To properly manage risk, start by applying the same security practices to the POS system that you use with other sensitive IT systems. For example, just as you would never deploy a network device that still uses the vendor's default user name and password, the same applies to POS devices. All the components of a POS system--hardware, the OS, the application, and the network connections--can have potential defects that could lead to security failures. Whether your own internal experts or a qualified third party review these elements, companies must understand what vulnerabilities their POS systems may contain.
Note that for POS systems that process credit card transactions, the PCI Security Standards Council maintains a list of approved devices. PCI approval doesn't guarantee the products are devoid of security issues, however. Your company ultimately is responsible for protecting customer data.
Another important step is to take a "least privilege" approach to deploying POS systems on the network, especially if you're considering using PCs as dual-purpose computing platforms and POS systems. Under least privilege, you restrict which parts of the network a POS system communicates with, limit the applications and files it can access, and don't let users log in with administrative privileges.
Companies may like dual-purpose POS/general computing platforms because the approach is cheaper than buying each separately, but letting employees check e-mail and surf the Web on the same systems that handle credit cards is a corporate death wish. Dual use increases the system's exposures to "drive-by" and custom malware and Web-based attacks.
If you must support this model, implement a rugged set of technical controls. For example, whitelisting technology from companies like Bit9, McAfee, and CoreTrace ensures that only approved applications will run. Also consider strict limitations on Web access. Do retail employees really need to use Facebook at work?
If you contract with a POS provider for operations and maintenance, ensure that security controls are a regular component of that maintenance. We have seen breaches where POS vendors didn't upgrade the systems they deployed because their policy was to wait for customers to ask. That's simply unacceptable. Smart companies should build expectations for security best practices into any contract they sign with a provider.
Finally, look for POS systems that have clear security design improvements over legacy ones. For example, companies like Heartland Payment Systems are pushing for the broader adoption of the "chip and pin" approach, in which credit and debit card transactions are authenticated with both a user PIN and a microchip embedded on the card. Other initiatives use tokenization, in which merchants store a reference number rather than a credit card number, and end-to-end encryption. Of course, such initiatives will require large-scale--and expensive--upgrades, so widespread adoption will take years to achieve.
Any system that's part of a payment process is a target of data thieves. Wise companies will assume that the devices, applications, and networks that house sensitive cardholder data are under siege and act accordingly.