misconfiguration

{
  "id": "MLC-T-CYB-002692",
  "term": "misconfiguration",
  "field": "Cybersecurity",
  "definition": "1. An incorrect or subobtimal configuration of an information system or system component that may lead to vulnerabilities.\n\n2. An incorrect or suboptimal configuration of an information system or system component that may lead to vulnerabilities.\n\n3. A setting within a computer program that violates a configuration policy or that permits or causes unintended behavior that impacts the security posture of a system. CCE can be used for enumerating misconfigurations.\nNOTE: NIST generally defines vulnerability as including both software flaws and configuration issues [misconfigurations]. For the purposes of the validation program and dependent procurement language, the SCAP Validation program is defining vulnerability and misconfiguration as two separate entities, with “vulnerability” referring strictly to software flaws.",
  "references": [
    "NIST SP 800-128",
    "NISTIR 7511 Rev. 4",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/misconfiguration/"
}