Excessive data exposure occurs when data like credit cards, personal information, or browsing habits are not properly secured by an application. This can lead to reputational risks if the exposure occurs. To prevent it, developers should carefully consider what data needs to be stored, encrypt data by default, store encryption keys separately from the encrypted data when possible, and get security advice from trusted sources. Security misconfiguration is another common issue where missing permissions, unused features, default accounts, or outdated security settings leave systems vulnerable. Developers can address this by implementing consistent processes for server hardening, code reviews, configuration reviews, and deployments. They should also regularly check for new vulnerabilities and segment systems to reduce risks.

1. Excessive Data Exposure
What is it?
•Some data has high value e.h. Credit cards, credentials, other personal
data, browsing habits, financial information
•If this data is not correctly handled by your application, data exposure
is a serious risk
•Reputational risks if it occurs
•Directly vulnerable or caused by poor quality controls
•Often secondary to another type of attacks

2. Excessive Data Exposure (Cont.)
How to fix it?
• Take a considered view to data value
• Remove data you don't need
• Learn about encryption
• Encryption is generally lightweight so you use by default
• Consider multiple levels of encryption
• Do not store encryption keys with data
• Use hardware protection of keys where possible
• Be careful where you get your advice from!

3. Security Misconfiguration
What is it?
• Missing security hardening or incorrect permissions on app
• Unnecessary features/ports are available
• Default accounts enabled
• Error leakage
• Updated security features are left disabled or misconfigured
• Insecure configuration in web app or server frameworks
• Lack of security headers
• Vulnerable components used

4. Security Misconfiguration (Cont.)
How to fix it
• Consistent process for server and app hardening
o Development
o Code review
o Configuration
o Deployment
• Consider minimal server as starting point
• Regular consideration of new vulnerabilities
• Segmentation of systems to reduce risk
• Automated and online server checks