Solved

Security For Register Software

Posted on 2014-09-20
1
81 Views
Last Modified: 2014-10-29
I am writing software for Point of Sale terminals.  They will be communicating to the MS 2008R2 SQL server at the same time.  I want them to be secure of course and have been researching some options.  I think I have found what i want to do but wanted to get some feedback on my thoughts.  I want to run services on the server that will do all the queries, keeping the passwords local on the server.  Also all communication between the server and the POS will be encrypted with AES 256 using a passed token to initial a handshake between the two systems.  

My concerns are that i am writing with visual studio and will use the wcf for my services and I'm not sure if my server has IIS.  How would I tell?  Can I use the wcf without IIS?

I was going to go simpler route of either using certificates or SSID but we have several employees and heavy turnover so giving access to the database for each user would be a pain.  We are required to have each employee log into the POS with their network credentials.

I got the WCF service to work locally and am hoping it isn't too difficult to move to the server.  Let me know of any areas I may be not considering.

Thanks,
0
Comment
Question by:Millkind
1 Comment
 
LVL 14

Accepted Solution

by:
quizwedge earned 500 total points
ID: 40334476
First, I want to direct you to the PCI compliance standards at https://www.pcisecuritystandards.org/security_standards/documents.php Writing a POS system is simple. Complying with all of the PCI rules isn't. I know PCI compliance isn't part of your question, but I didn't want to recommend something without passing on the PCI compliance standards which would override anything I'll say below.

The short answer is that you can use wcf without IIS. It's possible to wrap it in a windows service. See the following for some ideas. Some of the links are shorter than others.

http://msdn.microsoft.com/en-us/library/bb332338.aspx
http://msdn.microsoft.com/en-us/library/ff649818.aspx
http://msdn.microsoft.com/en-us/library/ms751414.aspx
http://msdn.microsoft.com/en-us/library/ms733069.aspx
http://www.codeproject.com/Tips/692041/How-to-host-a-WCF-service-without-IIS

To enable or configure IIS on the server, see http://msdn.microsoft.com/en-us/library/ms181052(v=vs.80).aspx
0

Featured Post

Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article I will describe the Backup & Restore method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
In this article we will get to know that how can we recover deleted data if it happens accidently. We really can recover deleted rows if we know the time when data is deleted by using the transaction log.
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question