YanoSec
Progress0 of 152 lessons complete

Course / 12 Testing / Lesson 07 of 11

Why misconfiguration is the usual story

Estimated time: 14 min reading · 14 min activity

A misconfiguration is a setting that violates the intended requirement. Least privilege gives an identity the rights needed for its current task and no unnecessary authority. To assess a permission, first state the job; a grant cannot be judged excessive without that context.

A permission graph represents identities and resources as nodes, with an edge showing a relationship such as group membership or a right. In the fictional directory, lea belongs to readers. Group-granted rights therefore matter to the member as well as to the group label.

Before you begin

Estimated time
14 min reading, 14 min activity. Setup and optional practice may take longer.
Where you work
Use only the supplied North Desk fictional cards and source in a desktop or mobile browser. Keep predictions in private notes. No login attempt, recovery tool, framework module, permission change, domain setup or target connection is required. Optional later lab setup has a separate budget.
Without a lab
All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.

After this lesson you can:

  • Compare each edge on the fictional graph with the readers job.
  • Point at the edge that grants an admin password reset.
  • Recommend a narrower grant on paper without removing the only admin need.

01Example

Fresh job comparison, separate from the activity’s document and administrator.

Job: room attendants may list room bookings.
Grant: attendants may list bookings and delete accounts.
Mismatch: account deletion is outside the documented job.
Paper remedy: retain needed booking access and remove the unnecessary account-control right.

02Job, edge, and delegation

The activity job is read document-7 only. Edge E-1 supplies that read. Edge E-4 adds the ability to reset admin-mina’s password, an account-control operation outside the readers job. A permission’s impact follows from what it authorizes, not from how short its name looks.

Edge E-6 describes a different concept, delegation: service-notes may act on a client’s behalf toward files-3. It should be reviewed against its own job, but it is not the reset edge identified by this task. Keep distinct relationships separate.

A fitting paper remedy removes unnecessary grants while preserving intended work and a legitimate administrative recovery path. A graph review does not establish that a permission was changed or an account was accessed.

Compare a group’s rights with its documented job and propose a narrower grant.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Retain booking-list accessRemove excess account deletion
Documented job

Job: room attendants may list room bookings.

met · list room bookings matches the job.
Current grant

Grant: attendants may list bookings and delete accounts.

met · The grant includes booking listing.
Apply the stated rule
Retain needed access

A narrower proposal preserves the documented work.

A narrower permission proposal must preserve the needed job and legitimate administration; no real permission changes.

A narrower proposal preserves the documented work.

Follow the explanation

  1. A narrower proposal preserves the documented work.
  2. Keep booking access and legitimate administration; no real permission is changed.
Read every state and value

1. A narrower proposal preserves the documented work.

Case
list
Conditions inspected
Documented job · Current grant
Decision shown
Yes

2. Keep booking access and legitimate administration; no real permission is changed.

Case
delete
Conditions inspected
Documented job · Current grant
Decision shown
Yes
A narrower permission proposal must preserve the needed job and legitimate administration; no real permission changes.

03Mark the overbroad edge

Read the supplied graph as a model, not an export from a domain.

Directory permission graph
Label: original fictional directory club.lab.invalid. No directory was built and no account was changed.

Job for group readers: read document-7. Nothing else.

E-1 readers -> document-7: read. Matches the job.
E-4 readers -> admin-mina: reset password. Larger than the job.
E-6 service-notes -> files-3: may present a client's identity onward. That is delegation, named here and not used.
Membership: lea is in readers. Membership matters only with the rights the group has.

Least privilege, from Microsoft's administrative-model article: the minimum permissions for the current task, and nothing more.
E-4 is the overbroad edge for this job. Removing it is a recommendation on paper. Do not remove it here.

Download the fictional permission graph

  1. Copy the readers job and the membership line for lea.
  2. Compare E-1 and E-4 with that job. Identify E-4 as the extra reset-password right.
  3. Write a proposed narrower grant that retains document read. State a retest goal: readers can still perform the job without that account-control authority.
  4. Stop after the proposal. Do not reset a password, remove an edge or build a directory.

04Optional challenge

For about twelve optional minutes, specify two future checks after a hypothetical E-4 removal: the intended read remains, and a separately authorized administrator can still recover the directory. No graph file or real account is changed.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Graph card A: fictional job and edgesOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Job for group viewers: read document-12 only. Account Ivo belongs to viewers.
G2 viewers → document-12: read.
G5 viewers → admin-kai: reset password.
G8 recovery-admins → admin-kai: reset password; required authorized recovery path.
Ivo is not in recovery-admins. No other memberships or edges exist in this model.

Changed membership card B: independent graphOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Job for group indexers: list folder-6.
H1 indexers → folder-6: list.
H3 indexers → privileged account: reset password.
Mio initially belongs to indexers and no other group. The hypothetical change removes that membership.
No other rights are supplied.

06Explain the evidence and its limit

Optional self-check: describe the job, excessive edge and least-privilege proposal in a short private note.

Review it: cite edge ids, connect membership to rights, retain required work and recovery, and mark the proposed change as hypothetical.

07Common mistakes

If E-1 is removed merely because it grants something, revisit the job: useful work needs its appropriate permission.

If E-6 is substituted for E-4, name each edge’s actual right before choosing.

If the proposal removes all recovery authority, preserve a legitimate administrative path while narrowing the excessive group grant.

References