Risk
12/3/2009
02:10 PM
50%
50%

The Point-Of-Sale Problem

Retailers must take sensible steps to protect POS systems or face the consequences.

Smart Steps

To properly manage risk, start by applying the same security practices to the POS system that you use with other sensitive IT systems. For example, just as you would never deploy a network device that still uses the vendor's default user name and password, the same applies to POS devices. All the components of a POS system--hardware, the OS, the application, and the network connections--can have potential defects that could lead to security failures. Whether your own internal experts or a qualified third party review these elements, companies must understand what vulnerabilities their POS systems may contain.

Note that for POS systems that process credit card transactions, the PCI Security Standards Council maintains a list of approved devices. PCI approval doesn't guarantee the products are devoid of security issues, however. Your company ultimately is responsible for protecting customer data.

Another important step is to take a "least privilege" approach to deploying POS systems on the network, especially if you're considering using PCs as dual-purpose computing platforms and POS systems. Under least privilege, you restrict which parts of the network a POS system communicates with, limit the applications and files it can access, and don't let users log in with administrative privileges.

Companies may like dual-purpose POS/general computing platforms because the approach is cheaper than buying each separately, but letting employees check e-mail and surf the Web on the same systems that handle credit cards is a corporate death wish. Dual use increases the system's exposures to "drive-by" and custom malware and Web-based attacks.

If you must support this model, implement a rugged set of technical controls. For example, whitelisting technology from companies like Bit9, McAfee, and CoreTrace ensures that only approved applications will run. Also consider strict limitations on Web access. Do retail employees really need to use Facebook at work?

Our Take
SECURING POINT-OF-SALE DEVICES AND SYSTEMS
Attackers aren't likely to stop targeting POS systems to steal customer cardholder data.
Retailers must account for security when selecting POS devices and systems.
Companies should calculate potential costs of a breach and include them in any TCO calculations for POS systems.
Third-Party Security

If you contract with a POS provider for operations and maintenance, ensure that security controls are a regular component of that maintenance. We have seen breaches where POS vendors didn't upgrade the systems they deployed because their policy was to wait for customers to ask. That's simply unacceptable. Smart companies should build expectations for security best practices into any contract they sign with a provider.

Finally, look for POS systems that have clear security design improvements over legacy ones. For example, companies like Heartland Payment Systems are pushing for the broader adoption of the "chip and pin" approach, in which credit and debit card transactions are authenticated with both a user PIN and a microchip embedded on the card. Other initiatives use tokenization, in which merchants store a reference number rather than a credit card number, and end-to-end encryption. Of course, such initiatives will require large-scale--and expensive--upgrades, so widespread adoption will take years to achieve.

Any system that's part of a payment process is a target of data thieves. Wise companies will assume that the devices, applications, and networks that house sensitive cardholder data are under siege and act accordingly.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.