Insufficient security configurability