Risk
12/3/2009
02:10 PM
Connect Directly
RSS
E-Mail
50%
50%

The Point-Of-Sale Problem

Retailers must take sensible steps to protect POS systems or face the consequences.

Smart Steps

To properly manage risk, start by applying the same security practices to the POS system that you use with other sensitive IT systems. For example, just as you would never deploy a network device that still uses the vendor's default user name and password, the same applies to POS devices. All the components of a POS system--hardware, the OS, the application, and the network connections--can have potential defects that could lead to security failures. Whether your own internal experts or a qualified third party review these elements, companies must understand what vulnerabilities their POS systems may contain.

Note that for POS systems that process credit card transactions, the PCI Security Standards Council maintains a list of approved devices. PCI approval doesn't guarantee the products are devoid of security issues, however. Your company ultimately is responsible for protecting customer data.

Another important step is to take a "least privilege" approach to deploying POS systems on the network, especially if you're considering using PCs as dual-purpose computing platforms and POS systems. Under least privilege, you restrict which parts of the network a POS system communicates with, limit the applications and files it can access, and don't let users log in with administrative privileges.

Companies may like dual-purpose POS/general computing platforms because the approach is cheaper than buying each separately, but letting employees check e-mail and surf the Web on the same systems that handle credit cards is a corporate death wish. Dual use increases the system's exposures to "drive-by" and custom malware and Web-based attacks.

If you must support this model, implement a rugged set of technical controls. For example, whitelisting technology from companies like Bit9, McAfee, and CoreTrace ensures that only approved applications will run. Also consider strict limitations on Web access. Do retail employees really need to use Facebook at work?

Our Take
SECURING POINT-OF-SALE DEVICES AND SYSTEMS
Attackers aren't likely to stop targeting POS systems to steal customer cardholder data.
Retailers must account for security when selecting POS devices and systems.
Companies should calculate potential costs of a breach and include them in any TCO calculations for POS systems.
Third-Party Security

If you contract with a POS provider for operations and maintenance, ensure that security controls are a regular component of that maintenance. We have seen breaches where POS vendors didn't upgrade the systems they deployed because their policy was to wait for customers to ask. That's simply unacceptable. Smart companies should build expectations for security best practices into any contract they sign with a provider.

Finally, look for POS systems that have clear security design improvements over legacy ones. For example, companies like Heartland Payment Systems are pushing for the broader adoption of the "chip and pin" approach, in which credit and debit card transactions are authenticated with both a user PIN and a microchip embedded on the card. Other initiatives use tokenization, in which merchants store a reference number rather than a credit card number, and end-to-end encryption. Of course, such initiatives will require large-scale--and expensive--upgrades, so widespread adoption will take years to achieve.

Any system that's part of a payment process is a target of data thieves. Wise companies will assume that the devices, applications, and networks that house sensitive cardholder data are under siege and act accordingly.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio