Point-of-Sale security

Point-of-Sale security
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Networking Firewalls    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Point-of-Sale security Dale I. Green 01-23-2007
Posted by Dale I. Green on January 23, 2007, 12:23 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi.

I've been tasked with setting-up a POS (Point-of-Sale) system for a
small restaurant. The POS will consist of 5 terminals and a server (all
WinXP-Pro), all networked together.

I would like to completely isolate the 5 terminals from the Internet.
Also I would like to allow only very limited Internet access to/from the
server, 1) for credit card authorization and 2) for remote access (e.g.
RAdmin).

I am thinking that one way to accomplish this would be to have a "local"
switch connecting all 5 terminals and the server, thereby securing the
terminals. Then I would install a second NIC in the server and have it
connected to an "Internet facing" switch connected to a router
(connected to a DSL modem). I would then use the router's firewall to
block all traffic to the server except those aforementioned.

A) Would this work? If so, are there any particular features my router
would need, or can they all do this?

B) Is there a better / easier way to accomplish my goal, perhaps without
needing the extra switch and NIC?

Please be gentle, this level of networking is mostly new to me.
Thanks!

Dale

Posted by Volker Birk on January 23, 2007, 5:03 am
If you were  Registered and logged in, you could reply and use other advanced thread options
> I would like to completely isolate the 5 terminals from the Internet.

Pull the plug.

> Also I would like to allow only very limited Internet access to/from the
> server, 1) for credit card authorization and 2) for remote access (e.g.
> RAdmin).

This is an oxymoron now. You will not manage to do what you want. The
best compromize will be: don't route into the net on the server, and
filter anything with the exception of the needed servces on the server.

> I am thinking that one way to accomplish this would be to have a "local"
> switch connecting all 5 terminals and the server, thereby securing the
> terminals. Then I would install a second NIC in the server and have it
> connected to an "Internet facing" switch connected to a router
> (connected to a DSL modem). I would then use the router's firewall to
> block all traffic to the server except those aforementioned.

Yes. Do so.

Yours,
VB.
--
"Pornography is an abstract phenomenon. It cannot exist without a medium
to propagate it, and it has very little (if anything at all) to do with sex."
Tina Lorenz
<https://events.congress.ccc.de/congress/2006/Fahrplan/events/1422.en.html>

Posted by Dale I. Green on January 23, 2007, 6:59 am
If you were  Registered and logged in, you could reply and use other advanced thread options
VB, Thank you for your input. I assume by your comments that you
consider my goals to be naive but that you think my overall approach is
solid. Is that right?

>> Also I would like to allow only very limited Internet access to/from
>> the server, 1) for credit card authorization and 2) for remote access
>> (e.g. RAdmin).
>
> This is an oxymoron now. You will not manage to do what you want. The
> best compromize will be: don't route into the net on the server, and
> filter anything with the exception of the needed servces on the
> server.

What do you mean by "don't route into the net on the server"? Also, by
"filter" do you mean using the hardware router, a software firewall, or
something else?

Kind regards,
Dale

Posted by Leythos on January 23, 2007, 7:22 am
If you were  Registered and logged in, you could reply and use other advanced thread options
dig@notmail.com says...
> VB, Thank you for your input. I assume by your comments that you
> consider my goals to be naive but that you think my overall approach is
> solid. Is that right?
>
> >> Also I would like to allow only very limited Internet access to/from
> >> the server, 1) for credit card authorization and 2) for remote access
> >> (e.g. RAdmin).
> >
> > This is an oxymoron now. You will not manage to do what you want. The
> > best compromize will be: don't route into the net on the server, and
> > filter anything with the exception of the needed servces on the
> > server.
>
> What do you mean by "don't route into the net on the server"? Also, by
> "filter" do you mean using the hardware router, a software firewall, or
> something else?

You need a real firewall appliance and then you setup only the access
that you want to permit - do not confuse a NAT Router as a firewall

With a real firewall appliance you can setup a IPSec client to allow you
to remotely connect to the firewall itself, then from a rule in the
firewall, your authenticated user can remotely admin the server.

You can also allow outbound to the credit card processing facility and
block all other access.

--

spam999free@rrohio.com
remove 999 in order to email me

Posted by Dale I. Green on January 23, 2007, 9:59 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> dig@notmail.com says...
>> VB, Thank you for your input. I assume by your comments that you
>> consider my goals to be naive but that you think my overall approach
>> is solid. Is that right?
>>
>> >> Also I would like to allow only very limited Internet access
>> >> to/from the server, 1) for credit card authorization and 2) for
>> >> remote access (e.g. RAdmin).
>> >
>> > This is an oxymoron now. You will not manage to do what you want.
>> > The best compromize will be: don't route into the net on the
>> > server, and filter anything with the exception of the needed
>> > servces on the server.
>>
>> What do you mean by "don't route into the net on the server"? Also,
>> by "filter" do you mean using the hardware router, a software
>> firewall, or something else?
>
> You need a real firewall appliance and then you setup only the access
> that you want to permit - do not confuse a NAT Router as a firewall
>
> With a real firewall appliance you can setup a IPSec client to allow
> you to remotely connect to the firewall itself, then from a rule in
> the firewall, your authenticated user can remotely admin the server.
>
> You can also allow outbound to the credit card processing facility and
> block all other access.
>

Leythos, Thank you!

Does "IPSec" imply VPN?

Could you suggest a firewall appliance which would be suitable? I
checked newegg and the best rated firewall is the NETGEAR FR114P. Would
this be a good choice?

Finally, would you still recommend using 2 switches, a "local" and an
"Internet facing"?

Thanks again. I appreciate your advice.

Kind regards,
Dale



Similar ThreadsPosted
New site dedicated to security conferences : www.security-briefings.com May 6, 2006, 11:17 am
Security programs 2005 - , Firewall programs 2005 -, Antivirus programs 2005 -, APPDEV DOT NET SECURITY, Linux Security and Firewall programs 2005 -, CiscoWorks ( CW ) Security programs 2005 - , February 25, 2005, 5:03 am
Home Security eBook - Home Security - How to Protect Your Family and Your Property - Home_Security.exe (0/2) November 5, 2004, 5:25 pm
Security June 6, 2005, 11:23 am
BGP Security October 4, 2005, 2:27 am
Network security December 10, 2004, 5:09 am
Security Software May 15, 2005, 3:41 pm
Security Breach June 28, 2005, 7:06 pm
Network Security Job July 8, 2005, 11:26 pm
Possible security problem? July 28, 2005, 12:16 am

The site map in XML format XML site map

Contact Us | Privacy Policy