this post was submitted on 19 Jul 2024
175 points (98.3% liked)
Asklemmy
43948 readers
463 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy ๐
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Coffee shop open WiFi on the same network as the main retail central point of sale system server for several stores.
Transport layer security should mean this shouldn't matter. A good POS shouldn't rely on a secure network, the security should already be built in cyptographically at the network session layer. Anything else would still have the same risk vector, just a lower chance of happening.
In fact many POS systems happily just take a 4g/5g sim card because it doesn't matter what network they're on.
Non IT guy here.
Not all attackers might want access to the POS system. Some might just want to mess around
Couldn't someone mess with the WiFi or network itself? I'm just figuring someone who doesn't secure the WiFi is someone who's going to leave admin passwords on the default and they'd be able to mess with the network settings just enough to bring the system to a halt.
A software shouldn't use passwords for tls, just like before you use submit your bank password your network connection to the site has been validated and encrypted by the public key your client is using to talk to the bank server, and the bank private key to decrypt it.
The rest of the hygiene is still up for grabs for sure, IT security is built on layers. Even if one is broken it shouldn't lead to a failure overall. If it does, go add more layers.
To answer about something like a WiFi pineapple: those man in the middle attacks are thwarted by TLS. The moment an invalid certificate is offered, since the man in the middle should and can not know the private key (something that isn't used as whimsically as a password, and is validated by a trusted root authority).
If an attacker has a private key, your systems already have failed. You should immediately revoke it. You publish your revokation. Invalidating it. But even that would be egregious. You've already let someone into the vault, they already have the crown jewels. The POS system doesn't even need to be accessed.
So no matter what, the WiFi is irrelevant in a setup.
Being suspicious because of it though, I could understand. It's not a smoking gun, but you'd maybe look deeper out if suspicion.
Note I'm not security operations, I'm solutions and systems administrations. A Sec Ops would probably agree more with you than I do.
I consider things from a Swiss cheese model, and rely on 4+ layers of protection against most understood threat vendors. A failure of any one is minor non-compliance in my mind, a deep priority 3. Into the queue, but there's no rush. And given a public WiFi is basically the same as a compromised WiFi, or a 5g carrier network, a POS solution should be built with strengths to handle that by default. And then security layered on top (mfa, conditional access policies, PKI/TLS, Mdm, endpoint health policies, TPM and validation++++)
Never trust the network in any circumstance. If you start from that basis then life becomes easier.
Google has a good approach to this: https://cloud.google.com/beyondcorp
EDIT:
I'd like to add a tangential rant about companies still using shit like IP AllowLists and VPNs. They're just implementing eggshell security.
Iโm like 99% sure that goes against PCI compliance, they could get slapped pretty hard with some fines or lose the ability to take cards at all.
https://www.forbes.com/advisor/business/what-is-pci-compliance/