Active Server Pages (ASP) is Microsoft's server-side script engine for dynamically-generated web pages. It is marketed as an add-on to Internet Information Services (IIS). Programming ASP websites is made easier by various built-in objects. Each object corresponds to a group of frequently-used functionality useful for creating dynamic web pages. In ASP 2.0 there are six such built-in objects: Application, ASPError, Request, Response, Server, and Session. Session, for example, is a cookie-based session object that maintains variables from page to page.
Most ASP pages are written in VBScript, but any other Active Scripting engine can be selected instead by using the @Language directive or the <script language="language" runat="server"> syntax. JScript (Microsoft's implementation of ECMAScript) is the other language that is usually available. PerlScript (a derivative of Perl) and others are available as third-party installable Active Scripting engines.
InstantASP and ChiliASP are technologies that run ASP without Windows Operating System. There are large open source communities on the WWW, such as ASPNuke, which produce ASP scripts, components and applications to be used for free under certain license terms.
An application service provider (ASP) is a business that provides computer-based services to customers over a network. Software offered using an ASP model is also sometimes called On-demand software or software as a service (SaaS). The most limited sense of this business is that of providing access to a particular application program (such as medical billing) using a standard protocol such as HTTP.
The need for ASPs has evolved from the increasing costs of specialized software that have far exceeded the price range of small to medium sized businesses. As well, the growing complexities of software have led to huge costs in distributing the software to end-users. Through ASPs, the complexities and costs of such software can be cut down. In addition, the issues of upgrading have been eliminated from the end-firm by placing the onus on the ASP to maintain up-to-date services, 24 x 7 technical support, physical and electronic security and in-built support for business continuity and flexible working.
The importance of this marketplace is reflected by its size. As of early 2003, estimates of the United States market range from 1.5 to 4 billion dollars. Clients for ASP services include businesses, government organizations, non-profits, and membership organizations.
The ASP model
The application software resides on the vendor's system and is accessed by users through a web browser using HTML or by special purpose client software provided by the vendor. Custom client software can also interface to these systems through XML APIs. These APIs can also be used where integration with in-house systems is required.
Common features associated with ASPs include:
- ASP fully owns and operates the software application(s)
- ASP owns, operates and maintains the servers that support the software
- ASP makes information available to customers via the Internet or a "thin client"
- ASP bills on a "per-use" basis or on a monthly/annual fee
The advantages to this approach include:
- Software integration issues are eliminated from the client site
- Software costs for the application are spread over a number of clients
- Vendors can build more application experience than the in-house staff
- Key software systems are kept up to date, available, and managed for performance by experts
- Improve the reliability, availability, scalability and security of internal IT systems
- A provider's service level agreement guarantees a certain level of service
- Access product and technology experts dedicated to available products
- Reduce internal IT costs to a predictable monthly fee.
- Redeploy IT staff and tools to focus on strategic technology projects that impact the enterprise's bottom line
Some inherent disadvantages include:
- The client must generally accept the application as provided since ASPs can only afford a customized solution for the largest clients
- The client may rely on the provider to provide a critical business function, thus limiting their control of that function and instead relying on the provider
- Changes in the ASP market may result in changes in the type or level of service available to clients
- Integration with the client's non-ASP systems may be problematic
- Evaluating an Application Service Provider security when moving to an ASP infrastructure can come at a high cost, as such a firm must assess the level of risk associated with the ASP itself. Failure to properly account for such risk can lead to:
Loss of control of corporate data
- Loss of control of corporate image
- Insufficient ASP security to counter risks
- Exposure of corporate data to other ASP customers
- Compromise of corporate data
- Some other risks include failure to account for the financial future of the ASP in general, i.e. how stable a company are they and do they have the resources to continue business into the foreseeable future.
For these reasons Cisco Systems has developed a comprehensive evaluation guideline. This guideline includes evaluating the scope of the ASP's service, the security of the program and the ASP's maturity with regard to security awareness. Finally the guidelines indicate the importance of performing audits on the ASP with respect to:
- Port/Network service
- Application vulnerability
- ASP Personnel
Physical visits to the ASP to assess the formality of the organization will provide invaluable insight into the awareness of the firm.
| 
+ 91
97 6960 3939
+ 44 20 7193 7303 
Creative Web Mall (India) Pvt. Ltd.