I have experience developing software and web applications and I have decided to do some freelance work on the side. Well, I met with my first client and they are requesting a relatively simple, custom system that (without being long winded) tracks client’s paperwork as it progresses through the business’s different manual processes.
It is a small business that has about 10 employees, but all of the employees will interact with the client’s paperwork, therefore everyone would need access to the new system. When I say track I literally mean that the employees will check as complete on a simple page the increases a progress bar at different stages for the paperwork.
Now I am %110 capable of coding the custom system that meets their needs, but I am unsure about how I should go about doing it.
The information that is being tracked in the new system and stored in the DB is confidential information that they are very protective of. My main question is how should I be developing this to be as secure as I can?
- They have their own server in house, so should I develop an application (VB and SQL) for the server and require employees to log on remotely to use it? Can more than one person access/use the application at a time?
- Or should I develop a web application (ASP.Net/VB and SQL) that is only accessible on their network to their employees? They plan to expand offices, could they set up a VPN to access the site?
I’m leaning towards a web application, but I have not done too much in term of security. What specific options do I have for security that aren’t too complex.
Basically I’m looking for pros and cons for either option or any suggestions on what I should.
Actually, you have two independent choices to make:
-
Web application vs. desktop application,
-
An application available from anywhere vs. an application available only on local network.
The first choice has nothing to do with the network security and must be dictated by two elements:
-
The constraints related to the permissions required on the local machine. For example, you can’t force print something from a web application, but only to invite the user to print it, you can’t access local file system, etc.
-
The UX concerns, desktop applications being able to provide richer interaction design while having lesser impact on the performance. This is less true since HTML 5.
The second choice should be motivated by the ease of access to the system:
-
Entering passwords is tiring. They can be remembered, but once a user changes his Active Directory password, let’s say once per month, he should enter his password again in his application.
For an application which is accessed from the internet, there is nothing you can do. On the other hand, when the user is on a local network, use Windows authentication to save the user the burden of entering a password.
-
VPNs are difficult to set up, often tied to a specific version of an operating system and rarely upgraded, etc. Don’t use them.
If you want to provide the easiest way to use your app, make it available from anywhere, but also make it aware of the case where it is on a local network. In the first case, it will prompt for a username and a password; in the second case, it will be authenticated automatically.
If you’re concerned about security, don’t reinvent the authentication mechanism, use salts and hashes, use PBKDF2, read a good book about security and visit IT Security Stack Exchange website.
Note: why are you talking about ASP in the title of your question, while the question has nothing to do with it?
3
To add to @MainMa’s answer, this sounds to me more like a Project Management question, rather than a technical one.
The classic Project Manager’s triangle:
You control one side, the client control’s the other two.
You said you wanted to do web, but worried about security (scope). Does your budget allow for training / research / education? (cost). Even if you can afford the training, does the time frame allow you the time required to learn it? (schedule).
The old adage, “Sales Solves Everything” certainly applies.
Which technical direction can you afford?
To add To Christian’s answer, I think it’s only your decision so far. It will be better to think all the possibilities based on the information that you are having, prepare the answers and estimates, then communicate with your client.
Communication is one of the key parts to be an consultant. I have been seeing a lot of consultant without good tech skills, but they can solve the clients’ problems.
Clients like options, but sometime, they lost in the options, and you can help them or give suggestions at that time. However, make sure they understand all the scenarios, causes/effects.