I'm currently conducting a due-diligence review of a technical system. The system is a classic distributed, two-tier system with data held centrally and business-logic delegated to an application tier. I've been asked to perform a security analysis as part of my review. I can't tell you anything about the project itself, for confidentiality (and security) reasons, but I thought I'd share some of the thought processes behind what I've been doing.