Auditing Archives: The Case of the Overly Helpful Front Desk Clerk

Quick Answer: Why Shouldn't POS Systems Have General Internet Access

‍
POS and property management systems should never allow general internet browsing, since malware from a shared computer can compromise every future card transaction it processes.

• This SecurityMetrics case found hotel front desk clerks routinely using POS computers for guest tasks like printing boarding passes.
• The core issue is lack of network segmentation between POS/property management systems and general internet-connected devices.
• A single malware infection on a shared POS machine puts all future card transactions at risk.
• Segmenting POS systems from other network activity is essential to reducing this exposure.

‍

Just because you can get on the Internet, doesn’t mean you should.

The following post is a segment in the Auditing Archives series. Hopefully the security failures I’ve seen while auditing businesses will help inspire better practices to ensure your own business security.‍

Front desk clerks are friendly…sometimes to a fault, but friendly doesn’t necessarily equal secure. A front desk clerk that helps you print off your afternoon boarding pass on the same computer that was just used to run your credit card violates a serious security protocol. Unfortunately, the problem is pervasive. I’ve seen this issue in virtually every hotel I’ve ever stayed at.

Because point of sale (POS) and property management system components are not segmented from other systems with access to the Internet, any accidental malware download, malicious website, bad link, or virus downloaded to that front desk computer could result a compromise that will risk every future credit card transaction.

See also: SecurityMetrics PCI Guide

‍View the Slideshare below.

‍Auditing Archives: The Case of the Overly Helpful Front Desk Clerk from SecurityMetrics