Remote desktop Client versus Web based access to reports and limited data entry

Question

We have a requirement from management to give limited access of our Application to Distributors \ Dealers to look at their account statements in our books of account, enter their purchase requirements (sales order for us). We have given a few of them the RDC who connect to our terminal server and access the reports. This involves licensing of TS Client per each distributor. Is it more better, secure and less costly if a web based application is made to only enter the orders and retrive reports like pending orders, ledgers, receivables etc. Also which is more secure as far as database access is concerened...browser based access or RDC access. Please answer.

Answer 1

Giving access via RDC is not safe in my opinion . The users might look at other private data you might have also. Also it is pretty slow and the Remoting takes a lot of bandwidth and users might see a lot of lags in their end.

A web application gives you a lot of control , you could set user levels and provide individual logins to each user at no additional cost. It's a one time investment + ongoing maintenance cost though.

Answer 2

i dont know if you would have the same equipment, but where i am at we use Cisco ASA with policy groups for different users, and our active directory.

say if a user logged in and there policy group was sales, they would see sales tools on there client-less vpn portal. if the group policy was for example vendor, then they might see there vendor excel document that they could update and save for us to use at a later time.

just felt like sharing what we do with similar situations.

Answer 3

Both methods have security advantages and disadvantages.

One perspective to consider would be with a custom web application you are adding functions for them to get to what they need, with Remote Desktop you will be removing/limiting functions to just what they need.

While both can be achieved, it will be a lot easier to know what was put into the web application then everything that must be blocked from them having access onto a machine.

Further details regarding the Remote Desktop side will be difficult as we don't know if the application they run has access control within it (to keep them just to their information), if a database password is stored in a configuration file which they could potentially read, what other applications are hosted on the same terminal server, etc.