Security Baselines and Checklists (What “Good” Looks Like)

Why Baselines

Most incidents come from drift and inconsistent defaults. A baseline makes secure behavior the default and regressions visible.

Baseline Areas

• Transport: TLS only, HSTS, correct proxy headers.
• Browser surface: security headers + CSP where applicable.
• Auth: MFA for admins, secure cookies, session expiry, brute-force controls.
• Secrets: no secrets in repo, rotation procedure, environment injection rules.
• Logging: structured logs, no secrets/PII leakage, retention policy.
• Dependencies: patch cadence, lockfiles, vulnerability scanning gate.

Release Gate Checklist (Minimal)

Release gate:
- Headers smoke test passes
- CORS policy test passes
- AuthZ regression tests pass
- Dependency scan: no critical/high allowed (policy-based)
- Secret scan: no new secrets committed
- Admin endpoints require MFA (where applicable)

Drift Detection

• Snapshot critical configs (reverse proxy, app env, IdP settings) and review diffs.
• Run header and TLS checks as cron + CI.

Example: Header Baseline Smoke Test

curl -sS -D - https://app.example.com/ -o /dev/null | egrep -i 
"strict-transport-security|content-security-policy|x-frame-options|x-content-type-options|referrer-policy"

Example: TLS Sanity Check

# Requires openssl
echo | openssl s_client -connect app.example.com:443 -servername app.example.com 2>/dev/null 
| openssl x509 -noout -dates -issuer -subject