Security review for portals and internal tools

Why this checklist

Security review for portals and internal tools starts with access, proof, and separation. I use these checks before releases and after major changes. You can run them this week and spot real gaps.

Authentication and access control

• Enable multi factor authentication (MFA) for every admin account to reduce risk from stolen passwords.
• Use single sign on (SSO) with your identity provider to simplify account changes and reduce orphaned logins.
• Enforce role based access control (RBAC) with least privilege so each person sees only what they need.
• Review and remove stale user and vendor accounts on a schedule so former staff do not keep access.
• Expire sessions after idle time and revoke session tokens on password change to contain hijacked sessions.
• Set rate limits and temporary lockouts on login and sensitive actions to slow guessing attacks.
• Use separate service accounts with scoped API keys so integrations cannot read or change extra data.

Audit logging and data isolation

• Record who did what and when in append only audit logs so you can investigate issues later.
• Store audit logs in a separate system or account so app admins cannot tamper with them.
• Alert on high risk events like permission changes and mass exports so you can respond quickly.
• Encrypt data in transit with HTTPS and at rest with storage encryption to reduce exposure from leaks.
• Isolate each customer data set with a customer ID on every table and API to prevent cross account access.
• Prove isolation with automated tests that try cross customer reads and writes and confirm they fail before release.
• Avoid customer identifiers in public URLs and routine logs to reduce accidental exposure.
• Sanitize and scan all file uploads to block malware in documents and images.
• Rotate secrets like API keys and database passwords on a schedule to limit damage if a key leaks.
• Back up data and test restores regularly so you can recover from mistakes and attacks.

If you want hands on help, I can run these checks and ship fixes under Custom Development > Engineering Retainers or Custom Development > Applications.