Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

The 8 Do’s and Don’ts of Remote Access and Point-of-Sale Systems

Over the years, the point-of-sale (POS) environment has evolved from traditional cash registers and dial-up modems to more flexible, always-on multipurpose systems. These systems bring forth a greater technical complexity for retail storefronts.

Merchants now use high-speed connections with POS terminals that commonly link to a central server, providing the corporate office with insight into customer purchases and their spending habits. Operating on high-speed connectivity at all times also brings a new level of efficiency to the payments industry, including handling system maintenance and troubleshooting remotely.

The convenience of being able to remotely access your POS system from anywhere can be appealing and convenient. It may save you, your IT staff or your service providers (vendors, integrators, resellers) a visit to your office or store.

But the advantages offered by remote management software exposed to the internet may also pose significant risk to the security of your customer payment card information. Attackers, too, can gain access to these remote access tools - often by cracking weak passwords - to bypass security measures and laterally advance across your network. According to the 2016 Trustwave Global Security Report, insecure remote access software and policies, at 13 percent, contributed to the largest share of compromises Trustwave investigated in 2015 - and nearly all POS breaches in the year prior.

Security of cardholder data for merchants is critical, but remote access solutions pose an increased risk if they are not used in a manner with the Payment Card Industry Data Security Standard (PCI DSS). Here are some tips for helping stay in compliance and keeping your POS systems safeguarded against cyberattacks.

What You Should Do

  1. If remote connectivity is required, enable it only during the time needed for work/updates - and ensure the latest versions of the remote management tools and applications are being used.
  2. Use effective network segmentation, including firewalls - and separate Wi-Fi and security cameras from your POS environment.
  3. Work with your service providers to ensure that your POS environment in configured securely and in compliance with PCI DSS.
  4. Consider security testing, risk assessments and two-factor authentication (in concert with unique credentials, preferably passphrases) to identify weaknesses and ensure stronger access controls.

What You Should Not Do

  1. Do not use your POS for surfing the internet and checking email. (Remember, it is for card transactions and reporting only).
  2. Do not share credentials for logging into a remote solution or any part of the POS.
  3. Do not use your remote access to get to your security cameras.
  4. Do not leave remote access enabled after work is completed. (This leaves an open window for hackers to access your POS).

For best practices in fraud protection, view Sterling Payment Technologies tips on card-present and card-not-present transaction fraud here.

This guest post was written by Sterling Payment Technologies, a Tampa, Fla.-based payment processor.

Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More