Cybersecurity · Intermediate level

Intermediate level · Module 3: Web and Application Security Awareness · Lesson 2 of 3

Secure Configuration of Web and SaaS Tools

Configure websites and cloud services so defaults do not expose data.

In this lesson you will

  • Identify security misconfiguration
  • Apply secure settings to SaaS tools

Key concepts

security misconfigurationadmin accountssharing settingsupdates and plugins

The lesson

Many breaches come from misconfiguration rather than clever attacks: default admin passwords, public file-sharing links, outdated website plugins and unnecessary features turned on.

For website platforms, keep the core and plugins updated, remove unused plugins and protect admin logins with MFA.

For cloud tools such as email and file storage, enforce MFA, review sharing defaults and external sharing, and limit admin roles.

Step by step

  1. Review a site's plugins and admin accounts.
  2. Check file-sharing defaults.
  3. Enforce MFA for admins.
  4. Write a configuration checklist.

Practice activity

Write a secure configuration checklist for the organisation's website and cloud tools.

Expected result: A checklist covering updates, admin access, MFA and sharing.

Check your understanding

  1. Give two examples of security misconfiguration.

    Show answer

    Default admin passwords, public sharing links, outdated plugins or unneeded features enabled.

  2. Why remove unused plugins?

    Show answer

    They add vulnerabilities without benefit.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.