You are working in the IT shop of a rapidly growing organization that is plannin

Question

You are working in the IT shop of a rapidly growing organization that is planning to implement a new client/ server system. Initially, there will be slightly fewer than 100 clients, with a substantial amount of data input and data analysis activity across the network. The business drivers are to be able to get data in and to crunch it quickly. The budget for the project is robust and allows for the purchase of powerful workstations and personal computers. The designers on the team are pretty well evenly divided between a two-tiered and three-tiered client/server architecture. They are looking to you for advice. What would you recommend? Why?

Explanation / Answer

There are several reasons why I would recommend a two-tiered system for this architecture. The main reasons are:

1. Security: security is a tough one because arguments can be made either way for 2 vs. 3-tiers. In my experience, the 3-tier architecture has the potential for better security, but if great care isn’t taken during development it frequently ends up less secure. With a 2-tier approach, the application authenticates to and communicates directly to the database, which simplifies the attack surface area and is one less boundary to be concerned about. Depending on the details of the application server, there could be, for example, many complex REST APIs that could each have their own attack weaknesses.

2. Cost: 2-tier applications are generally easier to build and because of their lower complexity are less expensive all around.

3. Ease of maintainance: Although part of cost consideration, ease of maintenance is worth analyzing separately. Keeping the client up to date in a 2-tier architecture can be a trouble point that is not an issue with most 3-tier designs. However, in a 3-tiered architecture, keeping the application tier up to date is much more difficult in the long run. For example, sometimes security patches required to keep the application tier secure are not compatible with your code and require you to make code changes, which can be extensive.

Related Questions

Navigate

• Browse (All)
• Browse Y
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.