Network configuration consists of the settings that determine how networked components communicate, and whether those components are exposed or isolated. It belongs to the infrastructure side of API security, alongside design, implementation, and configuration management. section 1.1
Network segmentation reduces the blast radius between components with different risk profiles by dividing a network into isolated subnets. A user service and an admin service should not have the same exposure: an SSRF flaw in the user service could otherwise help an attacker send requests toward internal services. section 1.1
Internal application exposed to the internet
An application intended only for employees and suppliers was accessible to anyone on the internet. That exposure represented a wrong network configuration and qualified as a security misconfiguration breach. Secure deployment practices, Infrastructure as Code, and repeatable pipelines help prevent such accidental exposure. section 5.4
Use these checks to reduce configuration-related risk:
- Isolate services according to their risk and sensitivity. section 1.1
- Apply secure configuration consistently with Infrastructure as Code and automated, repeatable deployment pipelines. section 5.4
- Run smoke tests after every deployment to detect common misconfigurations. section 5.4
