0

I'm researching the best way to set up something like this: I have a client who wants to be able to kick off a data import/processing/export routine remotely -- from home, from his smartphone, whatever. He basically needs a couple of buttons and some way of telling if the process was successful and if not, why not. Nothing more complex than that.

The server where this process will run is Windows based.

The two approaches I'm considering are, first, to have IIS running and a Web page, possibly with .Net stuff on it, which will kick off the process. Or, second, to have the client Remote Desktop to the server and run a standalone application, maybe in .Net or in MS Access.

I'm concerned about securing IIS considering it will require being world accessible. On the other hand, of course Remote Desktop will have to be world accessible, too, and I don't anything about how secure that is. I suppose a VPN might be the right thing, but then I'm well outside my area of expertise.

Am I overthinking this?

1 Answer 1

1

IIS. Seriously.

from home, from his smartphone, whateve

A lot easier if you can rely on standard HTTP, no login, no requirement for a remote desktop front end.

I'm concerned about securing IIS considering it will require being world accessible.

Trivial. HTTPS, integrated security, everyon out except certain allowed people.

course Remote Desktop will have to be world accessible, too, and I don't anything about how secure that is

Totally. Do NOT EXPOSE IT TO THE INTERNET. Use a Terminal Services Gateway, then the client can acess it remotely via HTTP - it is a standard windows function.

Am I overthinking this?

YOu miss the old KISS approach - "Keep it Simple, Stupid" (not meant as insult, it is how i know the saying). Basically a nice little HTTPS page with some buttons should be good enough as a start. It is a LOT more convenitent on a small screen than RDP as you can make a remote version easily.

4
  • You say securing IIS is trivial. This is one area -- webserver security -- where I do have some expertise and I can say this is never trivial. Especially with IIS. The question is, is IIS easier to secure than Remote Desktop? And I don't take KISS as an insult at all -- I've done some very dumb things in my time!
    – crywalt
    Jul 2, 2012 at 15:52
  • Actually it is easier. THe main problem securing IIS is if you have to allow anonymous users. In your case it is easy - NO ACCESS FOR NON AUTHENTICATED USERS. Point. THis means that noone having the passsword gets anything. 90% of the leaks are in web servers the anonymous pages or non-trusted users that try to break your app - in your case all a non issue. Anyone without password won'tt get anything. SImple as it gets.
    – TomTom
    Jul 2, 2012 at 16:54
  • IIS comes equipped with its own holes which don't require authentication at all. Just having IIS listening on a port is enough of a hole.
    – crywalt
    Jul 2, 2012 at 17:14
  • Ahm no, sorry. There habe been ZERO inidents with IIS that hadad not been patched for months before exploiting. Ever.
    – TomTom
    Jul 2, 2012 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .