So I need to protect the front and back end then.
It depends.
1) The data are vital. If users are making unauthorised changes to the
actual records, then the back end needs to be properly protected with
Access user-level security. Bear in mind that this is not bullet-proof --
a user would have to go seriously out of his way to break in, but such
solutions are available to purchase. If the consequences of that could
result in loss of life or limb, or serious legal challenges etc, then you
might need to think about moving up to an industrial strength dbms. Most
of the time, Access ULS is more than enough.
2) Breaking the front end can be a pain in a bigger or lesser degree.
Someone making unwarranted changes to a query may at worst result in an
unusable form, or at best simply make more work for himself. This might
or might not be a disciplinary issue within the organisation if you think
he is wantonly interfering with your software. You can protect the front
end using ULS. On the other hand, it's probably just as easy to overwrite
the front end with a new copy of the original every day, session, close-
down, or whatever.
3) Converting the front end into an MDE is also a good way to stop people
interfering with the user interface. If you are paranoid about someone
purloining your secret and unique VBA code, an MDE will stop that too.
4) A knowledgeable user can access the data from lots of platforms, not
just your front-end. Even MS Word and Corel Draw have VBA environments
that will happily read and write to a mdb database. That is exactly why
all integrity constraints, ValidationRules etc need to be enforced at the
db engine level, not in the user interface.
Hope that helps
Tim F