There's few security related things that I see people constantly doing wrong. The very first thing is assuming Liferay bundle with it's default settings is secure for production. It is far from secure. Don't get me wrong this doesn't mean that Liferay isn't secure it just means that shouldn't deploy Liferay with it's default settings and assume it's secure. So let's go over some things you should consider.