Security For Register Software

I am writing software for Point of Sale terminals.  They will be communicating to the MS 2008R2 SQL server at the same time.  I want them to be secure of course and have been researching some options.  I think I have found what i want to do but wanted to get some feedback on my thoughts.  I want to run services on the server that will do all the queries, keeping the passwords local on the server.  Also all communication between the server and the POS will be encrypted with AES 256 using a passed token to initial a handshake between the two systems.  

My concerns are that i am writing with visual studio and will use the wcf for my services and I'm not sure if my server has IIS.  How would I tell?  Can I use the wcf without IIS?

I was going to go simpler route of either using certificates or SSID but we have several employees and heavy turnover so giving access to the database for each user would be a pain.  We are required to have each employee log into the POS with their network credentials.

I got the WCF service to work locally and am hoping it isn't too difficult to move to the server.  Let me know of any areas I may be not considering.

Thanks,
MillkindAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
quizwedgeConnect With a Mentor Commented:
First, I want to direct you to the PCI compliance standards at https://www.pcisecuritystandards.org/security_standards/documents.php Writing a POS system is simple. Complying with all of the PCI rules isn't. I know PCI compliance isn't part of your question, but I didn't want to recommend something without passing on the PCI compliance standards which would override anything I'll say below.

The short answer is that you can use wcf without IIS. It's possible to wrap it in a windows service. See the following for some ideas. Some of the links are shorter than others.

http://msdn.microsoft.com/en-us/library/bb332338.aspx
http://msdn.microsoft.com/en-us/library/ff649818.aspx
http://msdn.microsoft.com/en-us/library/ms751414.aspx
http://msdn.microsoft.com/en-us/library/ms733069.aspx
http://www.codeproject.com/Tips/692041/How-to-host-a-WCF-service-without-IIS

To enable or configure IIS on the server, see http://msdn.microsoft.com/en-us/library/ms181052(v=vs.80).aspx
0
All Courses

From novice to tech pro — start learning today.