# Insecure Default Initialization of Resource (CWE-1188)

The product initializes a resource in an insecure way that is not in line with the intended privileges for the resource.

**Stack:** Kubernetes

- Prevalence: 高 頻繁に悪用される
- Impact: ミディアム レビュー推奨
- Prevention: 文書化済み 2 件の修正例

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

When resources are initialized with insecure default settings, they may expose functionality or data that should be protected. Users may not realize they need to change default settings.

## Prevention

2 件の Shoulder 検出ルールに基づく Insecure Default Initialization の予防策。

### Kubernetes

Deploy resources to an explicit namespace instead of 'default' for better isolation

Add liveness and readiness probes to ensure Kubernetes can monitor container health

## Warning Signs

- [LOW] Resource deployed to default namespace instead of explicit namespace
- [LOW] resources deployed to the default namespace
- [LOW] Container is missing liveness and/or readiness probes.
- [LOW] containers missing liveness and/or readiness probes

## Consequences

- 保護メカニズムの回避
- アプリケーションデータの読み取り
- 権限の取得

## Mitigations

- すべての構成に安全なデフォルト値を使用する
- 各種設定のセキュリティ上の影響を文書化する
- 安全でないオプションには明示的なオプトインを要求する

## Detection

- Total rules: 2
- Languages: yaml

## Rules by Language

### Yaml (2 rules)

- **Using Default Namespace** [LOW]: Detects resources deployed to the default namespace.
  - Remediation: Use an explicit namespace instead of 'default' for better organization and isolation.
- **Missing Health Probes** [LOW]: Detects containers missing liveness and/or readiness probes.
  - Remediation: Add liveness and readiness probes.

```yaml
livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
```

Learn more: https://shoulder.dev/learn/kubernetes/cwe-1188/missing-health-probes