Bruce Backa

Nowadays it's quite common for us to write server-based applications. These apps differ from desktop applications in many ways - one of the most important of which is how they handle security. For a desktop application, security is easy. The application runs in the security context of the user who loaded it. Whatever the user has rights to, the desktop app has rights to, and nothing more. Server-based applications, on the other hand, run all the time and have their own security context, in addition to others they may impersonate. For many of the server-based applications we might write, there are few problems. IIS, for example, has built-in facilities that handle most of the security issues behind the scenes. However this magic is only available to standard ASP apps. Web services and non-IIS applications have to handle their security issues on their own. This means... (more)

Bruce Backa's Storage Blog: The New Economics

Bruce Backa's Storage Blog: The New Economics We have all watched the price of on-line storage decrease year after year. While it is still neither infinite nor free (and it's certainly not free to manage), it is pretty inexpensive these days. So inexpensive, in fact, that tape is now dramatically more expensive. This cost inversion (tape used to be much cheaper than on-line storage) should change the way we manage our storage. If you are a large corporation with sites all around the world, you need to replicate your data to these sites anyway. If London, New York and LA have all ... (more)

Storage & Security Journal: "Striking the Right Balance"

Storage is still one of the most costly and fastest-growing aspects of everyone's network and is likely to remain so for some time. Every network user is a storage user. We're all part of a community that shares the costs and the benefits of this expensive resource. Storage management can be a challenging task. There's so much hardware, so many alternatives, and so many issues that it's easy to get lost in the details and fail to see the forest for the trees. Networked storage is a service not a product. While hardware is necessary for you to provide the service, successful stor... (more)

End-to-End Application Security

Last month (.NETDJ, Vol. 1, issue 12) we demonstrated a simple technique that allows you to avoid storing passwords in clear text, making your .NET applications more secure and safer should they somehow be compromised. In this article, we want to step back a bit and look at the big picture: application security from end to end. When it comes to security, we developers are in charge. Security is not something that can be pushed off onto the network administrator; it is an integral aspect of an application's overall architecture. A well-built application should be inherently secur... (more)

What's In Store For 2006?

Okay, summer's over. Let's get back to work... But first, let's look at what's new. Microsoft has taken WinFS, its new file system, out of the first release of its next operating system. The story is that WinFS will follow soon after the OS releases. For most of us, this is something we don't need to worry about for a couple of years, at least. EMC has reduced prices on its Celera line of NASes. Network Appliance still dominates the high-end NAS business and its alliance with NTP Software for storage management gives it a significant advantage in the marketplace. Speaking of NTP S... (more)