Harden production systems with security checklist

MONOPOLY - Security Hardening Checklist is a reference skill of security hardening checks across eight categories: network security, authentication and authorization, API security, data security, secrets management, supply chain and dependencies, incident response, and compliance.

Use this as a reference when hardening or reviewing a system's security posture before production, or auditing an existing architecture against a checklist rather than starting from a blank page. It is explicitly a reference document that may not cover every edge case, so any resulting architecture still needs independent verification.

Network Security checks private VPC placement with only the load balancer or API gateway exposed, least-privilege security groups, NACLs as a secondary layer, a WAF with the OWASP Top 10 ruleset, DDoS protection (Cloudflare or AWS Shield Standard at minimum), and VPN or Private Link for multi-region inter-service traffic. Authentication and Authorization checks short-lived JWTs (15-minute access, 7-day refresh), OAuth 2.0/OIDC for third-party auth, MFA on admin accounts, RBAC or ABAC, no secrets in JWT payloads, and a token revocation strategy. API Security checks rate limiting per user, IP, and endpoint, input validation, SQL injection prevention via parameterized queries, XSS prevention via output encoding and CSP, CSRF protection via SameSite cookies and tokens, a locked-down CORS policy, and HSTS, X-Frame-Options, and X-Content-Type-Options headers. Data Security checks TLS 1.2+ in transit, AES-256 or S3 SSE at rest, PII minimization and field-level encryption, encrypted backups, and no sensitive data in logs. Secrets Management checks no plaintext secrets in code or env vars, a secrets manager such as Vault or AWS/GCP Secrets Manager, automated rotation, and IAM roles instead of static credentials. Supply Chain checks dependency scanning (Snyk, Dependabot, npm audit), container image scanning (Trivy, ECR), pinned production dependency versions, and a generated SBOM.

Incident Response checks audit logs for admin actions and data access, alerting on anomalous access, a documented runbook, a defined breach-notification process citing GDPR's 72-hour rule, and scheduled penetration testing. Compliance items are broken out per framework: GDPR (data residency, right to deletion, consent tracking), PCI-DSS (never store raw PANs if handling card data), HIPAA (encryption, audit logs, BAAs with vendors for health data), and SOC 2 Type II (access control, availability, and confidentiality evidence).

Engineers and security reviewers hardening a system before production or auditing an existing one who want a concrete, checklist-driven pass across network, auth, API, data, secrets, supply chain, incident response, and compliance instead of relying on memory.