Security Audit Checklist: A Practical Guide to Protecting Your Systems

A security audit is a systematic evaluation of your organization's information systems, policies, and procedures — the goal being to find vulnerabilities before attackers do. Unlike penetration testing, which simulates active attacks, a security audit examines your entire security posture through documentation review, configuration analysis, and compliance verification. This checklist walks you through the critical areas: authentication, network infrastructure, data protection, and incident preparedness.

Authentication and Access Control

Authentication is your first line of defense. Start by auditing how users prove their identity and what they can access once they're in.

Review password policies and storage. Check that passwords meet minimum complexity requirements: at least 12 characters with mixed case, numbers, and symbols. Verify that passwords are hashed using modern algorithms like Argon2, bcrypt, or PBKDF2 with appropriate work factors. Never store passwords in plaintext or use outdated methods like MD5 or SHA-1 without salting.

# Check password hashing algorithm in a Linux system
sudo grep -E 'ENCRYPT_METHOD|SHA_CRYPT' /etc/login.defs

# Verify PAM password quality settings
sudo cat /etc/security/pwquality.conf | grep -v '^#' | grep -v '^$'

Audit multifactor authentication implementation. MFA requires two or more independent credentials — something you know (password), something you have (phone or hardware token), or something you are (biometric). Verify that it's enforced for all privileged accounts, remote access, and administrative interfaces. Check that backup codes are provided and securely stored. Where possible, avoid SMS-based MFA; SIM-swapping attacks make it unreliable. Authenticator apps or hardware tokens like YubiKey are much stronger options.

Examine access control lists and permissions. Review which users have administrative privileges. The principle of least privilege is simple: people should only access what their role actually requires. Check for orphaned accounts from former employees, shared credentials, or generic accounts like "admin" or "webmaster" that multiple people use — these are audit red flags every time.

# List users with sudo privileges
sudo grep -Po '^sudo.+:\K.*$' /etc/group

# Find files with SUID bit (potential privilege escalation)
find / -perm -4000 -type f 2>/dev/null

Network Security and Infrastructure

Network security controls how data flows between systems and who can reach your infrastructure in the first place.

Map and segment your network architecture. Document all network segments, VLANs, and trust boundaries. Critical systems like databases and payment processors should sit in isolated segments with strict firewall rules. Guest WiFi must be completely separated from corporate networks. Review firewall rules to confirm they follow a default-deny policy — block everything except explicitly permitted traffic.

Audit exposed services and ports. Scan all internet-facing systems to identify open ports and running services. Common problems include unnecessary services left running, outdated protocols like Telnet or FTP, and misconfigured web servers that reveal directory listings or debug information to anyone who looks.

# Scan for open ports on a target system
nmap -sV -p- 192.168.1.100

# Check listening services on local machine
ss -tulpn | grep LISTEN

Review remote access mechanisms. SSH should use key-based authentication with password authentication disabled. Check that root login is prohibited and that idle sessions time out. VPN configurations should use strong encryption (AES-256), certificate-based authentication, and split-tunneling policies that prevent unauthorized traffic from bypassing your security controls.

# Audit SSH configuration
sudo grep -E 'PermitRootLogin|PasswordAuthentication|PubkeyAuthentication' /etc/ssh/sshd_config

Data Protection and Encryption

Protecting data at rest and in transit means that even when other security controls fail, unauthorized disclosure isn't guaranteed.

Verify encryption for data at rest. All sensitive data stored on servers, databases, and backup media should be encrypted. Check that full-disk encryption is enabled on laptops and mobile devices. For databases, transparent data encryption (TDE) works well for general protection, but particularly sensitive fields like credit card numbers or social security numbers often warrant application-level encryption on top of that.

“The only secure computer is one that's unplugged, locked in a safe, and buried 20 feet under the ground in a secret location.”

— Dennis Hughes

Audit data in transit protection. All web applications must use HTTPS with TLS 1.2 or higher. Verify that TLS certificates are valid, properly configured, and use strong cipher suites. Test for mixed content warnings that can quietly downgrade security. Internal services talking to each other between servers should use encryption too — internal traffic isn't automatically safe.

# Test TLS configuration and cipher suites
nmap --script ssl-enum-ciphers -p 443 example.com

# Verify certificate details
openssl s_client -connect example.com:443 -servername example.com < /dev/null | openssl x509 -noout -text

Review email security implementations. PGP or S/MIME protects message contents from interception. Rolling it out organization-wide is genuinely complex, but critical communications around security incidents, financial data, or personal information should use it. Also verify that SPF, DKIM, and DMARC records are configured correctly — these three together do a lot to prevent email spoofing.

Logging, Monitoring, and Incident Response

Security controls are only effective if you can detect when they're being bypassed or attacked. Logging is how you find out.

Audit logging coverage and retention. Verify that all critical systems generate logs for authentication attempts, privilege escalation, configuration changes, and data access. Logs should be centralized, encrypted in transit to the log server, and stored for at least 90 days. Check that log timestamps are synchronized using NTP and that logs are write-once — if an attacker can modify your logs, you've lost your evidence trail.

# Verify NTP synchronization
timedatectl status

# Check syslog configuration
sudo cat /etc/rsyslog.conf | grep -v '^#' | grep -v '^$'

Review alerting rules and thresholds. Automated alerts should fire on suspicious activity: multiple failed login attempts, privilege escalation, unusual data transfers, or configuration changes outside maintenance windows. Test that alerts actually reach your security team. Alert fatigue is a real problem — if everything is urgent, nothing is.

Validate incident response preparedness. Does your team know exactly what to do when something goes wrong? Your audit should confirm that an incident response plan exists, has been tested through tabletop exercises, and includes contacts for legal counsel, law enforcement, and third-party forensics if needed. Check that system backups are regularly tested and stored offline where ransomware can't reach them.

Patch Management and Vulnerability Remediation

Unpatched systems are the most common entry point for attackers. Your audit needs to assess how quickly vulnerabilities get identified and fixed.

Inventory all software and versions. You can't patch what you don't know exists. Document all operating systems, applications, libraries, and dependencies. Use automated tools to track software versions and compare against known vulnerability databases like the National Vulnerability Database (NVD).

**Assess patc