At the company I work at, they have a physical kiosk open to the public where customers can use it to upload their files to and have them processed. Customers can connect their phones, tablets, and USB drives to it and take their files off of it to put into the kiosk software. They also enter in their name, phone number, address, and other personal information into the kiosk. The kiosk software belongs to another company, and so their IT staff "remotted in" (screen shared) to the computer to install the kiosk software on a brand new installation of Windows 7.
However, I'm worried about the kiosk security. Firstly, it is connected to our internal network, even though it only just needs internet access. The kiosk runs in administrator mode, and has no password. However, the kiosk also has three anti-virus software applications installed on it, and sometimes a small message from one of the anti-virus programs appears over top the kiosk application.
I'm the "IT Guy" so I'm responsible for keeping things secure. We store financial data and customer data on company computers so I would probably be responsible for any leakage. I don't want to spend extraneous time on things that already meet a standard of security. However, I think it's extremely insecure, but I don't want to make unnecessary changes to the system.
For example, I tried to install anti-virus on an extremely ancient but very important Windows XP system on SP2 (I found out the firewall was disabled, windows defender disabled, running as administrator with no password, no updates since before 2013!) attached directly to the internet and internal network for years and years previously but got a blue screen (manager was not too happy about that.) I was able to get a ton of Windows updates installed however. In this case, I may have gone overboard with the security, and I don't want to break my already shaky trust with my manager as they appear to be very sceptical about my security suggestions as they just see blue screens and possible loss of software stability. All of the software on the Windows XP computers is 100% irreplaceable as it's 15+ years old and we don't have any way of reinstalling the software, which makes me very worried.
Is this set up common for kiosks? How secure should it be, and what steps can I take to make it more secure?