Security etc advice required

[terryd]

One of my clients is the largest retailer of cellphones in the country. Up until now they have been filling in application forms and faxing them to our site. Our staff then capture the data (on an internal website created using Nettalk) and from there we debit their bank accounts, receive and administer claims generate reports etc.
They have now raised the possibility of allowing retail staff at their stores to capture the data on tablets directly onto the system
We will be recommending the tablet to use and creating the web interface.
 I will  capture their input to a separate database and only update my live database after vetting of the captured information
The problems that occur to me are:
1. Is there a way to establish which tablet is connecting to the website. Since the staff can login and since staff turnover is high I don't want a situation to arise where a member of staff has left and in a fit of pique decides to login and create a whole bunch of ficticious records which we won't know about until the client starts screaming about illegal deductions on his account. My thought was that if there was someway to register the tablet identities on our site then I could restrict external access to only those units.
2. What is the best way to verify the user? I already have a database of the users with their company empolyment number, name and store at which they are currently working. My though was to add another field being their ID number. When they are added to the system we allocate a password to them which we urge them to change. If they forget their password I would then ask them to enter their login (employee number) and their ID number. If these correspond to the database I would then automatically reset their password to a standard word like 'password'
Any comments or suggestions to increase the security without human intervention since there could be as many as 1500 staff involved.
3. We would like to get the user to sign on a digital pad once the information has been input. Any suggestions as to which tablet/operating system would be useable with a digital pad?

I have more issues which I will be addressing but these are those which are at the forefront at the moment.
Any advice appreciated

[kevin plummer]

1) You could restrict which IP address's can connect to your website. So if they try to login from home then it won't work
2) Email address is a good one. Seems to be the norm when resetting a pw that it emails a temp link to the user where they can use the link within a specified time to reset their password. SMS is also used to text the password.

[terryd]

Thanks Kevin.
Yes I had thought of the IP address restriction. Definitely the best way to go, plus it would also handle the security concern in section 2 since staff leaving wouldn't have access to the tablet or IP address.
email address is handy. My only caveat is that within the company email addresses are standardised and very easy to calculate for someone else's email address. e.g if your name is terry davidson then your email address is terry.davidson@company.co.za.

[Bruce]

firstly with regard to the passwords - you want to store them as a Salted, Hashed value. I did a bit on ClarionLive on this at some point, but it's not my own invention - you can google it and you'll get lots of info. Also see this link;
http://www.nettalkcentral.com/index.php?option=com_smf&Itemid=36&topic=3896.0;prev_next=next

In terms of limiting the number of devices, the IP address option is probably the best.

Give the user some way to remove access rights when they terminate an employee. they will avoid a lot of problems if they just remove access at the same time they lose the employee. They presumably have a bunch of things to do when an employee leaves (like redirect his email etc) so this is just one more task on that list.

a good audit trail sounds mandatory.

Cheers
Bruce

[terryd]

Thanks Bruce
I'm also looking at the Vodacom AVN option which looks like the answer since it restricts all the simcards issued to the same private network.