Security, from password policies to roles

There are a number of options to secure your account. Concerned about allowing your users to access the system from anywhere? Worried that a sales rep can view your customer list from his home, or during his final interview, while signing his new employment contract with your main competitor? Well, there is a feature for you, called IP address rules, which limits access to your NetSuite database to specific IP addresses. On a cautionary note, this is also the quickest way to potentially lock yourself out of your own NetSuite account, so it's best to set this up while you have NetSuite support on the line.

You can also tighten the password policy under Setup | Company | General Preferences, by setting the policy to Strong and deciding how often users will need to change their passwords:

Password settings on the General Preferences screen

These preferences (being general) will apply, unless they can be overridden by a user's personal preferences, so you can determine whether a user can override specific general preferences. One field to consider is the Customer Credit Limit Handling warning, which should be restricted from users; it's best to turn that off. Don't worry; users cannot override the password policy!

Setting the user's ability to override preferences

The critical security option is the ability to customize a user's roles and permissions. We cover that in Chapter 6, Customization, so let's leave it there for now. However, NetSuite gives you the ability to test roles by assigning multiple roles to yourself. You provide access to a user by going to the Access tab on the employee record and selecting the various roles that you wish to assign to the user. Once you have created a role, go to your own employee record and assign it to yourself. That enables you to switch your role to the custom role and test whether it is acting as designed.