During an initial demo with a water management company, Darktrace found an industrial control system exposed to the internet. Immediately, the organization went into incident response mode because this system was mission critical and could potentially impact the water facilities, as it had the power to adjust water flow.
This asset was exposed because of a simple misconfiguration, highlighting to the customer the need for proactive monitoring of its attack surface. In this case, the engineer who set up the system had simply not noticed the mistake, but these scenarios could be more dangerous and more likely if insider threat is involved.
The growing threat of misconfigurations in cybersecurity
Misconfigurations arise when vital security settings are either not applied or applied incorrectly. Such misconfigurations produce vulnerable security openings that can be exploited by attackers to either gain a foothold in the asset or generate a more dangerous attack, like altering water flow or deploying ransomware. There is a wide variety of assets that are subject to potential misconfigurations, including web or application servers, cloud containers, custom code, network devices like desktops or servers, and entire databases.
Unfortunately, the pervasiveness of misconfigurations is only increasing. In the past 12 months, there has been a 310% increase in hackers reporting misconfiguration vulnerabilities to the HackerOne platform.
Unique risks for industrial control systems and critical infrastructure
Every digital environment has its own characteristics that alter the prevalence or the impact of misconfigurations. For example, industrial devices that support critical infrastructure are all the more sensitive to these types of changes, as these devices often have limited integrated security, despite their highly delicate functions. Because with every vendor and device has its own recommended configuration, security teams must take additional precautions.
In cloud environments, the ease of deployment and increased capabilities also tend to produce more misconfigurations. Digital footprints are growing at such a pace that security departments may opt to skip onboarding processes of technologies to avoid becoming an obstacle for the business. It has become so easy for any department, regardless of their technical knowledge, to add cloud applications, software, or even hardware to the company's architecture. This is why shadow IT is so troublesome: it's impossible for the security team to ensure something is well configured if they don’t even know it exists.
In addition, due to rapid growth, security and IT teams aren’t experts in every technology included within the enterprise architecture. So, the teams may do their best to apply security controls while being unaware the current configuration is a misconfiguration. With digital assets’ constant evolution, they may even be configured correctly at one point but become misconfigured in the future if not updated.
Mitigating Misconfiguration
It’s human nature that we make mistakes, and the more assets and third parties that are introduced, the more mistakes are possible. However, there are certain steps organizations can take towards reducing the frequency and the impact of misconfigurations.
Any organization needs to have discovery processes to maintain an updated inventory of their assets, and should categorize these assets based on their exposure as well as their criticality to the business. This information should feed into the organization’s risk analysis, which in turn informs the priority of mitigation actions or controls. This process, when done manually, can be long and arduous, and is not continuous: as organizations’ digital footprints are evolving so rapidly, these analyses can become obsolete quickly.
On the other hand, organizations must also monitor the activity of these assets and not just assess them at face value. As with anything in security, security teams need to be weary of the symptoms. Inappropriate configurations will often generate alerts such as slow performance, multiple suspicious login attempts, bloatware, unexpected application behavior such as redirects or shutdowns.
Misconfigurations are easier to identify, prioritize and remediate with an AI solution that provides continuous analysis of the organization’s external and internal attack surface. Darktrace / Proactive Exposure Management and Darktrace / Attack Surface Management achieve exactly this.
Managing external assets
With ASM, security teams gain visibility of the entire external attack surface, including elusive assets like shadow IT and legacy devices. It frequently uncovers misconfigurations and recommends how to mitigate the risks caused by them. Some examples include email spoofing, no SPF records, no DKIM records, no DMARC records, subdomain takeover possible, and missing routes for netblocks.
The truly unique aspect of a Self-Learning technology is that security teams receive notifications tailored to the precise assets within their architectures. In other words, the tool will only provide the misconfiguration recommendations for the specific assets that require it, instead of having to reverse engineer state-of-the-art security and then trying to see where it can apply within the organization. With Darktrace, security teams are already getting that information directly. In fact, it doesn’t stop there, misconfigurations are prirotized by the risk inherited. The security team only has to check the list of misconfigurations in order of priority and take action on them.
Exposure management & attack paths
From an internal perspective, Darktrace / Proactive Exposure Management will map those misconfigurations to potential attack paths, answering the question of what damage each misconfiguration can lead to and more importantly how: an attacker could go from that initial misconfiguration through each lateral movement, whether it is via a device or a user, and then reach the most critical devices within the infrastructure.
Often in security, the focus can drift to the latest tactics and techniques being used by large Advanced Persistent Threats, but a simple misconfiguration caused by a rushed or distracted employee can pose an equally large threat. An innocent mistake can often open an even larger weakness in the digital architecture, as the attacker doesn’t have to force to open the window to break in.
%20copy.jpg)
.avif)
![Model alert in Darktrace / NETWORK showing the repeated SSL connections to a rare external Self-Signed endpoint, 185.49.126[.]50.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823ad5f8454ff831da3182a_Screenshot%202025-05-13%20at%201.35.56%E2%80%AFPM.avif)
![Darktrace’s detection of repeated connections to the suspicious IP address 185.49.126[.]50 over port 6606, indicative of beaconing behavior.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823adc5ac5c997938babf30_Screenshot%202025-05-13%20at%201.38.15%E2%80%AFPM.avif)
![Darktrace's Autonomous Response actions blocking the suspicious IP address,185.49.126[.]50.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6825268603a7a2b1459c9fea_Figure%204.avif)
![Darktrace’s detection of connections to the suspicious endpoint 195.26.255[.]81, where the default ports (6606, 7707, and 8808) for AsyncRAT were observed.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823ae6e325a742b23ef6e6d_Screenshot%202025-05-13%20at%201.41.09%E2%80%AFPM.avif)
![Darktrace's detection of a connection to the suspicious IP address 195.26.255[.]81 and the domain name identified under the common name (CN) of a certificate as AsyncRAT Server](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823aea233fc6374c1432604_Screenshot%202025-05-13%20at%201.42.00%E2%80%AFPM.avif)
![Darktrace’s Autonomous Response applied a total of nine actions against the IP address 191.96.207[.]246 and the domain 'kashuub[.]com', successfully blocking the connections.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6823af1b3cbc7734f47fc15b_Screenshot%202025-05-13%20at%201.43.56%E2%80%AFPM.avif)