Loom Security Audit

Security Audit

Deep, methodical security review producing evidenced, severity-ranked, remediable findings — the heavyweight companion to loom-security-scan (fast tooling). Delegates: STRIDE/architecture → loom-threat-model; authn/authz mechanisms → loom-auth; dependency/SBOM/supply-chain → loom-dependency-scan.

Method

1. Scope — assets, data classification, compliance obligations, threat model (pull from loom-threat-model). Define what "in scope" means before touching anything.
2. Review by layer — app code, APIs, infra/IaC, data pipelines, ML (sections below).
3. Evidence — every finding cites file:line or config path + a concrete exploit scenario. A finding without a repro is a guess.
4. Rate — CVSS or Likelihood×Impact; rank most-severe first.
5. Remediate — specific fix (ideally a diff), not "sanitize inputs".
6. Report — executive summary + technical detail + prioritized remediation.

Run tooling first (loom-security-scan) to clear known-pattern noise, then spend human effort on logic and authorization flaws that scanners miss — that's where audits earn their keep.

OWASP Top 10 (2021) — audit lens

For APIs, cross-check the OWASP API Security Top 10 — API1 is BOLA (object-level authz), the single most frequent API defect.

Vulnerability Patterns (wrong → right)

# A03 SQL injection
query = f"SELECT * FROM users WHERE id = {uid}"          # ✗ string interpolation
cursor.execute("SELECT * FROM users WHERE id = %s", (uid,))  # ✓ parameterized

# A03 Command injection
os.system(f"ping {host}")                                 # ✗
subprocess.run(["ping", "-c", "1", host])                 # ✓ arg vector, no shell

# A03 XSS
return f"<h1>Welcome {username}</h1>"                      # ✗
return f"<h1>Welcome {escape(username)}</h1>"             # ✓ context-aware output encoding

# A01 Path traversal
open(os.path.join(base, filename))                        # ✗ filename="../../etc/passwd"
p = os.path.normpath(os.path.join(base, filename))        # ✓ normalize then confine
if not p.startswith(base + os.sep): raise SecurityError

# A08 Insecure deserialization
pickle.loads(user_input)                                  # ✗ RCE by design
json.loads(user_input)                                    # ✓ data-only format

A10 SSRF — defense is an allowlist, never a blocklist

Any server-side fetch of a user-influenced URL (webhooks, image proxies, PDF renderers, URL previews, importers) can be pointed at internal services or the cloud metadata endpoint 169.254.169.254 to steal IAM credentials.

# ✗ blocklist — bypassed by DNS rebinding, redirects, encoded IPs
if host in ("localhost", "127.0.0.1"): reject()

# ✓ allowlist scheme + host; resolve then re-check; forbid redirects to non-allowlisted
if scheme not in {"https"} or host not in ALLOWED_HOSTS: reject()
ip = resolve(host)
if ip_is_private(ip) or host not in ALLOWED_HOSTS: reject()   # re-check post-DNS (rebinding)
fetch(url, allow_redirects=False, timeout=5)

Blocklists miss: DNS-rebinding, HTTP→internal redirects, IPv6 ([::1], [::ffff:127.0.0.1]), and decimal/octal/hex IP encodings (http://2130706433/ = 127.0.0.1). Enforce IMDSv2 on AWS so a bare SSRF can't read credentials.

Access-control (IDOR/BOLA), timing-safe secret comparison, JWT algorithm confusion, and password-hash choice (argon2id, bcrypt 72-byte truncation) are covered with wrong-vs-right in loom-auth — audit against that checklist rather than duplicating here. Runtime secret leakage (argv/ps, env inheritance, logs/stack traces) is in loom-security-scan.

Infrastructure & Cloud

• IAM — least privilege; no *:*; audit privilege-escalation paths (pass-role, policy-attach); no long-lived keys where roles work.
• Storage — no public buckets/blobs; encryption at rest (KMS-managed keys, not hardcoded); block public ACLs org-wide.
• Network — no 0.0.0.0/0 on 22/3389/DB ports; segment; security-group minimalism.
• Metadata — IMDSv2 required (SSRF hardening).
• Containers — non-root, read-only rootfs, drop capabilities, no --privileged, no secrets in image layers/env; scan images (loom-security-scan).
• K8s — RBAC least-privilege, NetworkPolicies default-deny, Pod Security Standards (restricted), etcd encryption, no automountServiceAccountToken unless needed.
• IaC — scan Terraform/CFN with tfsec/checkov (loom-security-scan); review before apply.

Handy audit probes (tool details in loom-security-scan):

aws s3api get-bucket-policy-status --bucket B          # public?
aws ec2 describe-security-groups \
  --query "SecurityGroups[?IpPermissions[?IpRanges[?CidrIp=='0.0.0.0/0']]]"
kubectl get networkpolicies -A                         # gaps = flat network

Security Headers (baseline)

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
server_tokens off;   # don't leak version

CSP is the real XSS backstop; X-Frame-Options/frame-ancestors 'none' stops clickjacking; X-XSS-Protection is deprecated (omit or 0).

Data & ML

• Data — classify (PII/PHI/PCI); encrypt at rest + in transit; column/row-level access; audit-log access to sensitive data; automate PII detection/masking; enforce retention & secure deletion.
• ML — training-data provenance & poisoning checks; sign & access-control model artifacts (no embedded secrets); inference input validation + rate limits (anti-extraction); output filtering (no training-data/PII leakage); differential privacy where required. Attack taxonomy → loom-threat-model.

Severity (CVSS-anchored)

Map findings to CWE/CVE/OWASP IDs so they're deduplicable and trackable.

Compliance (essentials)

• SOC2 — access control (MFA, quarterly access reviews, least privilege), encryption at rest/transit, monitoring/SIEM + alerting, incident-response runbooks, change management. It's controls + evidence.
• PCI-DSS — never store CAV2/CVC2/PIN; encrypt PAN, mask to last-4 in UI/logs; segment the CDE; audit trails for all cardholder-data access; quarterly scans + annual pentest.
• HIPAA — PHI encryption, access controls + audit logs, BAAs with processors, breach notification.
• GDPR — lawful basis/consent; data minimization; DSAR support: access, rectification, erasure, portability; breach notification < 72 h; pseudonymization; cross-border transfer safeguards. (Privacy threat modeling → LINDDUN in loom-threat-model.)

Audit Checklist (verify before sign-off)

• Scope, assets, and compliance obligations documented up front
• Automated scans run and triaged first (loom-security-scan, loom-dependency-scan); human effort spent on logic/authz flaws
• A01 Access control audited object-by-object (IDOR/BOLA) — the top-frequency defect
• Injection, SSRF (allowlist), deserialization, path traversal checked with repro evidence
• Crypto: TLS ≥1.2, no weak/deprecated algos, secrets in KMS/vault (verify via loom-auth)
• Cloud/IaC/containers/K8s reviewed for least-privilege, no public exposure, IMDSv2
• Secrets absent from code, logs, argv, error responses
• Every finding: severity (CVSS), CWE/OWASP mapping, file:line evidence, concrete remediation
• Findings ranked most-severe first; exec summary + technical detail produced
• Applicable compliance controls mapped with evidence