# Insecure Default Initialization of Resource (CWE-1188)

The product initializes a resource in an insecure way that is not in line with the intended privileges for the resource.

**Stack:** Kubernetes

- Prevalence: 높음 자주 악용됨
- Impact: 보통 검토 권장
- Prevention: 문서화됨 2개의 수정 예시

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

When resources are initialized with insecure default settings, they may expose functionality or data that should be protected. Users may not realize they need to change default settings.

## Prevention

2개의 Shoulder 탐지 규칙을 기반으로 한 Insecure Default Initialization 예방 전략.

### Kubernetes

Deploy resources to an explicit namespace instead of 'default' for better isolation

Add liveness and readiness probes to ensure Kubernetes can monitor container health

## Warning Signs

- [LOW] Resource deployed to default namespace instead of explicit namespace
- [LOW] resources deployed to the default namespace
- [LOW] Container is missing liveness and/or readiness probes.
- [LOW] containers missing liveness and/or readiness probes

## Consequences

- 보호 메커니즘 우회
- 애플리케이션 데이터 읽기
- 권한 획득

## Mitigations

- 모든 구성에 안전한 기본값을 사용하세요
- 설정의 보안 영향을 문서화하세요
- 안전하지 않은 옵션은 명시적인 옵트인을 요구하세요

## Detection

- Total rules: 2
- Languages: yaml

## Rules by Language

### Yaml (2 rules)

- **Using Default Namespace** [LOW]: Detects resources deployed to the default namespace.
  - Remediation: Use an explicit namespace instead of 'default' for better organization and isolation.
- **Missing Health Probes** [LOW]: Detects containers missing liveness and/or readiness probes.
  - Remediation: Add liveness and readiness probes.

```yaml
livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
```

Learn more: https://shoulder.dev/learn/kubernetes/cwe-1188/missing-health-probes