Re: Terminal services
Rodrigo Blanco <rodrigo.blanco.r <at> gmail.com>
2008-10-01 07:10:37 GMT
Hi Fernando,
I would say there are two possibilities: either the application you
wnat to make available for your end users is web, or not
(client-server).
If it is a web aplication, the VPN SSL would be a good solution (for
enhanced security, you could think of providing your users with OTP
tokens, so that even if in the non-controlled PCs they are using there
was some kind of malware / keylogger, no falw is introduced by
enabling this access). VPN SSL is especially convenient since it
provide virtually ubiquitous access (it just requires a browser, no
need to install any software client), and normally remains transparent
for the internal application (behaviour similar to a reverse proxy).
If it is not a web application, you can still publish it through VPN
SSL. If the software client of the application can be installed on the
PCs, you can tunnel the trafiic through port forwarding (usually as an
applet or ActiveX from the VPN SSL). Apart from requiring the ability
to install software on the public PC (which is usually not the case),
this may also pose security concerns about pieces of information
remaining on the non-controlled PC as cache / temp files / RAM
memory... The other option is to publish the application in a
thin-client architecture (terminal server, citrix...), and enable
access through the VPN SSL through a port forwarder. The advantage of
this approach is that neither does the application need to be
installed on the public PC, nor does it run on it, so no sensitive
information can be expected to remain on it after the session has been
closed.
(Continue reading)
RSS Feed