How to Audit Authentication & Password Controls (Part 2)

Last week, we explored the fundamentals of authentication controls—how applications authenticate users and how that defines your testing approach.

This week, we go one step deeper: How should you prepare for a walkthrough meeting for authentication and password management controls?

These meetings are where you move from theoretical understanding to real-world evidence.

Let’s break it down.

Three Types of Walkthroughs You Might Encounter

Over the years, I’ve experienced three types of walkthrough scenarios:

1. Evidence Provided Before the Meeting

In this case, the control owner has already shared authentication-related evidence through your request list.

Your job?

Review it in advance and prepare a list of targeted questions to clarify the process and validate the evidence live.

2. Live Walkthrough of the Authentication Process

This is my personal favorite.

You walk into the meeting, and the control owner takes you through the entire authentication process—step by step—right from the production environment.

You get to see how settings are configured, how users log in, and how the system handles identity validation.

This type of walkthrough is a goldmine for evidence and clarity.

3. No Evidence, No Context - Start From Scratch

You walk into the meeting with no documents, no access, and no idea how authentication works for the application.

If that’s the case, don’t panic.

Ask clear, structured questions. Treat it like reading a new book.

Your job is to understand the story from page one.

Start With the Password Policy

Before you walk into any meeting, your first step should always be to:

• Request and review the latest organization-wide password and authentication policy
• Check if it has been reviewed and approved by a relevant authority (IT security lead, CISO, etc.)
• Use this policy as your benchmark when testing every application

Walkthrough Approach for Each Application Type

1. Applications Authenticated via Active Directory

Step 1: Understand how Active Directory (AD) handles login

Step 2: Test the AD password settings: complexity, length, expiration, lockout, etc

Step 3: Compare settings to both the company’s policy and Microsoft’s AD configuration best practices

Step 4: Request a list of all applications using AD authentication

Step 5: Sample one user who is:

• Successfully authenticated to AD
• Unable to access the application without AD
• Only able to access after AD login is successful

Step 6: Ask who can modify AD password settings

Step 7: Check if these changes go through a formal change request and approval process

Important! Confirm that evidence is from the production environment

2. Applications Not Tied to Corporate Network

Step 1: These applications allow login directly over the internet

Step 2: Inspect password settings configured within each application:

• Minimum length
• Complexity
• Lockout thresholds
• Inactivity
• Maximum Logon Attempts
• Account Lockout period
• Password expiry
• MFA (multi-factor authentication)

Step 3: Ensure these align with the organization’s security policy

Step 4: Sample a user who successfully logs in

Step 5: Ask:

• How is password risk managed?
• Is MFA enabled?
• Who can modify password settings in the app?
• Are changes documented and approved?

3. Applications Managed by a Third-Party Vendor

While not the focus this week, remember: In these cases, you rely on SOC reports to validate password controls.

Key Takeaways for the Walkthrough Meeting

• Understand how each application handles authentication
• Always tie system configurations back to the central password policy
• Ask who has access to change settings and how those changes are approved
• Document sample users and capture screenshots from production, not test environments
• Clarify how the risk of unauthorized access is mitigated

Next Week: How to Document This Control Effectively

In the next edition, we’ll walk through how to write a clear, effective workpaper for authentication and password controls so your testing reflects the real risk and the real design.

Until then, keep learning. Let your curiosity guide your questions and let your questions lead to evidence.

Until then, signing off

Chinmay Kulkarni