Secure your NetSuite account before somebody tests it.
Most NetSuite accounts have never had anybody look at them the way an attacker would. The ones that get looked at usually get looked at the week after something happened.
One evening a client of ours started getting a flood of NetSuite lockout emails for their employees. Their people were locked out, and there were files in the File Cabinet that nobody on staff had created. Every way in was something they could have closed ahead of time.
This program closes those gaps, then keeps checking so they stay closed. It is run by David Norris.
Scripts open to the outside
Most of the review is here. A Suitelet with Available Without Login checked is a public URL, and anybody who finds it can run it. Scripts with Customer Center in the audience can be reached by anyone who can create a web store account. A lot of those came from NetSuite’s own bundles, not your developers.
- Is Available Without Login checked, and does it need to be?
- What roles are in the audience? Is All Roles or Customer Center in there when it shouldn’t be?
- Does the script write files, create records or send email based on anything a user can pass in?
- Who owns it, and is it still used? Old scripts from a past consultant are the ones nobody’s looked at in years.
Integrations and their roles
Every integration logs in as something. We list every integration record and access token and check the role behind it. An integration running as Administrator because that was fastest at setup gets its own role with only what it needs. Tokens and integrations you don’t use anymore get shut off.
Logins and roles
Every role gets the least access that person needs to do their job. Administrator should be two people, not ten. If you’re on Google Workspace, we can set up single sign-on so shutting off somebody’s Google account shuts off NetSuite too. We can also set up passkeys or hardware keys for two-factor.
Payment processing and unused features
We check who can see and change your payment processing profiles and whether former staff still have access to the gateway portal. Features left on from an old implementation get turned off if nobody uses them.
Knowing when it happens
NetSuite keeps a login audit trail, including failed attempts. We set up a scheduled check that looks for a run of failed logins, logins from somewhere new, or a role you don’t expect logging in. For a lockout attack, the alert goes to a phone by text so somebody sees it at 6am, not from a phone call from somebody who can’t get in.
What’s covered
- Every script deployment, Suitelets and RESTlets first
- Bundles and SuiteApps you have installed
- Every integration and token, and the role behind it
- Login roles and who has Administrator
- Features turned on that you don’t use
- Files in the File Cabinet created by anyone or anything unexpected
- Payment gateway access and settings
- Single sign-on and passkeys or hardware keys for two-factor
- A login alert that goes to email and text
What you get each month
- A written list of what we found, what we fixed and what’s still open
- A fresh look at new scripts, integrations, users and roles added since the last review
Pricing depends on the size of the site or account. Book a free hour. See all monthly programs.