Security review

This guide is for information security specialists, compliance officers, and security engineers who can confirm that a Passwork deployment meets organizational and regulatory security standards.

The review is structured as a series of domain-specific checklists. Each item links to the relevant configuration documentation. Work through the checklist after initial deployment and repeat it periodically (recommended: quarterly) or following significant configuration changes.

Scope

This review covers the following security domains:

Domain	Page
Server and network security	Server security
Authentication policies	Authentication audit
Roles and access control	Roles and permissions
Encryption architecture	Encryption review
Monitoring and incident response	Monitoring and response

---

Master security checklist

Use this high-level checklist for a rapid initial assessment. Each item references the detailed section where findings are documented and remediated.

Server and network

• HTTPS enforced on all endpoints; HTTP redirects to HTTPS
• Valid SSL/TLS certificate installed (not self-signed in production)
• TLS 1.2 minimum; TLS 1.3 preferred; SSLv3/TLS 1.0/1.1 disabled
• Security headers present: Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• MongoDB port (27017) not accessible from the internet
• IS_EMERGENCY_RESET_ENABLED is not set to 1 in config.env (on-premise only)
• Health check endpoint protected with HEALTH_CHECK_TOKEN
• Trusted proxies list is restricted to known reverse proxy IPs
• CORS origin not set to * if Passwork is exposed to untrusted origins
• Background tasks (cron) are running and LDAP sync is current

Authentication

• Two-factor authentication enforced via role policy for all administrative roles
• 2FA enforced or strongly recommended for all users (not optional)
• Account lockout after ≤ 5 failed attempts
• Session timeout configured (recommended: ≤ 60 minutes of inactivity)
• Local password complexity policy: ≥ 12 characters, mixed case + digit + symbol
• Master password complexity policy configured (if CSE is enabled)
• LDAP communication uses LDAPS (TLS) — not plain LDAP on port 389
• SSO configuration uses a trusted IdP; only necessary claims are mapped
• No user accounts with authentication disabled without documented justification

Roles and access control

• No users assigned the Owner role unnecessarily (maximum 1 Owner)
• Administrative accounts are separate from daily-use accounts
• Default Member role does not have access to vault creation, user management, or settings
• Custom roles follow the principle of least privilege
• Role-based user management is enabled for department-level admin roles (separation of duties)
• All Corporate vaults have at least one explicitly assigned corporate administrator
• Private vault restrictions reviewed (can users create private vaults without oversight?)
• Service account for emergency vault access exists and is blocked (cannot sign in)
• Access to API token generation is restricted by role policy
• No long-lived inactive user accounts with active vault access

Encryption

• CSE (client-side encryption) status documented and intentional (enabled or disabled with justification)
• If CSE is disabled: deployment is within a trusted perimeter; server-side encryption is verified active
• If CSE is enabled: master password complexity policy is configured; help desk trained on reset consequences
• Server encryption key (encryption_key file) is stored outside the web root and access is restricted
• Backup archives are encrypted before storage

Monitoring and audit

• Activity log (audit log) is enabled
• Syslog / Windows Event Log forwarding configured for SIEM integration
• Audit log retention period meets regulatory requirements
• Security Dashboard has been run and critical findings addressed
• No compromised passwords present (users with revoked access whose passwords were not rotated)
• Alert configured for repeated failed authentication attempts

---

Regulatory alignment

Requirement	Passwork capability	Section
ISO 27001 A.9 — Access control	RBAC, vault access levels, role policies	Roles and permissions
ISO 27001 A.10 — Cryptography	AES-256, RSA-2048, PBKDF2, Zero-Knowledge	Encryption review
ISO 27001 A.12.4 — Logging and monitoring	Activity log, CEF/Syslog, SIEM	Monitoring and response
ISO 27001 A.14 — System security	Security headers, TLS, network hardening	Server security
GDPR Art. 32 — Security of processing	Encryption, access controls, audit trail	All sections
NIST SP 800-63B — Authentication	2FA, lockout, session management	Authentication audit

---

Prerequisites

Before starting the review, obtain:

• Access to the Passwork admin panel with Owner or Admin role
• SSH or RDP access to the server (on-premise only) or access to the cloud admin console
• Access to config.env or equivalent configuration (on-premise only)
• The current LDAP/SSO configuration details
• The organization's access control policy document (for comparison)
• Results of the previous security review (if applicable)

LLM version