How Businesses Can Prevent Point-of-Sale Attacks

Retailers, hotels and restaurants have all been victimized through the same Achilles' heel that cyber-criminals continue to attack: the point-of-sale system, where customers' payment data is routinely processed.  

These digital cash registers are often the target of malware designed to steal credit card numbers in the thousands or even millions. This year, US fast-food vendor Wendy's, clothing retailer Eddie Bauer and Kimpton Hotels have all reported data breaches stemming from such attacks.

Security experts, however, are encouraging a variety of approaches to keep businesses secure from point-of-sale-related intrusions. Here are a few to consider:

Monitoring

Point-of-sale malware can strike in a number of ways. Often, it can involve hackers spreading malicious code by breaching the remote access services designed to maintain the payment processing systems, said John Christly, CISO of Netsurion, a security provider.

These remote access services can be poorly configured with guessable passwords, enabling the hackers to break in and distribute the malware to hundreds or thousands of point-of-sale machines. It also doesn't help that the malware can be tricky to detect, Christly added. Sometimes, it can sneak past antivirus programs, and then stealthily extract payment data, despite the presence of traditional firewalls.

"Then it can send out the stolen data slowly, making it look like normal traffic," Christly said. "A few months will go by, and who knows how many credit cards will have been breached."

Businesses that provide remote access to their point of sale system can consider installing two-factor authentication, to avoid relying only on password logins, Christly said. But to ensure better detection of all possible threats, he advocates that businesses go beyond basic antivirus and firewalls and use tools that can monitor for any unusual activity on the actual point-of-sale machines.

"You have to watch every computer to make sure nothing has changed," Christly said. "Whether that computer is active during the night and communicating data, or if the files are being changed."

These tools have been generally marketed to big brand retailers, but Netsurion said it's been offering them at a low cost to small and medium-size businesses.

Encryption

Although hackers continue to develop ever-craftier point-of-sale malware, the most resilient malicious coding becomes useless if all it steals is encrypted data, said George Rice, a senior director of payments at Hewlett Packard Enterprise Security.

Typically, point-of-sale malware works by reading payment data the moment the card is swiped through the retail checkout machine. It does this by scraping the RAM memory of the point-of-sale terminal, where the payment data can be unencrypted.

"The malware techniques are evolving all the time," Rice said. Criminals also understand that retailers are continually updating their point-of-sale machines for pricing or inventory reasons. "So they (the hackers) are using a variety of vulnerabilities to insert the malware into the system," he added.

However, businesses are far less vulnerable to any data breach if they move to end-to-end encryption, according to Rice. That means encrypting the customer's data throughout the entire payment process, including the moment the credit card is swiped.

"This technique can help close any loopholes and vulnerabilities within the system," Rice said.

Earlier this year, HPE Securty announced a partnership with Ingenico, a maker of payment checkout devices, on an end-to-end encryption product for businesses.

To better protect payment data, Hewlett Packard Enterprise Security also provides tokenization, a process of replacing the processed payment card data with digital placeholders, known as tokens. Both this and encryption can be used in combination to reduce the risk of data theft, Rice said.

Testing

Unfortunately, when businesses select the point-of-sale system they want to buy, they rarely think of security, said Charles Henderson, the head of X-Force Red, a security testing team at IBM.

"Most companies assume when they buy a point-of-sale system, they're buying something secure," Henderson said. Buyers also tend to conflate security with a product's compliance to industry standards, but that's not always true, he added.

Henderson's team routinely tests point-of-sale systems to look for vulnerabilities. Often, his team finds them when the business assumed its system was secure because of its industry compliance.

In addition, many of these point-of-sale products are installed by third-party resellers that may not specialize in security. These factors can put businesses at risk, he said.

To prevent this problem, Henderson advises that businesses hire a security specialist to test that their point-of-sale system for any vulnerabilities. Most mainstream point-of-sale system products can be secured with the right implementation, he added.

That testing also goes for security products. Although encryption and other malware-fighting tools can prevent data breaches in point-of-sale systems, they're practically useless if they aren't properly installed, Henderson said.

"They're not bullet proof. The devil is in the implementation," he said.

Computerworld

 

 

« Cisco says It Will Make The IoT Safe
Overconfident: US Will Win A Cyber War With China »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

MarQuest

MarQuest

MarQuest provides services and systems to enhance network reliability and security.

Softtek

Softtek

Softtek helps its clients to gain a competitive edge by implementing digital solutions that propel their business strategies.

Center for Strategic Cyberspace & International Studies (CSCIS)

Center for Strategic Cyberspace & International Studies (CSCIS)

CSCIS seeks to advance global cyberspace security and prosperity by providing strategic insights for cyberspace and policy solutions to decision makers.

Accredia

Accredia

Accredia is the national accreditation body for Italy. The directory of members provides details of organisations offering certification services for ISO 27001.

Cyber Threat Alliance

Cyber Threat Alliance

CTA is working to improve cybersecurity of our digital ecosystem by enabling near real-time cyber threat information sharing among companies and organizations in the cybersecurity field.

Liquid Technology

Liquid Technology

Liquid Technology provide DOD- and NIST-compliant data destruction and EPA-compliant e-waste disposal and recycling services throughout North America, Europe and Asia.

ACET Solutions

ACET Solutions

ACET Solutions delivers a wide range of Automation, Cyber Security and Enterprise IT/OT Integration Solutions to industrial clients.

MagiQ Technologies

MagiQ Technologies

MagiQ produced the world’s first commercial quantum cryptography product that delivered advanced, future-proof network security.

Cirosec

Cirosec

Cirosec is a specialized company with a focus on information security. We carry out pentests & audits and advise our customers in the German-speaking countries on information and IT security issues.

Open Data Security (ODS)

Open Data Security (ODS)

Open Data Security is a market leader in the information security sector, offering services to companies, governments and individuals, helping them shield from hackers and cyber attacks.

Execweb

Execweb

Execweb are a cybersecurity executive network, comprised of 400+ security practitioners who work at Fortune 500 and SME companies.

Infinavate

Infinavate

Infinavate Fort CyberVault offers end-to-end services that comprehensively responds to the organization’s information security and privacy needs.

Zeron

Zeron

Zeron build bridges between security teams and top management. Our platform unifies your cyber risk posture seamlessly, encompassing threat insights and quantifiable risk scenarios.

Safe Data Storage

Safe Data Storage

Safe Data Storage offer a fully managed, professional, secure UK-based online backup service to businesses, education and charities.

Vault Cloud

Vault Cloud

Vault Cloud, Australia's National Cloud, is an Australian owned and operated company specialising in secure, sovereign, hyperscale cloud infrastructure.

CyberGrape

CyberGrape

CyberGrape is a client centric managed services company, providing enterprise leading security solutions and helping companies through their IT risk and security challenges.