configuration parameter
A named, adjustable variable — such as a setting, flag, threshold, or rule — in the hardware, software, or firmware of a system component whose value determines some aspect of that component's behavior or security posture. Configuration settings (of which configuration parameters are the constituent elements) are "the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system" (NIST SP 800-53r5, CM-6). Examples span registry settings, file and directory permission settings, settings for functions, protocols, ports, and remote connections, as well as privacy-affecting settings such as access controls, data processing preferences, and processing and retention permissions. In practice, compliance and audit frameworks treat configuration parameters as the lowest-level, individually assessable units of a system's configuration baseline: NIST SP 800-204A, for instance, organizes its deployment recommendations around configuration parameters for service-mesh components as the concrete mechanism by which security requirements for microservices applications are met.
Senses
No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.
A discrete, adjustable setting — such as a named variable and its assigned value — that governs the behavior, capability, or security posture of a hardware, software, or firmware component. Configuration parameters are distinguished from one another by the breadth of what they control: individually each represents a single knob (e.g., maximum password length, an allowed port, a timeout interval), but collectively they constitute the full configuration surface of a system and, together, determine whether that system meets an organization's security baseline. In security-focused configuration management, practitioners enumerate, assign values to, document, and monitor these parameters to enforce least-privilege operation and to detect unauthorized drift — covering components as varied as operating systems, network devices, and cryptographic modules.
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- configuration parameters
- possessive
- configuration parameter's
- pluralpossessive
- configuration parameters'