Security Audit Checklist
Audit your application security with a structured approach to authentication, data protection, infrastructure hardening, and vulnerability management.
Checklist: Security Audit (engineering)
Security vulnerabilities are discovered after deployment, not during development. A structured security audit catches common weaknesses before attackers do. This checklist covers the critical areas from authentication and authorization through data protection and infrastructure security.
Checklist Items
- Verify authentication implementation [critical]: Audit password hashing (bcrypt/argon2), session management, MFA, and account lockout policies.
- Review authorization and access controls [critical]: Verify RBAC implementation, ensure users cannot access other users data, and test privilege escalation paths.
- Scan for OWASP Top 10 vulnerabilities [critical]: Run automated scanners for SQL injection, XSS, CSRF, SSRF, and other OWASP Top 10 issues.
- Audit data encryption [important]: Verify encryption at rest for databases and file storage, TLS for all network communication, and key management.
- Review dependency vulnerabilities [important]: Scan all dependencies with Snyk, Dependabot, or npm audit. Patch critical and high severity issues.
- Verify secrets management [important]: Ensure no hardcoded API keys, passwords, or tokens in code, configs, or Docker images.
- Audit logging and monitoring [important]: Verify security events are logged with timestamps, user context, and IP addresses for incident response.
- Test rate limiting and abuse prevention [recommended]: Verify rate limits on authentication, API, and form submission endpoints to prevent brute force and abuse.
- Review CORS and CSP policies [recommended]: Ensure CORS headers restrict origins appropriately and Content Security Policy prevents inline script execution.
- Conduct penetration testing [recommended]: Perform manual penetration testing on critical flows including authentication, payment, and admin functions.
Common Mistakes
- Security as an afterthought: Integrate security scanning into CI/CD. Catch vulnerabilities during development, not after deployment.
- Ignoring dependency vulnerabilities: Enable automated dependency scanning and patch critical vulnerabilities within 48 hours of disclosure.
- Overly broad CORS policies: Never use wildcard CORS origins in production. Whitelist specific trusted domains.
Frequently Asked Questions
- How often should I conduct security audits?
- Quarterly for high-risk applications, semi-annually for most applications, and after any major feature release or architecture change.
- Should I hire external penetration testers?
- Yes, at least annually. Internal teams develop blind spots. External testers bring fresh perspective and adversarial thinking.
- What is the most commonly exploited vulnerability?
- Broken access control is the number one OWASP vulnerability. Users accessing data or functions they should not have permission to reach.