TodayTools

Security Auditing flashcards

Plan, buy and act on authorised security audits so weak spots get fixed before attackers find them.

Donate
Beginner friendly, starts from zero
Section
How to study
0
Security AuditingStart from zero · 1 of 12

What is a security audit, in one plain sentence?

A planned, careful check of a company's computer systems to find weak spots before criminals do, ending in a written report of what to fix first.

Find the holes before someone else does.

All topics

Security Auditing at a glance

A security audit is a planned check of a company's systems to find weak spots before criminals do.

Like hiring someone, with your written permission, to test every door, window and lock of your home and give you a list of what to fix.

Words you will meet

Vulnerability
A weakness an attacker could use, like an unlocked door
Risk
How likely a harm is and how bad it would be
Scope
The exact list of what may be tested
Authorisation
Written permission from the owner to run the test
Penetration Testing
A skilled person safely trying to break in to prove a weakness is real
False positive
A reported problem that turns out not to be real
Staging
A copy of the live system used for testing

The steps

  1. 1. Start from zero (12 cards): What an audit is, why companies need one, and the plain meaning of every word auditors use.
  2. 2. Core basics (16 cards): What an audit buys you, scope, permission and the three test styles.
  3. 3. Next steps (17 cards): Rules of engagement, test methods, CVSS 4.0 ratings, evidence, reports and fix tracking.
  4. 4. Go deeper (18 cards): Cloud reviews, standards, CERT-In auditors, risk decisions and running a testing programme.
All 12 cards in Start from zero
What is a security audit, in one plain sentence?
A planned, careful check of a company's computer systems to find weak spots before criminals do, ending in a written report of what to fix first.
What problem does an audit solve? What happens without one?
Without checks, a company often learns about a hole only after a break-in: stolen customer data, lost money, fines and angry customers. An audit finds the hole while it is still cheap to fix.
Where do security checks already touch your daily life?
Your banking app, a hospital's patient records and an online shop all get checked like this. It is the same idea as a fire safety inspection of a building you work in.
What everyday thing is a security audit like?
Like hiring someone to test your home's doors, windows and locks, with your written permission, and hand you a list: this window does not lock, this key is under the mat.
What do system, app, server, API and source code mean?
A system is any computer setup a company runs. An app is software people use; a server is a computer that runs it. An API is the door apps use to talk to servers. Source code is what programmers write.
What are a vulnerability, an attacker and an exploit?
A vulnerability is a weakness, like an unlocked door. An attacker is a person who tries to misuse it. An exploit is the trick or tool that actually uses the weakness to get in.
What are a threat and a risk?
A threat is who or what could cause harm, like a thief or a flood. Risk is how likely that harm is and how bad it would be. A weak lock on an empty shed is low risk.
What do scope and authorisation mean in an audit?
Scope is the exact list of what may be checked, like one website and one app. Authorisation is the signed, written permission from the owner that allows the check to happen.
What is the difference between a scanner and a penetration test?
A scanner is a tool that checks systems on its own and lists possible weak spots. In a penetration test, a skilled tester, often called an ethical hacker, safely tries to break in to prove which spots are real.
What are production, staging, a finding and a false positive?
Production is the live system real customers use; staging is a copy for testing. A finding is one problem in the report. A false positive is a reported problem that turns out not to be real.
What do you need before you start?
No coding is needed for this topic, just a basic idea of how websites and logins work. For hands-on practice later, use only systems you own or have written permission to test.
What will you be able to do after this topic?
Plan an audit, set its scope and permission, choose the right test style, read a report and rank findings by risk, and follow through until each problem is fixed and retested.
Security Auditing cheatsheet

Before testing starts

  • Authorisation letter Signed by asset owner: scope, dates, testers, IPs
  • Scope list Domains, IPs, apps, APIs, builds; out of scope named
  • Rules of engagement Windows, banned tests, stop conditions
  • Test accounts One per role, expiring after the test
  • Emergency contacts Both sides, reachable during test hours
  • Third party consent Vendor or SaaS owner agrees in writing
  • Backups and SOC notice Restore point taken, monitoring team told

CVSS 4.0

  • 0.1 to 3.9 Low
  • 4.0 to 6.9 Medium
  • 7.0 to 8.9 High
  • 9.0 to 10.0 Critical
  • CVSS-B Base metrics only
  • CVSS-BT Base plus threat (exploit maturity)
  • CVSS-BTE Base, threat and your environment
  • KEV / EPSS Known exploited / chance of exploit in 30 days

Fix targets (example policy)

  • Critical Fix or block in 7 to 15 days
  • High 30 days
  • Medium 90 days
  • Low 180 days or next release
  • Known exploited (KEV) Jump the queue whatever the score
  • Cannot fix in time Signed risk acceptance with expiry

Frameworks and what they ask

  • ISO 27001:2022 8.8 Manage technical vulnerabilities
  • ISO 27001:2022 8.29 Security testing in development
  • SOC 2 CC7.1 Detect configuration and new vulnerabilities
  • PCI DSS 4.0.1 11.3 Quarterly internal and external scans
  • PCI DSS 4.0.1 11.4 Pentest yearly and after big change
  • CERT-In 2022 directions Report incidents in 6 hours, keep logs 180 days
  • OWASP ASVS 5.0 / MASVS Web and mobile test checklists
  • NIST SP 800-115 How to plan and run security tests

Defensive tools

  • npm audit --audit-level=high Known flaws in Node packages
  • pip-audit -r requirements.txt Known flaws in Python packages
  • trivy fs . Scan code folder for library flaws and secrets
  • trivy config ./infra Risky settings in infrastructure code
  • checkov -d ./infra Policy checks on Terraform and more
  • prowler aws Cloud account settings review
  • zap-baseline.py -t URL Passive web scan for CI

Report and closure

  • Executive summary Plain words, top risks, overall posture
  • Scope and method What was and was not tested, and how
  • Findings table Sorted by severity with CVSS vector
  • Each finding Impact, evidence, steps, fix
  • Tracker Owner, due date, status per finding
  • Closure report Re-test result: closed, open, accepted
Donate