Security Audit Skill

A systematic approach to evaluating the security posture of applications, systems, and infrastructure. This skill equips you with the methodology, tooling, and reporting standards needed to conduct professional-grade security audits.

Core Principles

1. Defense in Depth

Security is not a single control but layered protections. An audit must evaluate each layer independently and in combination. A failure in one layer should be caught by another.

2. Least Privilege

Every component, user, and process should have the minimum permissions necessary to function. Audits must verify that privilege boundaries are enforced, not just declared.

3. Assume Breach

Design and audit with the assumption that an attacker has already compromised some part of the system. What can they access? What can they pivot to?

4. Repeatability

Audit procedures must be reproducible. If two auditors run the same methodology against the same target, they should reach consistent conclusions.