@823 - there is a phrase we use in computer security - "low-hanging fruit" - which is when you have fewer security measures in place than some other sites on the net. If you are able to do so, put some barriers in the way (and from your comments in this thread, you ARE doing that). Lots of people neglect simple security measures such as having a network security system in place. Using smart routers and firewalls is also a good way to handle external hackers, though that is usually a decision for the higher bosses.
Hackers come in two major varieties. Targeted hackers know exactly what they want and will go to great lengths to get it. Browsing hackers look for easy targets - low-hanging fruit - and take what they can get. If you are lucky, you can make it tedious enough to make many hackers lose interest and look for lower-hanging fruit so that they choose to leave you alone.
Putting various protective measures in place will make your DB less attractive to the browser hackers because they have a short attention span. If you make them take too long, the browser hackers decide it isn't worth their time - which is exactly what you want. Particularly with Access, you can't stop the targeted hackers. You can only slow them down. But that is actually true for ALL DB systems, not just Access. When I was with the U.S. Navy as a contractor, we saw security patches coming in not only for operating systems but for network software, database management software, applications packages, and even security software. A recent scandal in the Solar Winds/Orion software was a targeted hack that hit the military very hard. (Technically, it was a Trojan Horse hack.)
Your concern over your own users is proper, which in operational terms means you must be vigilant and consider who among you could benefit from internal DB knowledge. Then watch those people slightly more carefully than other users. Dealing with internal security threats is a lot harder since the insiders presumably have passwords and network access through internal routers. The internal routers and firewalls assume you have a right to be there if you are already known to the domain or server or whatever you have protecting things. Something you need to consider is to know HOW you would detect that data HAD been stolen, since you are worried about it.
