external user security