misconfigured

Misconfigured is an adjective used to describe systems, software, devices, or services that have not been set up according to their intended design, policies, or security requirements. Misconfigurations can occur in computing environments such as servers, network devices, cloud infrastructure, containers, databases, and security controls, but they can also appear in non-IT contexts. They typically result from human error, ambiguous requirements, reliance on default settings, automation gaps, or configuration drift between environments.

In information technology, misconfigurations can lead to performance problems, outages, data exposure, or security vulnerabilities. Examples include publicly accessible storage buckets, weak or default credentials, insecure TLS configurations, or overly permissive access policies. The consequences may encompass downtime, regulatory risk, and costly remediation, especially in regulated industries or where sensitive data is involved.

Detection of misconfigurations relies on configuration management practices, drift detection, vulnerability and compliance scanners, and manual or automated reviews. Maintaining accurate baselines, inventories, and change records helps identify deviations from approved configurations. Remediation involves bringing configurations back in line with policy, applying least-privilege principles, removing defaults, and enforcing formal change control.

Preventive measures emphasize standardization, version-controlled infrastructure as code, automated testing, and sandboxed validation before deployment. Regular audits and continuous monitoring of configurations help reduce drift and improve resilience. Proper governance and documentation support consistent, secure, and reliable system deployments.

See also: configuration management, security misconfiguration, drift, vulnerability scanning.