Security
Checklist
Revision
2015-­‐05-­‐19
Please
use
this
checklist
as
a
reference
guide
only.
Not
all
items
are
required
for
every
project.
File
Checklist
☐
Enable
Encryption
At
Rest,
be
sure
to
document
password
☐
Enable
File
Access
Restrictions
in
Manage
Security
☐ Disable
automatically
opening
the
file
with
account
credentials
☐ Set
the
minimum
required
version
in
File
Options
☐
Use
External
Authentication
when
possible
☐
Disable/Remove
the
default
Admin
account
☐
Consider
hiding
your
files
from
being
shown
when
hosted
☐
Enable
disconnecting
users
from
server
when
idle
☐ Disable
storing
passwords
in
the
Credential
Manager
☐ Consider
requiring
a
minimum
length
password
for
all
users
☐ Consider
requiring
users
to
change
their
passwords
Server
Checklist
☐
Remove
sample
file
from
FM
Server
☐
Disable
unused
technologies
(XML,
PHP,
WebDirect)
☐
Enable
SSL
on
Server
with
a
custom
certificate
☐
Enable
HTTPS
for
Progressive
Downloads
(requires
a
custom
cert)
☐
Enable
client
timeout
☐ Disable
Installing
Plug-­‐ins
on
Server
☐ Consider
changing
the
default
ports
from
80
and
443
to
non-­‐standard
ports
☐ Restrict
admin
console
access
by
IP
Address
General
Tips
☐
Keep
FileMaker
up
to
date
for
the
latest
security
patches
☐
Block
non
full
access
accounts
from
using
FM
Advanced
☐ Limit
plug-­‐ins
usage
with
Get(
InstalledFMPlugins
)
☐ Use
guard
clauses
to
ensure
scripts
run
from
correct
platform
☐ Send
credentials
via
encrypted
email
via
a
service
like
Virtru.com