Blog

Microsoft Internet Explorer compromise highlights POS issue

October 5, 2012 by Brad Cyprus — Chief of Security and Compliance, Vendor Safe Technologies

The key to good security is more than just technology. It starts with an attitude and culminates in a corporate environment designed to keep sensitive data secure. Of course, technology will be part of the equation as will employee training and secure operating procedures. With that in mind, it is easy to see why breaches are still so common when the most prevalent push back we get from small merchants and retailers when trying to help them achieve PCI compliance deals with browsing, specifically, accessing the Internet from their POS server. Inevitably, we hear the same thing, "I'm too small to have another computer lying around so my manager can do what they need to do on the Internet."

Even if this activity could be allowed under PCI (though that is highly unlikely), in most cases, it is a bad idea from a security standpoint. Browsing to compromised web sites is one of the easiest ways that hackers can spread their malware (malicious software) to unsuspecting users. This malware is designed to compromise your data or allow a hacker uninhibited access to your server. The bottom line is that once a hacker gets their hooks into your system, it is usually only a matter of time before you are their next victim.

Most people are still unaware how easy it is to pickup this malware by simply browsing the web. Some malware is so insidious that it can compromise your machine without you clicking on a special link or accepting anything while you are browsing. Just going to the webpage is enough for you to be hacked. If you are still not convinced that you must treat your POS server as an untouchable machine that should not be used for anything besides processing orders, then read this.

Security and convenience are rarely synonymous. It is sometimes inconvenient to change how a location operates even though such a change could prevent a breach. Everyone must operate in a way that supports their business needs, so when evaluating your browsing activities ask yourself if it is worth risking your data for the sake of expediency. Only then, will you be able to make an informed decision.

About Brad Cyprus

---

None

Connect with Brad: