Hello Patrick,  I think you miss my point, and maybe that even scares me more. There is nothing wrong with the topology. Sure, all ports are closed, SSL is being used and they can only come in on port 443. The weakest link here is there is too much information in the public login page. Inside the HTML source you can see all kinds of input boxes, password dialogs and settings. A hacker can use these to try some sql injection methods or buffer overruns or other exploits. Maybe the code prevents this, maybe not, but you shouldn't give a way so much information to possible hackers. If a developer forgets to check one of the (hidden) inputboxes, a hacker may find nice things to do with that. Now, I'm sure the default username/password boxes are checked for all wellknown exploits, but because you present so much information in the HTML source, he may also try the change password function. It's completely in the source, even if we disable this function.  Our conclusion: The webportal needs some code cleanups.It's currenlty not safe, or at least gives away too much information for possible exploits/hacks.
Today I was attended by one of our web developers. He took a look at the source code of the vworkspace portal. He said he was shocked to see that the login page contained so much extra information. He could adjust all kinds of settings using javascript. He also saw some interesting things about changing passwords and lots of other stuff that could attract hackers. All this without being logged in. So any guest internet user could do this.  You would expect a web portal, that is connected to the internet, to provide only a very basic login page without any other things that can be changed. A normal user wouldn't care, but hackers do like this information. If a hacker sees java code to change passwords, that is something he would give a closer look.  So my question is: Is it really safe to use the web portal on internet without being hacked?
Is it safe to use the web portal on internet?