title: Security for Exposing Internal Web-based application to the World
body: <p>We have an internal CRM system which is currently a website that can only be accessed inside our intranet. The boss is now wanting to have it exposed to the outside world so that people can use it from home and on the road. My concern is security based in the fact we will be exposing our Customer base to the outside world. I have implemented 3 layers of security as follows:</p>
  
  <ol>
  <li>User Name and Strong password combination to login</li>
  <li>SSL on all data being pushed across the line</li>
  <li>Once the user is logged in and authenticated the server passes them a token which must be used in all communication with the server from than on.</li>
  </ol>
  
  <p>Basically Im a bit of newb in the respect of web security. Can anyone give me advice on whether I am missing anything? Or something should be changed?</p>