security-audit

Follow an eight-step process: define scope, gather architecture and data flow information, perform STRIDE threat modeling, run automated and manual vulnerability scanning, assess risks by severity and likelihood, document findings with proof of concept, prioritize remediation, and create a 30/60/90-day roadmap.

STRIDE analyzes six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. For each category, you identify attack vectors, list existing controls, and assign a risk rating to guide remediation priorities.

The audit references OWASP ZAP and Burp Suite for dynamic testing, Nmap for network scanning, AWS Security Hub for cloud posture, Bandit for Python static analysis, and Safety or Snyk for dependency CVE detection.

Findings are scored with CVSS and grouped into Critical, High, Medium, and Low. Critical issues like SQL injection and hardcoded credentials must be fixed within 7 days, High priority within 30 days, and Medium/Low items scheduled in months two and three.

The audit checks for publicly accessible S3 buckets, RDS databases exposed to the internet, and overprivileged IAM roles with wildcard permissions. Fixes include bucket deny policies, private subnet placement, and least-privilege IAM policies.

Dependency scanning should run in CI/CD pipelines to block merges containing High or Critical vulnerabilities. Tools like Snyk or Safety detect outdated packages with known CVEs, such as end-of-life Django versions with remote code execution flaws.