8.2 Software Deployment Architectures & Licensing

Software Deployment Architectures & Licensing

Exam Focus: IT professionals must evaluate how software is architected, deployed, and licensed to balance performance, cost, and legal compliance. This section breaks down the operational differences between locally installed thick clients and web-hosted thin clients, compares proprietary closed-source and open-source licensing models, details enterprise procurement structures, and covers software patch maintenance and End of Life (EOL) security risks.

---

Software Deployment Architectures: Locally Installed vs. Web-Based

Applications can be deployed either as locally installed thick clients executing directly on endpoint hardware or as web-based thin clients running across cloud infrastructure.

+-------------------------------------------------------------------------+
|                   SOFTWARE DEPLOYMENT ARCHITECTURES                     |
|                                                                         |
|   THICK / FAT CLIENT (Local Installation)                               |
|   +-----------------------------------------------------------------+   |
|   | Application Logic + Local GUI Engine + Local Processing (CPU/GPU)|   |
|   | Execution on Endpoint Silicon | Works Offline | High Local Storage|   |
|   +-----------------------------------------------------------------+   |
|                                                                         |
|   THIN CLIENT (Web-Based / Cloud-Hosted)                                |
|   +-----------------------------------------------------------------+   |
|   | Browser GUI (HTML5/JS) <== Network ==> Remote Cloud Server Logic|   |
|   | Centralized Execution | Requires Network | Minimal Local Storage|   |
|   +-----------------------------------------------------------------+   |
+-------------------------------------------------------------------------+

1. Locally Installed Applications (Thick / Fat Clients)

A thick client (or fat client) is a software program that is downloaded, installed, and executed entirely on the user's physical computing device (desktop workstation, laptop, or mobile endpoint).

• Local Resource Consumption: The application code is stored on the local non-volatile storage drive (SSD/HDD) and loaded into local system RAM. The application directly harnesses the endpoint's CPU cores, system memory, and dedicated GPU rendering hardware.
• Standard Installation Package Formats:
  • Windows Platforms: .msi (Microsoft Installer packages supporting automated, standardized deployment, logging, and transactional rollbacks via Active Directory Group Policy or Microsoft Intune) and .exe (standalone executable setup routines).
  • macOS Platforms: .dmg (Apple Disk Image containers), .pkg (structured multi-file package installers), and .app (self-contained application directory bundles).
  • Linux Platforms: .deb (Debian and Ubuntu software packages managed via dpkg and apt) and .rpm (Red Hat, Fedora, and openSUSE packages managed via rpm and dnf).
• Key Advantages:
  • Offline Functionality: Fully operational when disconnected from local networks or the Internet. Critical for field engineers, airline travelers, and secure isolated SCADA facilities.
  • Maximum Raw Performance: Negligible input latency and unconstrained access to high-performance local hardware (essential for 3D computer-aided design [CAD], high-definition video editing, audio digital signal processing, and gaming engines).
  • Deep Hardware & Peripheral Access: Direct communication with specialized local hardware interfaces, high-speed PCIe capture cards, and industrial serial peripherals.
• Operational Disadvantages:
  • Significant Storage & Compute Footprint: Consumes gigabytes of local drive space and demands capable host processors and memory.
  • Complex Patch Management: Upgrades and security patches must be distributed and installed across every individual endpoint device.
  • Platform OS Dependency: Software compiled for Windows x86-64 will not run natively on macOS ARM (Apple Silicon) or Linux without virtualization or translation layers.

2. Web-Based / Cloud-Hosted Applications (Thin Clients)

A thin client or web-based application (Software as a Service) is an architecture where core application logic, database processing, and data persistence reside on remote cloud servers. The user interacts with the software through a standard web browser or an ultra-lightweight client wrapper.

• Presentation Layer: The user interface is dynamically rendered inside the web browser utilizing standard web technologies: HTML5 for document structure, CSS for styling, and JavaScript or WebAssembly (Wasm) for client-side interactivity.
• Key Advantages:
  • Universal Cross-Platform Portability: Runs on any device with a modern web browser, regardless of the underlying operating system (Windows, macOS, Linux, ChromeOS, iOS, Android).
  • Zero Local Footprint: Requires negligible local storage space and places minimal computational strain on the client endpoint.
  • Instant, Centralized Patching: When software developers deploy bug fixes, security patches, or new features to the cloud server, 100% of users immediately receive the update on their next browser page refresh. There is no client-side installation process.
  • Data Centralization: Files and user project data persist in cloud storage, preventing data loss if the physical client laptop is lost, damaged, or stolen.
• Operational Disadvantages:
  • Absolute Network Dependency: If local Wi-Fi fails, ISP routing drops, or the cloud provider experiences an outage, the application becomes completely inaccessible.
  • Network Latency & Bandwidth Constraints: Heavy data processing requires round-trip network communications, introducing latency that is unsuitable for ultra-low-latency real-time rendering.
  • Security & Compliance Governance: Corporate proprietary data resides on multi-tenant cloud provider infrastructure, requiring thorough compliance and data residency audits.

Thick Client vs. Thin Client Deployment Comparison

---

Software Licensing Models: Proprietary vs. Open-Source Software

Software is intellectual property protected by copyright law. When an individual or business procures software, they do not own the code; rather, they obtain a legal license defining permitted operational boundaries.

+-------------------------------------------------------------------------+
|                     SOFTWARE INTELLECTUAL PROPERTY                      |
|                                                                         |
|   COMMERCIAL / PROPRIETARY                OPEN-SOURCE SOFTWARE (OSS)    |
|   - Closed-source binary code             - Human-readable source code  |
|   - Strict EULA restrictions              - Modify, audit, redistribute |
|   - Prohibits reverse engineering         - Permissive vs Copyleft      |
|   - Enforced by activation keys / DRM     - Community / commercial model|
+-------------------------------------------------------------------------+

1. Commercial / Proprietary Software (Closed-Source)

In a proprietary software model, the software publisher retains exclusive commercial ownership of the source code. The code is compiled into binary machine executables before distribution, shielding internal algorithms as proprietary trade secrets.

• End User License Agreement (EULA): A legally binding contract between the software publisher and the end user. The EULA explicitly dictates how many machines may run the software, restricts reverse engineering or decompilation, prohibits commercial resale or unauthorized redistribution, and disclaims publisher warranties.
• Digital Rights Management (DRM) & Activation: Proprietary software enforces compliance through technical countermeasures, including alphanumeric product keys, mandatory online activation servers, hardware configuration fingerprinting, or physical USB security dongles.
• Commercial Support & Vendor Accountability: While proprietary licenses carry licensing costs, commercial vendors provide formal Service Level Agreements (SLAs), enterprise technical support hotlines, certified compatibility documentation, and regular security patch schedules.
• Examples: Microsoft Windows, Adobe Creative Cloud, AutoCAD, macOS.

2. Open-Source Software (OSS)

Open-Source Software (OSS) provides users with access to the underlying human-readable source code. Anyone is legally entitled to inspect the code, modify it to suit custom technical requirements, compile it, and redistribute it under defined open-source licensing terms.

• Free as in Speech vs. Free as in Beer: The open-source movement emphasizes freedom (the right to view, modify, and run software) rather than merely zero financial cost (gratis). Many commercial enterprises (such as Red Hat / IBM and Canonical) build highly profitable multi-billion-dollar business models around open-source software by selling enterprise technical support, certified security patches, and deployment integration services.
• Key Security & Quality Advantages: The ability to inspect source code enables comprehensive security auditing by independent researchers, ensuring there are no hidden surveillance backdoors or undisclosed data telemetry.

Open-Source License Categories: Permissive vs. Copyleft

Open-source licenses are broadly divided into two primary legal philosophies:

1. Permissive Open-Source Licenses:
   • Impose minimal restrictions on downstream users and developers.
   • Core Feature: Developers are permitted to take the open-source code, modify it, and incorporate it into closed-source, proprietary commercial software products without being legally required to release their modifications back to the public.
   • Prominent Examples:
     • MIT License: Extremely concise and permissive. Allows anyone to use, copy, modify, merge, publish, distribute, or sell copies of the software, requiring only that the original copyright notice and permission disclaimer be preserved.
     • Apache License 2.0: Permissive license similar to MIT, but includes explicit grants of patent rights from contributors and prevents users from misusing trademarks associated with the project.
     • BSD Licenses (2-Clause / 3-Clause): Lightweight permissive licenses requiring copyright retention.
2. Copyleft / Reciprocal Open-Source Licenses:
   • Designed to preserve software freedom across all future derivatives.
   • Core Feature (The "Share-Alike" Provision): If an engineer modifies copyleft-licensed source code or links it into a larger program and distributes the result, the entire combined derivative work must also be released under the exact same copyleft license, with all modified source code made publicly available.
   • Corporate Caution: Commercial software firms prohibit their developers from incorporating copyleft code into proprietary corporate software suites to prevent the legal hazard of being forced to open-source proprietary trade secrets.
   • Prominent Example: GNU General Public License (GPL / GPLv3), GNU Lesser General Public License (LGPL).

---

Commercial Licensing Structures & User Entitlement Models

Enterprise software procurement requires selecting the appropriate financial structure and user entitlement tier to balance organizational operational demands against software licensing budgets.

+-------------------------------------------------------------------------+
|                    COMMERCIAL PROCUREMENT STRUCTURES                    |
|                                                                         |
|   [ Perpetual License ]     --> One-time buy, owned version, paid upgrade|
|   [ Subscription (SaaS) ]   --> Recurring fee, continuous updates, cloud |
|                                                                         |
|                    USER ENTITLEMENT TIER MODELS                         |
|                                                                         |
|   [ Single-User / Seat ]    --> 1 Named user or 1 specific machine      |
|   [ Multi-User / Volume ]   --> Bulk bucket (e.g., 200 seats), KMS/VLK   |
|   [ Concurrent / Floating ] --> Shared pool, max simultaneous users     |
|   [ Site / Enterprise ]     --> Unlimited installs across campus/firm   |
+-------------------------------------------------------------------------+

1. Perpetual Licensing vs. Subscription-Based Licensing

• Perpetual License Model:
  • Structure: The customer pays a one-time upfront capital expenditure (CapEx) to purchase the right to utilize a specific version of a software application indefinitely.
  • Upgrades & Maintenance: The license applies strictly to the purchased release (e.g., Office 2021). The customer receives free minor bug and security patches for that specific release, but major version upgrades require purchasing a new license. Vendors often sell optional annual Software Assurance or maintenance contracts.
  • Operational Advantage: The organization retains access to the software permanently without recurring operational costs.
• Subscription-Based Model (SaaS):
  • Structure: The customer pays a recurring operating expenditure (OpEx) billed monthly or annually (e.g., Microsoft 365, Adobe Creative Cloud).
  • Continuous Upgrades: As long as the subscription remains active, the user always has access to the most recent software release, feature enhancements, cloud storage integrations, and technical support.
  • Cancellation Lockout: If the organization terminates the subscription, the software immediately locks out usage or reverts to an unactivated, read-only mode where files can be viewed but not edited or created.

2. User Entitlement Models

• Single-User / Single-Seat License: The license is assigned to one designated individual or installed onto one specific physical computer. It cannot be legally shared or installed across multiple workstations.
• Multi-User / Volume Licensing: An organization purchases a defined quota of licenses (e.g., a 250-seat pack) under a unified enterprise agreement. Rather than managing 250 separate consumer retail boxes, IT administrators deploy the software using a single Volume License Key (VLK) or authenticate machines automatically against a local enterprise Key Management Service (KMS) server.
• Concurrent User Licensing (Floating License):
  • Operational Structure: Software is installed on hundreds of employee computers across the company. However, the organization purchases a limited pool of concurrent license tokens (e.g., 50 tokens) managed by a central network license server daemon.
  • Token Checkout: When an employee launches the application, the client software contacts the license server and checks out an active token. When the employee closes the program, the token returns to the shared pool. If all 50 tokens are checked out, the 51st user receives an alert requesting them to wait until another user exits.
  • Ideal Use Case: Shift-based environments (such as 24/7 hospital nursing stations, emergency call dispatch centers, or engineering firms where personnel use expensive CAD software only a few hours per week).
• Site / Enterprise License: A comprehensive enterprise agreement granting the customer the right to install and execute the software on an unlimited number of computers throughout a specific physical site, corporate facility, or across the entire worldwide organization. Eliminates the administrative burden of tracking individual seat counts.

---

Legitimate Sources, Removal & Piracy

Obtain software from an original equipment manufacturer (OEM) or publisher website, a trusted enterprise repository, or an official application store. Validate the publisher, domain, digital signature, reviews, permissions, and update path before installation; a third-party download page can bundle malware or an altered installer. Proprietary products may use a product key or serial number to prove a license entitlement, but a key found on a public website does not make an unauthorized copy legal.

Remove unwanted software the user did not intend to install and unnecessary software that no longer serves a business purpose. Fewer installed applications mean fewer background processes and fewer components to patch. Software piracy is the installation, copying, sharing, or use of software outside its license terms. Besides violating the license and law, pirated installers are a frequent malware source and receive no trustworthy update or support path.

Software Maintenance & Lifecycle Management

Software deployment is not a one-time event. IT administrators must continuously patch and maintain installed systems while tracking vendor support lifecycles.

Software Update Classifications

• Hotfix: A targeted, single-issue software update engineered to resolve an immediate, critical system bug or actively exploited zero-day security flaw. Hotfixes are released outside standard patch cycles and are applied rapidly without waiting for comprehensive regression testing.
• Patch: A scheduled, minor software update designed to fix non-critical bugs, optimize system performance, or remediate known security vulnerabilities identified during routine vendor testing.
• Service Pack / Feature Update: A cumulative, comprehensive roll-up package that bundles all prior hotfixes, security patches, system updates, and significant new functional capabilities into a single unified installer.

Automated Patch Management & Orchestration

Enterprise environments disable uncoordinated consumer update prompts in favor of centralized update management systems (such as Windows Server Update Services [WSUS], Microsoft Intune, macOS Mobile Device Management [MDM], or Ansible playbooks).

• Staging and Testing: Systems administrators deploy updates first to an isolated pilot testing group of representative computers. Once stability, application compatibility, and line-of-business software interactions are verified, the update ring expands enterprise-wide.

End of Life (EOL) & End of Support (EOS) Hazards

Every software product follows a planned commercial and technical lifecycle established by the publisher:

• End of Life (EOL): The software product is discontinued from general sale and will receive no further feature innovations or architectural improvements.
• End of Support (EOS) / End of Service: The vendor completely ceases the development and distribution of security patches, bug fixes, vulnerability remediations, and technical telephone support.
• The Critical Security Threat: When an operating system or enterprise application reaches EOS, newly discovered vulnerabilities are never patched by the vendor. Attackers and automated exploit kits reverse-engineer unpatched flaws, creating permanent, unmitigated attack vectors. Organizations running EOS software face catastrophic ransomware exposure, severe regulatory non-compliance fines (e.g., violating HIPAA or PCI-DSS requirements), and system failure.