Docs

Appearance

Runbook: Monthly Security Review ​

Purpose ​

A structured monthly security review ensures that controls are operating effectively, access remains appropriate, and any drift from baseline is caught before it becomes an incident. This checklist is intended for the IT administrator and covers identity, network, endpoint, PAM, credentials, backups, and log review.

Estimated time: 2–3 hours. Run on the first Monday of each month.

1. Identity and Access ​

  • [ ] Review Entra ID users created or modified in the past 30 days
    • Entra portal → Users → All users → Sort by Created date
    • Confirm each new account is expected and has appropriate group memberships
  • [ ] Review Privileged Identity Management (PIM) activations for the past 30 days
    • Entra portal → PIM → Audit history → Filter: last 30 days
    • Flag any activations by unexpected accounts or at unusual hours
  • [ ] Confirm all Global Admin accounts have MFA and FIDO2 enrolled
    • Entra portal → Users → filter by Global Administrator directory role
  • [ ] Review Guest accounts — confirm all guests are still needed
    • Entra portal → Users → filter by User type = Guest
    • Remove any guests whose access is no longer required
  • [ ] Verify break-glass account status — accounts should have no recent login
    • SecOps platform → Incidents tab → filter for break-glass source
    • Any activity from cirius-breakglass@ciriusgroup.com or ciriusdde.com requires immediate investigation
  • [ ] Review Conditional Access policy health in both PROD and DDE tenants
    • Maester weekly report should show all required policies passing

2. Network and Firewall ​

  • [ ] Review Palo Alto firewall traffic logs for anomalous patterns
    • Panorama (when available) or local firewall management: Monitor → Logs → Traffic
    • Look for: unexpected egress destinations, high-volume transfers, new applications
  • [ ] Confirm DNS Security is active and blocking threats
    • Palo Alto → Monitor → DNS Security
    • Review any blocked queries — investigate domain categories if unusual
  • [ ] Review NSG flow logs for unexpected east-west traffic
    • LAW query: AzureNetworkAnalytics_CL | where FlowType_s == "ExternalPublic" or FlowType_s == "IntraVNet"
    • Confirm no production-to-development VNet traffic (should be zero — VNets are not peered)
  • [ ] Confirm Twingate connector health (both PROD and DDE)
    • Twingate admin console → Connectors
    • All connectors should show "Online" status

3. Privileged Access Management (PAM) — Keeper Session Log Review ​

Keeper Security is the PAM tool for privileged session management. Monthly review of session logs ensures that privileged access to sensitive systems is tracked and appropriate.

  • [ ] Log into Keeper Security admin console (keepersecurity.com/console)
  • [ ] Navigate to Reporting & Alerts → Session Recordings or Audit Logs
  • [ ] Filter by the past 30 days
  • [ ] Review all privileged sessions:
    • Confirm sessions were initiated by expected users and service accounts
    • Verify sessions to sensitive targets (DCs, firewalls, databases) are expected
    • Flag any sessions at unusual hours or from unexpected source IPs
    • Confirm all sessions have a documented change management justification
  • [ ] Review Vault Access Logs for any access to sensitive records (break-glass creds, service account passwords)
    • Flag any access to break-glass credential records — these should be rare and always documented
  • [ ] Check Failed Login Attempts to Keeper itself
    • Repeated failures may indicate a brute-force attempt against the PAM console
  • [ ] Export session log summary to PDF and file in SharePoint compliance folder:
    • SharePoint → Compliance → Monthly Reviews → <YYYY-MM> → keeper-session-review.pdf

4. Endpoint and EDR ​

  • [ ] Review Cortex XDR weekly security digest for the past 4 weeks
    • Cortex XDR console → Dashboards → Security Overview
    • Confirm no CRITICAL or HIGH incidents went unresolved
  • [ ] Verify EDR coverage — all managed endpoints should have Cortex XDR agent active
    • Cortex XDR → Endpoints → filter by status
    • Follow up on any endpoints showing "Disconnected" for more than 24 hours
  • [ ] Review Intune compliance status — all managed devices should be compliant
    • Intune portal → Devices → Monitor → Device compliance
    • Non-compliant devices should be remediated or have documented exceptions
  • [ ] Confirm patch compliance
    • Intune portal → Reports → Windows updates → Windows feature update report
    • All devices should be within 2 versions of current

5. Credential and Secret Health ​

  • [ ] Review SecOps findings tab for open credential expiry findings
    • SecOps platform → Findings → filter by source=CREDENTIAL_EXPIRY
    • Remediate any CRITICAL (expired or expiring within 30 days) findings immediately
    • Plan remediation for HIGH findings (expiring within 90 days)
  • [ ] Review third-party API key rotation schedule
    • Cortex XDR API key: rotate every 180 days
    • KnowBe4 API key: rotate every 365 days
    • Twingate client secret: rotate every 365 days
    • Keeper admin password: rotate every 180 days
    • AWS IAM access keys (aws-coverage-*): rotate every 90 days
  • [ ] Review Entra app registration client secrets
    • Entra portal → App registrations → All applications → Certificates & secrets tab
    • Address any secrets expiring within 90 days

6. Backup and Recovery ​

  • [ ] Confirm Veeam backup job completion for all protected VMs
    • Veeam Backup & Replication → Home → Jobs
    • All jobs should show "Success" for the past 30 days
    • Investigate any "Warning" or "Failed" jobs
  • [ ] Verify Recovery Services Vault backup status in Azure
    • Azure portal → Recovery Services Vaults → Backup alerts
    • No active critical alerts
  • [ ] Confirm AWS backup targets (S3 Veeam buckets) are healthy
    • AWS console → S3 → cirius-backup-* buckets
    • Verify objects are being written (check Last Modified date)
  • [ ] Spot-check backup integrity — restore one non-critical VM or file monthly
    • Document the test restore result in SharePoint: Compliance → Monthly Reviews → <YYYY-MM> → backup-restore-test.md

7. Cloud Security Posture ​

  • [ ] Review weekly HIPAA audit email for new failures (arrives Monday morning)
    • Address any new HIGH or CRITICAL compliance failures within 5 business days
  • [ ] Review Azure Policy compliance — open the Compliance blade for both subscriptions
    • Azure portal → Policy → Compliance
    • Confirm no new non-compliant resources in HIPAA/HITRUST or ISO 27001 initiatives
  • [ ] Review AWS Security Hub for new findings
    • AWS console → Security Hub → Summary
    • Address any CRITICAL findings immediately
  • [ ] Run the quarterly unmanaged resource scan if it is a quarter boundary (January, April, July, October)
    • ops-automation → Actions → Quarterly Unmanaged Resource Scan → Run workflow

8. Security Incident Review ​

  • [ ] Review SecOps platform — all OPEN incidents
    • SecOps platform → Incidents tab → filter by status=OPEN
    • Confirm each open incident has an assigned owner and documented investigation notes
    • Close any incidents confirmed as false positives with a brief note
  • [ ] Review resolved incidents from the past 30 days
    • Confirm root cause was identified for all HIGH and CRITICAL incidents
    • Identify any patterns that suggest a control gap

9. Documentation and Change Management ​

  • [ ] Confirm all infrastructure changes this month have CM tickets in SecOps
    • SecOps platform → Changes tab → filter by last 30 days
    • Any untracked change requires a retrospective CM ticket
  • [ ] Update CMDB for any new or decommissioned assets
    • Run quarterly CMDB audit if needed: SecOps platform → CMDB → Run audit

Completing the Review ​

After completing all checklist items:

  1. Save this checklist with all items marked to SharePoint: SharePoint → Compliance → Monthly Reviews → <YYYY-MM> → monthly-security-review-<YYYY-MM>.md

  2. If any finding requires follow-up:

    • Create a story in the SecOps platform with appropriate priority
    • Note the story ID in the checklist before saving

  3. Send a brief summary to the security distribution list noting:

    • Month reviewed
    • Number of open findings
    • Any items requiring immediate action

10. Annual Year-End Review (December Only) ​

In December, run these additional items as part of the monthly review. They exist here so the year-end refresh never gets orphaned from the regular cadence.

  • [ ] Threat model refresh — review and update the threat model set:
    • security/threat-model/crown-jewels.md — add or remove assets; re-rate blast radius
    • security/threat-model/threat-actors.md — update TTPs from the past year's landscape
    • security/threat-model/stride-analysis.md — re-score residual risk per crown jewel
    • security/threat-model/controls-mapping.md — add newly deployed controls, retire superseded ones
    • security/threat-model/threat-model-2026.md (or current year) — refresh the executive summary; produce a new yearly version for the next calendar year
    • Open a SecOps story tagged threat-model-annual capturing any deltas requiring action
  • [ ] Risk acceptance register review — confirm every accepted risk still meets its compensating-control bar, renew or retire each
  • [ ] Compliance scorecard recertification — every IMPLEMENTED row reverified; GAP rows have a named owner and target
  • [ ] Access recertification — every workforce member's access reviewed; unused access revoked
  • [ ] Vendor inventory annual refresh — BAAs still valid, SOC2 reports current, risk tiers still accurate

Record completion of the year-end review in SharePoint → Compliance → Monthly Reviews → <YYYY-12> → year-end-refresh.md alongside the monthly output.

Document History ​

DateChangeAuthor
April 2026Initial draft — added PAM session log review, Keeper console steps, all categoriesKobe
April 2026Added year-end annual review section including threat model refresh (TMOD-007)Kobe

Internal use only — Cirius Group