security-auditing

name	security-auditing
description	Security audit procedures and controls
license	MIT
compatibility	opencode
metadata	{"audience":"developers","category":"security"}

What I do

• Conduct security audits and assessments
• Evaluate control effectiveness
• Review access controls and permissions
• Audit logging and monitoring
• Test for vulnerabilities
• Document findings and recommendations

When to use me

When conducting internal audits, preparing for external audits, or verifying security compliance.

Audit Framework

Audit Scope

from enum import Enum
from datetime import datetime

class AuditType(Enum):
    INTERNAL = "internal"
    EXTERNAL = "external"
    COMPLIANCE = "compliance"
    VULNERABILITY = "vulnerability"

class AuditScope:
    def __init__(self, audit_type: AuditType):
        self.audit_type = audit_type
        self.systems = []
        self.processes = []
        self.standards = []
    
    def add_system(self, system_id: str, description: str,
                  owner: str):
        self.systems.append({
            "id": system_id,
            "description": description,
            "owner": owner,
            "classification": "internal"
        })
    
    def add_standard(self, standard: str):
        self.standards.append(standard)

Control Assessment

class ControlAssessment:
    """Evaluate security controls"""
    
    def __init__(self):
        self.controls = {}
    
    def add_control(self, control_id: str, name: str, 
                    control_type: str, category: str):
        self.controls[control_id] = {
            "name": name,
            "type": control_type,  # preventive, detective, corrective
            "category": category,   # access, encryption, logging
            "implemented": False,
            "test_results": []
        }
    
    def test_control(self, control_id: str, test_method: str,
                    result: bool, evidence: str):
        """Record control test result"""
        self.controls[control_id]["test_results"].append({
            "test_date": datetime.now(),
            "test_method": test_method,
            "result": result,
            "evidence": evidence
        })
    
    def calculate_effectiveness(self, control_id: str) -> float:
        """Calculate control effectiveness percentage"""
        results = self.controls[control_id][]
          results:
             
        
        passed = (  r  results  r[])
         (passed / (results)) * 
    
     () -> :
        
        effectiveness = .calculate_effectiveness(control_id)
        
         effectiveness >= :
             
         effectiveness >= :
             
         effectiveness >= :
             
        :
             

Access Control Audit

class AccessControlAudit:
    """Audit user access rights"""
    
    def __init__(self):
        self.findings = []
    
    def audit_user_access(self, user_id: str, 
                         expected_permissions: list) -> dict:
        """Compare expected vs actual permissions"""
        actual_permissions = self._get_actual_permissions(user_id)
        
        # Find discrepancies
        extra = set(actual_permissions) - set(expected_permissions)
        missing = set(expected_permissions) - set(actual_permissions)
        
        if extra or missing:
            self.findings.append({
                "user_id": user_id,
                "extra_permissions": list(extra),
                "missing_permissions": list(missing),
                "severity": "high" if len(extra) > 0 else "medium"
            })
        
        return {
            "user_id": user_id,
            "status": "compliant" if not (extra or missing) else "non_compliant",
            "extra": (extra),
            : (missing)
        }
    
     () -> :
        
        privileged_users = ._get_privileged_users()
        
        findings = []
         user  privileged_users:
              ._requires_mfa(user):
                findings.append({
                    : user,
                    : ,
                    : 
                })
            
              ._has_recent_certification(user):
                findings.append({
                    : user,
                    : ,
                    : 
                })
        
         findings
    
     () -> :
        
        service_accounts = ._get_service_accounts()
        
        findings = []
         account  service_accounts:
             ._password_expired(account):
                findings.append({
                    : account,
                    : ,
                    : 
                })
        
         findings

Logging Audit

class LoggingAudit:
    """Audit security logging"""
    
    def __init__(self):
        self.required_events = [
            "authentication_success",
            "authentication_failure",
            "authorization_failure",
            "privilege_change",
            "data_access",
            "configuration_change",
            "system_event"
        ]
    
    def audit_logging_coverage(self, system: str) -> dict:
        """Check if all required events are logged"""
        logged_events = self._get_logged_events(system)
        
        missing = set(self.required_events) - set(logged_events)
        
        return {
            "system": system,
            "required_events": len(self.required_events),
            "logged_events": len(logged_events),
            "missing_events": list(missing),
            "coverage_percent": len(logged_events) / len(self.required_events) * 100
        }
    
    def audit_log_protection(self) -> dict:
        """Verify logs are protected from tampering"""
        checks = {
            : ._check_immutable_storage(),
            : ._check_integrity_monitoring(),
            : ._check_restricted_access(),
            : ._check_tamper_alerts()
        }
        
         {
            : (checks.values()),
            : checks
        }
    
     () -> :
        
        logs = ._get_all_logs()
        
        current_retention = ._calculate_retention(logs)
        
         {
            : retention_policy,
            : current_retention,
            : current_retention >= retention_policy
        }

Audit Reporting

class AuditReport:
    """Generate audit reports"""
    
    def __init__(self, audit_id: str):
        self.audit_id = audit_id
        self.findings = []
        self.recommendations = []
    
    def add_finding(self, severity: str, title: str, 
                   description: str, evidence: str, 
                   recommendation: str):
        self.findings.append({
            "id": len(self.findings) + 1,
            "severity": severity,  # critical, high, medium, low
            "title": title,
            "description": description,
            "evidence": evidence,
            "recommendation": recommendation,
            "status": "open"
        })
    
    def generate_executive_summary(self) -> dict:
        """Generate executive summary"""
        severity_counts = {}
        for finding in self.findings:
            sev = finding["severity"]
            severity_counts[sev] = severity_counts.get(sev, 0) + 1
        
        return {
            "audit_id": .audit_id,
            : (.findings),
            : severity_counts,
            : ._calculate_overall_risk(),
            : (.recommendations)
        }
    
     () -> :
        
         {
            : .generate_executive_summary(),
            : .scope,
            : .methodology,
            : .findings,
            : .recommendations,
            : .evidence
        }

Continuous Auditing

class ContinuousAudit:
    """Automated continuous control monitoring"""
    
    def __init__(self):
        self.monitors = {}
    
    def add_automated_check(self, check_id: str, check_func: callable,
                           frequency: str):
        """Add automated control check"""
        self.monitors[check_id] = {
            "function": check_func,
            "frequency": frequency,  # hourly, daily, weekly
            "last_run": None,
            "last_result": None
        }
    
    def run_continuous_checks(self) -> dict:
        """Run all automated checks"""
        results = {}
        
        for check_id, monitor in self.monitors.items():
            if self._should_run(monitor):
                result = monitor["function"]()
                monitor["last_run"] = datetime.now()
                monitor["last_result"] = result
                results[check_id] = result
        
        return results
    
    def generate_compliance_dashboard(self) -> dict:
        """Real-time compliance status"""
        return {
            "controls_monitored": (.monitors),
            : (  m  .monitors.values() 
                           m[]),
            : (  m  .monitors.values() 
                           m[]),
            : ._calculate_score()
        }