Is Your POS System Safe?: 5 Critical Questions for your POS Vendor
While very skilled at installing systems, point-of-sale (POS) vendors often don't understand security basics and likely won't make your security their main priority. Obviously, this can lead to very poor organizational security. After all, your POS system harbors some of the most valuable information at your organization: customer credit card data. Before hiring someone to set up your POS environment, there are five key questions you should ask. These questions are designed to help you weed out ignorant vendors that don't have your security best interests at heart.
- Can I set my own user name and password? If a vendor provides POS credentials and won't let you change them, that's a serious red flag. It likely means they're using those same credentials at every other client's business too, also known as "universal credentials." Setting up universal credentials simplifies a POS installer's job: no need to rack his brain for each client's password when performing routine system maintenance (see point #2). He only needs to memorize one password! Unfortunately, this insecure practice leaves your business in danger. An installer really concerned about your security should allow you to choose your own password, and encourage you to follow industry best practices (e.g., your password must be a minimum of 8 characters long, have at least 4 special characters, and 2 numbers).
- How often do you conduct routine maintenance? A POS vendor's job isn't just to install software/hardware and disappear from your life forever. The vendor should be constantly maintaining those systems by installing updates on both applicable operating systems and POS software. One great question to ask is, "Are all critical security patches installed within one month of release?" I understand that keeping your system patched with the latest and greatest security isn't always fun, but it will help protect you from a data breach and is absolutely worth the time it takes to ensure your vendor is staying on top of it.
- Do you use unique remote access credentials for each POS system? If your POS vendor uses the same credentials to access your store as they use for others, their breach might soon become your breach. An attacker who discovers a vendor's remote access password now has ready-made credentials to get into any other system using the same credentials--including yours. Ensure your vendor uses unique credentials to access your environment.
You should also ask how long your vendor needs the remote access connection to your systems. It is not uncommon for a vendor to gain access remotely and then never disconnect. This is a very poor security practice and should be prohibited. Keep your vendor's access to a minimum and monitor it regularly.
- Do you maintain our anti-virus? An anti-virus program keeps an eye on your system. It's pretty independent, but when it finds a problem it requires human direction. It will ask if you want to delete the problem, ignore it, or quarantine it. Until someone tells the anti-virus program what to do with that problem, it will just sit back and wait, which isn't doing anybody any good. That's why regular scanning maintenance is so important.
Your POS vendor may or may not maintain your anti-virus scanning, but this question isn't a make-or-break deal. It's just important to know the responsible party. If your vendor is not handling your anti-virus, make sure you have an up-to-date version, that it's scanning regularly, and that you have someone designated to address what it finds.
- Do you set up the POS system as an application on my back-office computer? Many POS vendors dump POS system software onto the back-office computer. What's the problem with that? Well, in addition to storing sensitive POS information, you use that computer to order uniforms, track payroll, browse Facebook, and email staff. As we know, the Internet is full of malicious links, software, and downloads ready to compromise your business. If you accidentally click on one of those malicious links, be prepared to kiss your customer credit cards goodbye.
A good POS vendor recognizes the importance of segmenting your POS environment. That means not allowing POS software to reside on a system that can browse the Internet. The best solution is to set up two computers in your back office. On one, you conduct all your business (ordering uniforms, etc.). The other is only for your POS, properly segmented from the other back-office server by a firewall.
Just remember: your security matters. Choose a POS installer with the same security-minded attitude and you'll be light years ahead of most of your peers... not to mention keeping your data safe from hackers.
Share this Feature
Comments:comments powered by Disqus
- Multi-Unit Franchising
- Get Started in Franchising
- Open New Units