Microsoft® Windows® 2000 Security Handbook

How to Write Secure N-Tier Applications

If you have read this chapter carefully, you have already learned almost everything about security in COM+. I want to finish the discussion with advice regarding the implementation of security in multi-tier applications.

When you design multi-tier applications, you have a choice of implementing security checks either on the database layer or in middleware. It is sometimes a hard choice because it seems that the database is a native place to check who is able to do what with the data. However, the payment for this is usually too high; you lose a lot in performance, your system becomes almost unscalable, and it is difficult to control the security.

In most cases, it is a good decision to check on the database ...