Security Audits

Purpose

A security audit is a systematic review of your systems, processes, and controls to find vulnerabilities. It is different from testing (which checks if something works) or compliance audits (which check if you meet regulations). Security audits ask: "Can an attacker break in?"

This guide explains how to conduct security audits appropriate for Startups and SMBs.

Context & Assumptions

Who this is for:

• Operations managers and IT administrators
• Business owners concerned about security
• Compliance or security officers

Key assumptions:

• You have a technology stack in place (email, cloud storage, databases, web applications)
• You do not have an in-house security team (yet)
• You want to identify and fix critical vulnerabilities before attackers exploit them

Types of Security Audits

1. Internal Security Review (In-house, Low Cost)

A self-assessment of your security practices using a checklist.

What to check:

• Passwords: Are they strong? Are they shared?
• Backups: Are backups working? Can you restore?
• Patches: Are systems updated?
• Access control: Who has access to what?
• Encryption: Is data encrypted at rest and in transit?
• Monitoring: Can you detect attacks?
• Incident response: Do you have a plan if something goes wrong?

Effort: 4–8 hours for a 30-person business Cost: Internal time only Frequency: Quarterly

2. Vulnerability Scan (Automated, Medium Cost)

Automated tools scan your systems for known vulnerabilities.

What it checks:

• Outdated software versions
• Missing security patches
• Misconfigured systems
• Weak passwords (if scanning internal systems)
• Open ports or services that shouldn't be exposed
• Missing encryption

Tools:

• Free: OpenVAS, Nessus Community Edition
• Paid: Qualys, Rapid7, Tenable

Effort: 2–4 hours to set up; automated thereafter Cost: $0–500/month Frequency: Monthly or continuous

Limitation: Automated scans find known vulnerabilities, not novel attacks.

3. Penetration Test (Pen Test) (Human Experts, High Cost)

Security experts attempt to break into your systems, reporting what they find.

What they test:

• Can they get in through your website?
• Can they escalate privileges (user → admin)?
• Can they access sensitive data (customer records, financial data)?
• Can they evade detection?
• Can they maintain access for long-term exploitation?

Effort: 1–2 weeks of expert work Cost: $5,000–$25,000 (depending on scope) Frequency: Annually or when major changes occur

When to consider: Growing business with significant customer/financial data at risk. This is not a "startup day 1" activity.

Internal Security Review Checklist

Conduct quarterly using this checklist:

Access & Authentication

• Passwords: Require minimum 12 characters, complexity?
• Multi-factor authentication (MFA): Enabled for email and critical systems?
• Shared passwords: Any shared accounts (e.g., "Finance" account used by multiple people)? If yes, create individual accounts.
• Inactive accounts: Disabled accounts removed? Last-login data reviewed?
• Privileged access: Who has admin access? Is it necessary? Limited to 3–5 people?

Data Protection

• Encryption at rest: Sensitive data encrypted on storage?
  • Email (encrypted by default in most cloud services)
  • Databases (encrypted by default in most cloud databases)
  • File storage (encrypted by default in Google Drive, OneDrive, Dropbox)
• Encryption in transit: Data encrypted when transmitted?
  • HTTPS enabled for all websites (check browser lock icon)
  • API connections use HTTPS or VPN
• Backup encryption: Backups protected with passwords/encryption?

Backup & Recovery

• Backups happening? Verify recent backups (last 24–48 hours)
• Backups tested? Restore from a backup to a test environment — does it work?
• Backup access: Only authorized people can restore from backups?
• Backup retention: Keeping backups long enough (30 days minimum, 90 days recommended)?

Patches & Updates

• OS updates: Servers and workstations on latest security patches?
• Application updates: Email, CRM, database, web servers updated?
• Third-party software: Dev tools, plugins, extensions up to date?

Network & Access Control

• Network segmentation: Production systems separated from development?
• Firewall: Web/API only accessible from expected IP ranges?
• VPN: Remote workers using VPN to access internal systems?
• Exposed services: Any unnecessary services exposed to the internet?

Monitoring & Logging

• Logs enabled: Email, systems, database logging enabled?
• Log review: Someone reviewing logs for anomalies (suspicious logins, data access)?
• Alerting: Critical alerts set for suspicious activity?
• Log retention: Logs kept for 90 days minimum?

Incident Response

• Incident plan: Do you have a written plan for "what if we're hacked"?
• Contact list: Security researcher, vendor support, legal?
• Notification plan: How will you notify customers if their data is breached?
• Communication channel: Secure way to communicate during incident (not email)?

Third-Party Risk

• Vendor access: Which vendors/contractors have access to your systems?
• Vendor agreements: Do contracts include security requirements?
• Vendor compliance: Are vendors meeting your security standards?

Physical Security

• Server access: Only authorized people can access servers/network equipment?
• Device security: Company devices password-protected?
• Unattended devices: Workstations lock after 10 minutes of inactivity?

Vulnerability Scan Process

If using an automated tool:

Step 1: Scope

Decide what to scan:

• Your website/web application?
• Internal network?
• Specific systems (database, email server)?

Important: Get permission before scanning. Unauthorized scanning may violate laws.

Step 2: Configure & Run

1. Install and configure the scanning tool
2. Add targets (IP addresses or domains to scan)
3. Run scan (takes 30 minutes to several hours depending on scope)
4. Review results

Step 3: Interpret Results

Results are typically rated:

Step 4: Remediate

For each finding:

1. Understand the vulnerability
2. Decide: fix it, accept the risk, or mitigate differently
3. Document your decision
4. Track fixes to completion

Example:

• Finding: OpenSSL version 1.0.1 detected (outdated, vulnerable)
• Remediation: Upgrade to OpenSSL 1.1.1 (2-hour task)
• Decision: Fix (critical)
• Owner: DevOps team
• Deadline: 2025-01-20

Step 5: Re-scan

After fixes, run the scan again to verify vulnerabilities are closed.

Penetration Testing

When do you need one? Consider if:

• You handle sensitive customer data (credit cards, health info, personal info)
• You operate in a regulated industry (finance, healthcare, government)
• You've experienced a security incident before
• Your business model depends on customer trust in your security
• You have significant funding and security is a priority

How to hire:

1. Get recommendations from industry peers or advisors
2. Verify the firm has certifications (CEH, OSCP, etc.)
3. Ask for references and past reports (redacted)
4. Define scope clearly: Which systems? What techniques allowed?
5. Require a detailed written report with findings and recommendations

Process:

1. Scoping call: Define what they'll test, rules of engagement
2. Testing phase: 1–2 weeks of active testing
3. Report: Written findings with severity ratings
4. Remediation: Fix critical/high issues
5. Retest: Confirm fixes work

Building a Remediation Plan

When vulnerabilities are found, track them:

Review remediation plan weekly. Vulnerabilities don't fix themselves.

Incident Response Plan

In case of a security incident (breach, ransomware, attack):

1. Detect: How will you know?
2. Respond: What's the first action?
3. Contain: How do you prevent spread?
4. Eradicate: How do you remove the attacker?
5. Recover: How do you restore systems?
6. Communicate: Who do you notify?

Example plan:

• Detection: Security alerts, customer reports, or vendor notification
• Immediate (first 1 hour): Incident commander declared, isolate affected systems, preserve evidence (logs, memory), notify leadership
• Contain (hours 1–24): Change passwords, disable compromised accounts, block attacker IPs
• Investigate (1–7 days): Determine scope (what was accessed?), forensic analysis
• Communicate: If customer data leaked, notify affected customers and regulators
• Remediate: Patch vulnerabilities, improve monitoring, update security controls

Common Pitfalls

• No ongoing monitoring — One-time audit in 2023, none since. Security is not a project; it's continuous.
• Ignoring low-severity findings — Today's "low" might be tomorrow's vulnerability chain. Don't ignore.
• No remediation tracking — Findings identified but never fixed. This provides false confidence.
• Over-reliance on tools — Automated scans find known vulnerabilities, not novel attacks. Combine with human review.
• No incident response plan — When something goes wrong, scrambling. Have a plan before you need it.
• Skipping penetration testing because it's expensive — If you handle important data, a $10K pen test is cheap vs. a $1M breach.
• Not educating employees — Most breaches involve social engineering. Phishing training is essential.

Practical Example: 25-Person Marketing Firm

Security audit schedule:

Year 1 investments:

• Vulnerability scanning tool: $200/year
• Penetration test: $8,000
• Total: ~$8,200 + internal time

Result: Identified and fixed:

• Outdated WordPress plugin (critical)
• Weak password policy (high)
• No MFA on admin accounts (high)
• Unmonitored logs (medium)
• Missing encryption on backup storage (medium)

Outcome: Significantly reduced breach risk and improved security posture

Related Documentation

• Maintenance Strategy — Operationalize security audits
• Updates & Patching — Remediate vulnerabilities
• Access Reviews — Access control is part of security
• Security Basics — Foundational security concepts

This documentation is for informational purposes only and does not constitute security or legal advice. For security audit planning and execution, consult qualified security professionals and your legal team.