Module 80: Security Assessment
Vulnerability review
🏠The everyday picture
A yearly health check-up goes through a set list: blood pressure, blood tests, eyes, teeth. The list makes sure nothing is forgotten, and the results are compared with last year's.
📘What it really is
- A vulnerability review is a planned check of your whole system against a known list, combining what you've learned:
- configuration: server hardening (Module 64), firewalls and open ports (Module 76), headers and TLS (Modules 66 and 75), storage privacy (Module 68);
- code: the OWASP Top 10 and API Top 10 (Modules 75 and 76), using your review checklist (Module 78) and static analysis results;
- access: roles, object-level checks, sessions, MFA, credentials (Module 74);
- dependencies and images: audits, scans, SBOM (Module 78);
- secrets and encryption: inventory, scans, rotation (Module 77);
- privacy: data inventory, retention, rights (Module 79);
-
operations: logging, alerts, backups and restore (Module 72).
-
OWASP ASVS Level 1 is a good published checklist for a first full review of a web app.
-
Rate each finding by severity (critical, high, medium, low), using impact and likelihood (Module 73) or CVSS. Critical means fix before anything else (for example, anyone can read all customers, or a database open to the internet).
-
Write findings clearly: what, where, how to reproduce (on your own system), impact, recommended fix, and status.
- Fix, then re-test to confirm each fix works, and add a test so it can't quietly come back.
- Repeat on a schedule (for example, every six months) and after big changes.
🖱️Try it
Run a full vulnerability review of your CRM using the list above and ASVS Level 1 as a guide. Record every finding in
security-review.md with severity and status. Fix all critical and high findings, re-test them, and add a regression test
for each.
✅Quick check
What should happen to a critical finding?
Show the answer
It's fixed before other work, then re-tested and covered by a test.
Why add a test for each fixed vulnerability?
Show the answer
So the same weakness can't return unnoticed in a later change.