This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing list is active, is there any reference document or standardized checklist for security auditors to refer to?
I have not seen a compliance guide for evaluating the security posture of CAS, but I have some urls that might be useful.
Securing Your New CAS Server https://wiki.jasig.org/display/CASUM/Securing+Your+New+CAS+Server
Auditing and Statistics Via Inspektr https://wiki.jasig.org/display/CASUM/Auditing+and+Statistics+Via+Inspektr
Enabling auditing will generate logs, but you might want to look at something to ingest logs and provide some analysis (like Splunk).
I hope this gives you a place to start.