Cyber security threats: misconfigured access rights

The idea

Access rights are the permissions that decide which users, groups or processes may read, write, execute or delete a file, folder or system resource. A misconfiguration means those permissions are set wrongly, so someone gains access they should not have or is blocked from access they need. Typical faults include granting write or full-control permission to everyone, leaving default administrator credentials active, giving a whole department access to payroll data, or failing to remove a leaver's account. The weakness is not a broken algorithm but a human setup error, so attackers exploit it by simply logging in with excessive rights or escalating privileges. Reducing the risk means applying least privilege, reviewing permissions regularly, removing stale accounts and separating administrative from everyday accounts.

What earns the marks

• Identifies access rights as permissions controlling who can read, write, execute or delete a resource.
• Recognises that misconfiguration means permissions are set incorrectly, granting too much or too little access.
• Distinguishes misconfigured access rights from other threats such as malware, phishing or brute force.
• Explains that excessive permissions let an attacker access data without needing to break encryption.
• Links the fix to least privilege, regular permission reviews and removing accounts that are no longer needed.

Common mistakes and how to put them right

• Confusing access rights with antivirus software.

  Put it right: Access rights are permissions, not a scanning tool, so the correction is to describe who is allowed to do what.

• Assuming a misconfiguration is deliberate hacking.

  Put it right: The error is treating it as an attack method, when it is a setup mistake that an attacker can exploit.

• Thinking encryption alone prevents this threat.

  Put it right: Valid but excessive permissions bypass the need to decrypt anything.

• Ignoring the 'too little access' side.

  Put it right: Note that misconfiguration can also block legitimate users, causing denial of service.

Exam tips

• Read the scenario and ask who has permission to do what before choosing an option.
• Eliminate options describing malware, phishing or physical theft, since these are different threat categories.
• Look for wording such as 'everyone', 'default account' or 'full control', which signals a permission problem.