Skip to content
Saturday, 17 October 2026Threat Detection & DefenceCyber SafetyIdentity & AccessCloud SecurityDevices & IoT
Wire
01Cisco Umbrella Explained: Cloud Security for Users On and Off the Network02Why Remote Monitoring and Management Belongs in an MSP's Security Strategy03CyberArk Study Finds 95% of APJ Organisations Hit by Identity Breaches04Metaverse Security: The Attacks Businesses Expect as They Move Into Virtual Worlds
OpinionThreat Detection & DefenceCyber Safety

Six Checks to Find and Fix the Misconfigurations Quietly Weakening Your Network

Keysight's Scott Register cites the Verizon DBiR on rising error-driven breaches and lists six internal checks, from SSL decryption to URL filtering.

Cybersecurity ASEAN editors · 1 min read

The sudden move to remote work forced security teams into quick and risky decisions, argues Scott Register, vice president of security solutions in Keysight Technologies' Network Applications and Security Group. Controls were reconfigured, temporary policy exemptions granted and equipment sent to employees' homes. SecOps staff were themselves working from home, which cut their view of systems that might be compromised and often their access to reports, alarms and dashboards too. For security professionals, he says, working without that visibility is a nightmare.

Errors are the growing cause of breaches

Register points to the 2020 Verizon Data Breach Investigations Report (DBiR), which states that "the only action type that is consistently increasing year-to-year in frequency is Error." In his reading, the data shows misconfigurations, loose policies and plain mistakes to be among the biggest threats organisations face, and the report records a sharp rise in breaches caused by misconfigured security equipment.

The industry talks a great deal about insider threats, but he wants the term read broadly. The problem is mostly the routine work of security, IT and other staff producing misconfigurations that end in breaches, and much less a rogue employee. Knowing where those misconfigurations are, on a continuous basis, and how to correct them should in his view be a core principle for any SecOps team. They can be as simple as ports left open, defaults that are not set to catch data exfiltration, or a lack of time and resources to keep up with the flood of updates from trusted security vendors.

Web applications as the way in

According to the DBiR, 43% of breaches entered through web applications. Register notes that apps now appear so quickly that IT and security leaders struggle to keep track. With DevOps and cloud platforms such as AWS and Azure, anyone in a company can build and deploy an app for internal use. Such apps are usually never scanned, even for the OWASP (Open Web Application Security Project) top vulnerabilities, and since they often go live without SecOps knowing, no Web Application Firewall (WAF) protects them.

A WAF that is configured "correctly" may still fail, he adds, because teams do not fully understand WAF rules and the applications behind them keep changing. SecOps and IT need to pay closer attention to web application security without stifling innovation and growth. His suggestion is for security teams to set WAF policies for web apps that are easy to understand and then monitor the WAF continuously so that its rule signatures stay correctly configured.

Six assessments worth running now

Register accepts that errors and misconfigurations sound alarming but maintains they can be dealt with. Managing the organisation's risk profile is a strong security practice, though for some it requires a change of mindset: alongside acquiring the newest tools for defence and detection, teams need ways to test whether those tools work and to fix them when they do not. He recommends six internal assessments:

  1. SSL decryption misconfiguration. Decryption can slow applications and the network, so teams often switch it off for performance or troubleshooting, and an IPS does not work properly when SSL decryption is misconfigured. Testing with decryption switched on is the way to be sure the IPS is actually doing its job.
  2. Default protection profile. Outdated protection profiles cause trouble. Teams should find where their profiles sit, usually in browser and web app security. These are often overlooked or altered for performance, and failing to review them exposes web apps and the business.
  3. Little or no segmentation inside a security zone. Lateral movement is a real risk. After a temporary shutdown for troubleshooting or maintenance, teams often forget to segment network security zones again, and restoring them reduces that risk.
  4. Ineffective Data Loss Protection (DLP). Losing sensitive data is a problem that usually stems from not understanding how DLP behaves or where it is configured. NGFW and DLP settings need to be right so that employees or others cannot take sensitive data out, by accident or deliberately.
  5. Weak cloud WAF rule protection. A leaky cloud creates vulnerabilities. Like NGFW rules, WAF rules are complex and keep changing. Testing the WAF against the latest web application attacks shows clearly how to set and refine rules that stop attackers.
  6. URL filtering policy misconfiguration. Web searches can expose remote staff even when they use a VPN. Filtering policies are frequently changed during office moves or when staff are set up to work remotely over VPN. Checking that the rules still apply, over VPN as well, helps employees avoid spreading malvertising or malware.

More opinions