01
Why POS Systems Are a Primary Target
Point of Sale systems process payment card data and cash transactions — making them a high-value target for cybercriminals. POS malware has stolen payment data from hundreds of thousands of businesses globally, often operating undetected for months.
The vulnerability isn't primarily in the POS software itself. It's in how POS systems are networked, maintained, and secured — or more commonly, not secured — alongside the rest of the business IT environment.
The most common POS breach vector: POS terminal on the same network as office computers and internet access, with no segmentation. A phishing email opened on an office workstation gives attackers access to the payment network.
02
POS Network Architecture
Network segmentation — the most critical control
✓POS terminals must be on a completely separate network segment from office computers and guest Wi-Fi
✓Dedicated VLAN for POS — firewall rules prevent any communication between POS VLAN and office VLAN
✓POS systems should only communicate with: the payment processor, software update servers, and management systems — nothing else
✓No internet browsing from POS terminals — deny all outbound except required destinations
✓Guest Wi-Fi completely isolated — no access to POS or office network
If a customer can see your guest Wi-Fi network and your POS system is on the same physical switch, you have a network segmentation problem. Guest traffic must be completely isolated — physically or via VLAN with enforced firewall rules.
Operating system
✓POS terminals running Windows must be on a supported OS — Windows 10 (now EOL) or Windows 11
✓End-of-life OS on POS terminals cannot receive security patches — must be replaced or isolated to a fully air-gapped network
✓Disable all unnecessary services — Windows Remote Desktop, SMB file sharing, Bluetooth where not required
✓Auto-run disabled — no USB autoplay
Endpoint protection
✓Antivirus or EDR deployed on all POS terminals — Microsoft Defender for Business or equivalent
✓Defender Application Control — allowlist only approved applications. POS terminal should only run POS software, nothing else
✓Block USB storage devices — prevent malware introduction via USB, and prevent card data exfiltration
✓Screen lock with strong PIN — POS terminals lock after inactivity
Patch management
✓POS software updates applied promptly — critical updates within 7 days
✓OS patches applied on monthly cadence — test in staging first
✓Patching window during non-trading hours — minimise trading disruption
Staff access to POS
✓Unique login credentials per staff member — no shared POS login
✓Role-based access — sales staff cannot access management functions, refunds, or reporting
✓Manager override requires manager credentials — not a shared override code
✓Automatic session timeout — return to login screen after inactivity
Remote access
✓POS vendor remote access — restrict to on-demand only, disabled when not in active support session
✓Log all remote access sessions — who connected, from where, what duration
✓Never allow persistent remote access from POS vendor — disable after each session
✓De4sec remote management — via dedicated management VLAN, separate from POS VLAN, MFA required
Physical security
✓POS terminal mounting — secured to counter, tamper-evident seal
✓Payment terminal (EFTPOS) — checked daily for skimming device attachment
✓Back-of-house systems — physically secured, not accessible to customers or non-IT staff
05
PCI DSS Compliance Overview
If your POS system processes payment cards (EFTPOS, credit card), Payment Card Industry Data Security Standard (PCI DSS) applies to your business. PCI DSS v4.0 is the current version.
| PCI DSS Requirement | Practical meaning |
|---|
| 1: Install and maintain network security controls | Firewall between POS and other networks — segmentation |
| 2: Apply secure configurations | No default passwords on POS systems, only required services enabled |
| 3: Protect stored account data | Do not store full card numbers — POS system should only store tokens |
| 5: Protect all systems against malware | AV/EDR on all in-scope systems |
| 6: Develop and maintain secure systems | Patch POS software and OS promptly |
| 7: Restrict access to cardholder data | Least privilege — only staff who need access have access |
| 8: Identify users and authenticate access | Unique user IDs, strong passwords or PINs, MFA for remote access |
| 10: Log and monitor all access | Audit logs for all access to cardholder data environment |
| 12: Support information security with policies | Documented security policy, incident response plan |
De4sec assists businesses in Kenya and Australia with PCI DSS scoping, gap assessment, and control implementation.
06
De4sec POS Security Service
POS Deployment
Hardware supply and installation, network design and VLAN configuration, POS software setup and testing. Kenya and Australia.
Security Hardening
OS hardening, endpoint protection deployment, application control configuration, access control setup.
Network Architecture
Firewall configuration, POS VLAN design, traffic policy implementation, guest Wi-Fi isolation.
Ongoing Support
Remote monitoring, patch management, security incident response, PCI DSS compliance support.
