Securing End User Active Server Page Applications on an Intranet

End user computing solutions have evolved from the mainframe to the personal computer and now to the web. Business partners must be empowered to create their own applications, but the enterprise must still ensure that adequate control and security is in place. This can be especially challenging in a Microsoft IIS intranet environment, as Microsoft has made it easy for end user developers to create powerful, but unsecure, applications. Creation of highly secure applications can require more skills than are possessed by the average end user developer and compromises may need to be made. This paper discusses the evolution of end user computing as well as the issues involved, and explores a number of techniques which can be used to secure end user applications in a Microsoft IIS 4.0 intranet environment.