<div dir="ltr"><a href="http://in.pcmag.com/microsoft-windows-vista/103124/feature/top-8-security-vulnerabilities-threatening-your-sm">http://in.pcmag.com/microsoft-windows-vista/103124/feature/top-8-security-vulnerabilities-threatening-your-sm</a><font size="2"><br></font><br>In December of 2013, Target
acknowledged that a hacker gained access to more than 70 million of its
customer credit and debit card numbers via the company's <a class="" href="http://in.pcmag.com/cloud-services/99482/guide/the-best-point-of-sale-pos-software-of-2016">point-of-sale</a> (<a href="http://www.pcmag.com/encyclopedia/term/49444/point-of-sale">POS</a>) system. One of the biggest data breaches in US history, the <a href="http://in.pcmag.com/news/67832/target-hack-may-have-hit-40-million-credit-debit-c">Target hack</a> cost the company's CEO and CIO their jobs.<div id="id_text" itemprop="articleBody">
<p>Unfortunately for everyone involved, the hack could have been avoided
if only Target executives had implemented the auto-eradication feature
within its FireEye <a class="" href="http://in.pcmag.com/cloud-services/96509/guide/the-best-saas-endpoint-protection-software-of-2016">anti-malware</a> system. The <a class="" href="https://www.fireeye.com/index.html" target="_blank">FireEye</a> tool caught the <a href="http://www.pcmag.com/encyclopedia/term/46552/malware">malware</a> code in November of that year and could have deleted it from Target's network before any of the data was pilfered.</p>
<p>Although it's still unclear how the hacker infected Target's network
with the malware, there are many ways to exploit a company's POS system.
For small to midsize businesses (SMBs), the threats are even greater
and more abundant than they are for larger enterprises. This is because
most SMBs don't have the resources to create the necessary security
restrictions to keep hackers at bay (or to take a hit if hackers do
infiltrate their systems). In this article, we'll examine the top eight
POS security vulnerabilities that are threatening SMBs today. We'll tell
you not only what to look out for but how to stay safe.</p>
<p><strong>1. Vendors Managing Encyption Keys With No Hardware Security Module</strong><br> Here's the issue at hand: If your company stores <a href="http://www.pcmag.com/encyclopedia/term/42594/encryption">encryption</a>
information in the same location where it stores user data, you're
putting all of your eggs in one fragile basket. However, if you
physically keep encryption key data separate from user data, a hacker
who gains access to the user data won't have access to the encryption
information.</p>
<p>A hardware security module is a physical device that stores your
encryption data. You can attach this device directly onto your computers
or servers to access the POS data once it's been uploaded to your
network. It's another step in your data offloading, but it's not as
difficult as explaining to your company's legal counsel why your
customer data is in someone else's hands.</p>
<p><strong>2. Business Networks With Unsegmented POS Data</strong><br>
If your business is using your corporate network to send system and
security updates to POS data environments and devices, you're putting
your business at serious risk. In this scenario, if a hacker gains
access to your network, he or she has also gained access to all of your
POS data.</p>
<p>Companies with deep pockets and IT experts on-hand separate these two
networks and create small pathways from the business network to the POS
data environment in order to make system changes. This is the Fort Knox
version of POS security. However, it is incredibly difficult and
expensive to configure. So, smaller organizations often settle for
enabling <a href="http://www.pcmag.com/encyclopedia/term/57825/multifactor-authentication">multifactor authentication</a>
(MFA) from the business network to the POS device. This isn't a dream
security scenario but it's the most secure option available for modest
companies.</p>
<p>Another important note here: Coffee shops and restaurants that offer <a href="http://www.pcmag.com/encyclopedia/term/54444/wi-fi">Wi-Fi</a>
to customers should make sure that their POS devices aren't hooked up
to the same network. Once a hacker sits down, sips his or her latte, and
accesses your Wi-Fi, he or she can then find a way into your POS data
environment.</p>
<p><strong>3. Running on Old Operating Systems</strong><br>Not everyone wants to update to <a class="" href="http://in.pcmag.com/windows-10/94627/review/microsoft-windows-10">Microsoft Windows 10</a>.
I get it. Fine, but if you're still running an old version of Windows,
you're asking for trouble. Microsoft ended support for Windows XP in
2009, for <a class="" href="http://in.pcmag.com/microsoft-windows-vista/10173/review/microsoft-windows-vista">Microsoft Windows Vista</a> in 2012, and for <a class="" href="http://in.pcmag.com/microsoft-windows-7/18494/review/microsoft-windows-7">Microsoft Windows 7</a> in 2015—and it will end support for <a class="" href="http://www.pcmag.com/article2/0,2817,2392889,00.asp">Microsoft Windows 8</a> in
2018. If you've asked Microsoft for extended support, you'll be safe
for at least five years after the termination of mainstream support. If
you haven't extended your support or if extended support has lapsed (as
it has with Windows XP), it's important to note that Microsoft will no
longer add security patches to fix issues that arise within the <a href="http://www.pcmag.com/encyclopedia/term/48618/os">operating system</a> (OS). So, if hackers find an entry point into the software, you're POS data will be exposed.</p>
<p><strong></strong></p><div align="center"><strong></strong></div>
<p><strong>4. Default Manufacturer Passwords</strong><br> Even if you're
a numbers wizard who can memorize the intricate passwords provided by
your POS device manufacturer, it's incredibly important that you change
the password once you've hooked the device up to your software. That's
because hackers have been known to pull lists of these passwords from
the manufacturers' networks and trace them back to your devices. So,
even if you took every precaution possible to secure your data, you're
still leaving the door unlocked to hackers.</p>
<p><strong>5. Fraudulent Devices</strong><br> Make sure you partner with
a company with a solid reputation. Otherwise, you may wind up buying a
fraudulent POS system, which is essentially game over for your company
and your customer data. By directly gaining access to your customer's
credit card, these crooks can pull data without you or your customer
knowing anything went wrong. These machines simply tell the customer
that the transaction can't be finalized, leaving the customer to believe
there is a problem with his or her credit card or that there's a
problem with your back-end system. In fact, the machine is simply
pulling in the customer's data without anyone being the wiser.</p>
<p><strong></strong></p><div align="center"><strong></strong></div>
<p><strong>6. Malware via <a href="http://www.pcmag.com/encyclopedia/term/49176/phishing">Phishing</a></strong><br>
It's important that you alert your employees not to open suspicious
emails. Hackers embed links in email that, if clicked, give them access
to your employee's computer. Once the hacker has taken control of the
machine, he or she can navigate throughout the network and your servers
to gain access to any data. If you're lucky enough to not store your POS
data in the same network environment, you're still not in the clear as
hackers can remotely access a POS device that's connected to the
hijacked computer.</p>
<p><strong>7. RAM Scraping</strong><br> This is an old-fashioned attack that still has a bit of bite. <a class="" href="http://www.investopedia.com/terms/r/ram-scraping-attack.asp" target="_blank">RAM scraping</a>
is a technique by which attackers rip credit card data from the POS
device's memory before it gets encrypted on your network. As I mentioned
before, keeping your POS systems isolated from your business network
should limit these types of attacks (given that hackers have fewer entry
points to POS devices than they do to your corporate network). However,
you should also tighten your company firewalls to ensure that POS
systems are only communicating with known devices. This will limit the
ways in which hackers can access the data on your POS devices by forcing
them to hijack computers or servers within your network to scrape the
RAM.</p>
<p><strong>8. Skimming</strong><br> This is an easy one to ignore as it
requires on-the-ground security to ensure no one sketchy handles your
POS devices. Essentially, <a href="http://www.pcmag.com/encyclopedia/term/64587/skimming">skimming</a>
requires hackers to install hardware onto the POS device, which will
then allow them to scan credit card information. This can also be done
via malware if you haven't followed some of the steps I mentioned
earlier. If you run multiple branches, it's crucial that you monitor how
your POS devices are being used and by whom.</p></div></div>