When did your PowerBuilder application last go through a security architecture review?

Your PowerBuilder application probably runs on implicit trust.

It was designed for a corporate network where users on the inside are trusted, database connections are direct, and there is no authentication boundary at the API layer — because there is no API layer.

That architecture made sense in 1998. In 2025 it is an attack surface, not a design choice.

Modern enterprise security requirements cannot be retrofitted onto a client/server PowerBuilder architecture without fundamental change:

Multi-factor authentication requires an identity layer the architecture doesn’t have. Token-based API authorization requires an API boundary that doesn’t exist. SIEM integration requires structured audit events at the transaction level — not available from a desktop client that talks directly to the database. Zero-trust network access requires every request to be authenticated at the service layer.

A properly executed modernization resolves all of this by design:

OAuth 2.0 with Azure AD or Okta issues JWT tokens. Every API call is authenticated and authorized by ASP.NET Core middleware. Fine-grained authorization — field-level visibility, transaction approval thresholds — is encoded in policy-based authorization. A full audit trail exists at the service layer, independent of the database.

The presentation layer replacement is what users notice. The security architecture improvement is what your CISO notices. The compliance exposure reduction is what your legal team notices.

When did your PowerBuilder application last go through a security architecture review?

You can find relevant information in the specific section: https://enable-dev.com/modernization

The target architecture for a modernized PowerBuilder application is a clean three-tier system

The target architecture for a modernized PowerBuilder application is a clean three-tier system.

Tier 1 — the frontend: A React or Angular single-page application, served from a CDN. Fully responsive — works on a 375px phone screen, a tablet, and also a widescreen monitor. Furthermore communicates with the backend exclusively through HTTPS API calls. A React Native or Flutter app shares the same API surface for mobile.

Tier 2 — the service layer: An ASP.NET Core application, containerized, deployed in Kubernetes or Azure App Service. Hosts a versioned REST API secured with OAuth 2.0. Each controller maps to a functional domain — accounts, orders, reporting — and internally uses .NET DataStore objects to execute the business logic originally contained in PowerBuilder DataWindows. Secured with JWT, fine-grained authorization via ASP.NET Core policies.

Tier 3 — the database: Preserved as-is during the initial migration to ensure continuity. The existing relational database — SQL Server, Oracle, DB2 — continues as the system of record. Schema changes are introduced once the application layer reaches stability.

Three properties make this architecture compelling:

It is incremental — individual DataWindow objects migrate one at a time while the rest continue running in the legacy application.

It’s verifiable — the DataStore and the original app run against the same inputs, with outputs compared automatically.

It’s evolvable — once logic runs in .NET, it can be refactored into handwritten C# service classes wherever business value justifies it.

You can find relevant information in the specific section: https://enable-dev.com/modernization

When did your PowerBuilder application last go through a security architecture review?

The target architecture for a modernized PowerBuilder application is a clean three-tier system

We've never lost a business rule. Not one.