Risk
12/3/2009
02:10 PM
Connect Directly
RSS
E-Mail
50%
50%

The Point-Of-Sale Problem

Retailers must take sensible steps to protect POS systems or face the consequences.

Smart Steps

To properly manage risk, start by applying the same security practices to the POS system that you use with other sensitive IT systems. For example, just as you would never deploy a network device that still uses the vendor's default user name and password, the same applies to POS devices. All the components of a POS system--hardware, the OS, the application, and the network connections--can have potential defects that could lead to security failures. Whether your own internal experts or a qualified third party review these elements, companies must understand what vulnerabilities their POS systems may contain.

Note that for POS systems that process credit card transactions, the PCI Security Standards Council maintains a list of approved devices. PCI approval doesn't guarantee the products are devoid of security issues, however. Your company ultimately is responsible for protecting customer data.

Another important step is to take a "least privilege" approach to deploying POS systems on the network, especially if you're considering using PCs as dual-purpose computing platforms and POS systems. Under least privilege, you restrict which parts of the network a POS system communicates with, limit the applications and files it can access, and don't let users log in with administrative privileges.

Companies may like dual-purpose POS/general computing platforms because the approach is cheaper than buying each separately, but letting employees check e-mail and surf the Web on the same systems that handle credit cards is a corporate death wish. Dual use increases the system's exposures to "drive-by" and custom malware and Web-based attacks.

If you must support this model, implement a rugged set of technical controls. For example, whitelisting technology from companies like Bit9, McAfee, and CoreTrace ensures that only approved applications will run. Also consider strict limitations on Web access. Do retail employees really need to use Facebook at work?

Our Take
SECURING POINT-OF-SALE DEVICES AND SYSTEMS
Attackers aren't likely to stop targeting POS systems to steal customer cardholder data.
Retailers must account for security when selecting POS devices and systems.
Companies should calculate potential costs of a breach and include them in any TCO calculations for POS systems.
Third-Party Security

If you contract with a POS provider for operations and maintenance, ensure that security controls are a regular component of that maintenance. We have seen breaches where POS vendors didn't upgrade the systems they deployed because their policy was to wait for customers to ask. That's simply unacceptable. Smart companies should build expectations for security best practices into any contract they sign with a provider.

Finally, look for POS systems that have clear security design improvements over legacy ones. For example, companies like Heartland Payment Systems are pushing for the broader adoption of the "chip and pin" approach, in which credit and debit card transactions are authenticated with both a user PIN and a microchip embedded on the card. Other initiatives use tokenization, in which merchants store a reference number rather than a credit card number, and end-to-end encryption. Of course, such initiatives will require large-scale--and expensive--upgrades, so widespread adoption will take years to achieve.

Any system that's part of a payment process is a target of data thieves. Wise companies will assume that the devices, applications, and networks that house sensitive cardholder data are under siege and act accordingly.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0985
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.

CVE-2014-0986
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.

CVE-2014-0987
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.

CVE-2014-0988
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.

CVE-2014-0989
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.

Best of the Web
Dark Reading Radio