--- path: onboarding/security-review/intro.mdx title: Security review sidebar_label: Overview sidebar_position: 1 slug: security-review pagination_next: null pagination_prev: null description: >- Security review guide for Passwork deployments: a structured checklist for information security specialists covering server hardening, authentication policies, roles and permissions, encryption, and monitoring. keywords: - Passwork - security review - security audit - compliance - information security - hardening - checklist - ISMS - ISO 27001 --- This guide is for **information security specialists**, **compliance officers**, and **security engineers** who can confirm that a Passwork deployment meets organizational and regulatory security standards. The review is structured as a series of domain-specific checklists. Each item links to the relevant configuration documentation. Work through the checklist after initial deployment and repeat it periodically (recommended: quarterly) or following significant configuration changes. ## Scope This review covers the following security domains: | Domain | Page | |--------|-----------| | Server and network security | [Server security](./server-security.mdx) | | Authentication policies | [Authentication audit](./authentication-audit.mdx) | | Roles and access control | [Roles and permissions](./roles-and-permissions.mdx) | | Encryption architecture | [Encryption review](./encryption-review.mdx) | | Monitoring and incident response | [Monitoring and response](./monitoring-and-response.mdx) | --- ## Master security checklist Use this high-level checklist for a rapid initial assessment. Each item references the detailed section where findings are documented and remediated. ### Server and network - [ ] HTTPS enforced on all endpoints; HTTP redirects to HTTPS - [ ] Valid SSL/TLS certificate installed (not self-signed in production) - [ ] TLS 1.2 minimum; TLS 1.3 preferred; SSLv3/TLS 1.0/1.1 disabled - [ ] Security headers present: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy - [ ] MongoDB port (27017) not accessible from the internet - [ ] `IS_EMERGENCY_RESET_ENABLED` is **not** set to 1 in config.env (on-premise only) - [ ] Health check endpoint protected with `HEALTH_CHECK_TOKEN` - [ ] Trusted proxies list is restricted to known reverse proxy IPs - [ ] CORS origin not set to * if Passwork is exposed to untrusted origins - [ ] Background tasks (cron) are running and LDAP sync is current ### Authentication - [ ] Two-factor authentication enforced via role policy for all administrative roles - [ ] 2FA enforced or strongly recommended for all users (not optional) - [ ] Account lockout after ≤ 5 failed attempts - [ ] Session timeout configured (recommended: ≤ 60 minutes of inactivity) - [ ] Local password complexity policy: ≥ 12 characters, mixed case + digit + symbol - [ ] Master password complexity policy configured (if CSE is enabled) - [ ] LDAP communication uses LDAPS (TLS) — not plain LDAP on port 389 - [ ] SSO configuration uses a trusted IdP; only necessary claims are mapped - [ ] No user accounts with authentication disabled without documented justification ### Roles and access control - [ ] No users assigned the Owner role unnecessarily (maximum 1 Owner) - [ ] Administrative accounts are separate from daily-use accounts - [ ] Default Member role does not have access to vault creation, user management, or settings - [ ] Custom roles follow the principle of least privilege - [ ] Role-based user management is enabled for department-level admin roles (separation of duties) - [ ] All Corporate vaults have at least one explicitly assigned corporate administrator - [ ] Private vault restrictions reviewed (can users create private vaults without oversight?) - [ ] Service account for emergency vault access exists and is blocked (cannot sign in) - [ ] Access to API token generation is restricted by role policy - [ ] No long-lived inactive user accounts with active vault access ### Encryption - [ ] CSE (client-side encryption) status documented and intentional (enabled or disabled with justification) - [ ] If CSE is disabled: deployment is within a trusted perimeter; server-side encryption is verified active - [ ] If CSE is enabled: master password complexity policy is configured; help desk trained on reset consequences - [ ] Server encryption key (`encryption_key` file) is stored outside the web root and access is restricted - [ ] Backup archives are encrypted before storage ### Monitoring and audit - [ ] Activity log (audit log) is enabled - [ ] Syslog / Windows Event Log forwarding configured for SIEM integration - [ ] Audit log retention period meets regulatory requirements - [ ] Security Dashboard has been run and critical findings addressed - [ ] No compromised passwords present (users with revoked access whose passwords were not rotated) - [ ] Alert configured for repeated failed authentication attempts --- ## Regulatory alignment | Requirement | Passwork capability | Section | |-------------|---------------------|---------| | ISO 27001 A.9 — Access control | RBAC, vault access levels, role policies | [Roles and permissions](./roles-and-permissions.mdx) | | ISO 27001 A.10 — Cryptography | AES-256, RSA-2048, PBKDF2, Zero-Knowledge | [Encryption review](./encryption-review.mdx) | | ISO 27001 A.12.4 — Logging and monitoring | Activity log, CEF/Syslog, SIEM | [Monitoring and response](./monitoring-and-response.mdx) | | ISO 27001 A.14 — System security | Security headers, TLS, network hardening | [Server security](./server-security.mdx) | | GDPR Art. 32 — Security of processing | Encryption, access controls, audit trail | All sections | | NIST SP 800-63B — Authentication | 2FA, lockout, session management | [Authentication audit](./authentication-audit.mdx) | --- ## Prerequisites Before starting the review, obtain: - Access to the Passwork admin panel with **Owner** or **Admin** role - SSH or RDP access to the server (on-premise only) or access to the cloud admin console - Access to config.env or equivalent configuration (on-premise only) - The current LDAP/SSO configuration details - The organization's access control policy document (for comparison) - Results of the previous security review (if applicable)