Service Misconfig

Authentication

• default creds/weak passwords
• Anonymous Login
• Misconfigured access (incorrect permissions)
• RBAC, ACL - https://authress.io/knowledge-base/role-based-access-control-rbac

Unnecessary Defaults

• New software might ask for a new password but the rest of the settings might still be default
• 

Preventing Misconfig

• once environment is figured out.
• lock down most critical infra
• only allow desired behavior
•