Web Services Enhancements Webinar 2/23 & 2/26

Agenda AE Application Server/Service Enhancements MS SQL Browser Application Security –Errors many vendors make Controlling ESS Access via IIS

AE Service Components Service Components –AutoTask Running reports, tasks, communications –Background Processes Data processes Timecard calculations –Communication Server Real-Time data collection

Existing Server Layout IIS Servers SQL ServersApplication Server AutoTask Running reports, tasks, communications –Background Processes Data processes Timecard calculations –Communication Server Real-Time data collection

Distributed Processing AutoTask - Running reports, Tasks, Communications Background Processes - Data processes, Timecard calculations Communication Server - Real-Time data collection

Enhanced Server Layout IIS Servers SQL ServersApplication Servers AutoTask Server Communication Server Background Processing Server

Advantages Ultimate in scalability Lower total cost of ownership 100% redundancy = 24/7

MS SQL Security Microsoft Security Holes –Browser app written in.asp Default.ASP page Contains authentication – Connectivity Information ASP is not encrypted Low Isolation NOTE: ASP can utilize obfuscated secrets

ASP Pages

What is Low Isolation? IIS Service / Process ASP Pages ISAPI, DLL’s & ADO MS SQL Server Web Server Low Medium High

Advantages of High Isolation If Server fails, service isn’t affected If Service (AeWebLoader) fails, Server doesn’t shutdown Further removed from IIS process = more security Note: High Isolation does slow down service a little

Controlling ESS Access Internet Information Services

Directory Security

Deny / Grant IP or PC

Summary Distributed Application Server –Ultimate in Scalability –Only supported in Enterprise Edition Microsoft secure development strategy –ISAPI vs. ASP (typical) Securing ESS accessibility