Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/3/2009
02:10 PM
50%
50%

The Point-Of-Sale Problem

Retailers must take sensible steps to protect POS systems or face the consequences.

Smart Steps

To properly manage risk, start by applying the same security practices to the POS system that you use with other sensitive IT systems. For example, just as you would never deploy a network device that still uses the vendor's default user name and password, the same applies to POS devices. All the components of a POS system--hardware, the OS, the application, and the network connections--can have potential defects that could lead to security failures. Whether your own internal experts or a qualified third party review these elements, companies must understand what vulnerabilities their POS systems may contain.

Note that for POS systems that process credit card transactions, the PCI Security Standards Council maintains a list of approved devices. PCI approval doesn't guarantee the products are devoid of security issues, however. Your company ultimately is responsible for protecting customer data.

Another important step is to take a "least privilege" approach to deploying POS systems on the network, especially if you're considering using PCs as dual-purpose computing platforms and POS systems. Under least privilege, you restrict which parts of the network a POS system communicates with, limit the applications and files it can access, and don't let users log in with administrative privileges.

Companies may like dual-purpose POS/general computing platforms because the approach is cheaper than buying each separately, but letting employees check e-mail and surf the Web on the same systems that handle credit cards is a corporate death wish. Dual use increases the system's exposures to "drive-by" and custom malware and Web-based attacks.

If you must support this model, implement a rugged set of technical controls. For example, whitelisting technology from companies like Bit9, McAfee, and CoreTrace ensures that only approved applications will run. Also consider strict limitations on Web access. Do retail employees really need to use Facebook at work?

Our Take
SECURING POINT-OF-SALE DEVICES AND SYSTEMS
Attackers aren't likely to stop targeting POS systems to steal customer cardholder data.
Retailers must account for security when selecting POS devices and systems.
Companies should calculate potential costs of a breach and include them in any TCO calculations for POS systems.
Third-Party Security

If you contract with a POS provider for operations and maintenance, ensure that security controls are a regular component of that maintenance. We have seen breaches where POS vendors didn't upgrade the systems they deployed because their policy was to wait for customers to ask. That's simply unacceptable. Smart companies should build expectations for security best practices into any contract they sign with a provider.

Finally, look for POS systems that have clear security design improvements over legacy ones. For example, companies like Heartland Payment Systems are pushing for the broader adoption of the "chip and pin" approach, in which credit and debit card transactions are authenticated with both a user PIN and a microchip embedded on the card. Other initiatives use tokenization, in which merchants store a reference number rather than a credit card number, and end-to-end encryption. Of course, such initiatives will require large-scale--and expensive--upgrades, so widespread adoption will take years to achieve.

Any system that's part of a payment process is a target of data thieves. Wise companies will assume that the devices, applications, and networks that house sensitive cardholder data are under siege and act accordingly.

 

Recommended Reading:

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11583
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-11584
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-5770
PUBLISHED: 2020-08-03
Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5771
PUBLISHED: 2020-08-03
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious backup archive.
CVE-2020-5772
PUBLISHED: 2020-08-03
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file.