Confused about kiosk security: am I being overly cautious?

Question

At the company I work at, they have a physical kiosk open to the public where customers can use it to upload their files to and have them processed. Customers can connect their phones, tablets, and USB drives to it and take their files off of it to put into the kiosk software. They also enter in their name, phone number, address, and other personal information into the kiosk. The kiosk software belongs to another company, and so their IT staff "remotted in" (screen shared) to the computer to install the kiosk software on a brand new installation of Windows 7.

However, I'm worried about the kiosk security. Firstly, it is connected to our internal network, even though it only just needs internet access. The kiosk runs in administrator mode, and has no password. However, the kiosk also has three anti-virus software applications installed on it, and sometimes a small message from one of the anti-virus programs appears over top the kiosk application.

I'm the "IT Guy" so I'm responsible for keeping things secure. We store financial data and customer data on company computers so I would probably be responsible for any leakage. I don't want to spend extraneous time on things that already meet a standard of security. However, I think it's extremely insecure, but I don't want to make unnecessary changes to the system.

For example, I tried to install anti-virus on an extremely ancient but very important Windows XP system on SP2 (I found out the firewall was disabled, windows defender disabled, running as administrator with no password, no updates since before 2013!) attached directly to the internet and internal network for years and years previously but got a blue screen (manager was not too happy about that.) I was able to get a ton of Windows updates installed however. In this case, I may have gone overboard with the security, and I don't want to break my already shaky trust with my manager as they appear to be very sceptical about my security suggestions as they just see blue screens and possible loss of software stability. All of the software on the Windows XP computers is 100% irreplaceable as it's 15+ years old and we don't have any way of reinstalling the software, which makes me very worried.

Is this set up common for kiosks? How secure should it be, and what steps can I take to make it more secure?

Answer 1

So you are the IT guy responsible for keeping things secure. But you are not the guy who can decide to stop the kiosk application if it is not secure enough. My opinion if that you should setup a split in the responsabilities here. As the kiosk software belongs to another company and was installed by their IT staff, you should not try to change anything on that machine without their explicit consent.

But you are responsible for warning your company, and first your manager for the security risks involved, explaining that it violates many best practice rules and can be harmful for the company. The best you can (and should IMHO) do is evaluate the threats, by describing possible attacks using that machine and the possible consequences:

• image of the company if the kiosk was to publish malicious content
• loss of internal data if the kiosk was used to attack the internal network (think in term on Confidentiality, Integrity, Availability here)

Then (and only then) you should worry for possible mitigations of the risk:

• ask the kiosk editor to provide an application not using an admin account (cost/gain/risks(*)) - do not do that yourself without an explicit requirement/consent from your manager
• use an external firewall to isolate that machine, so that even if it was compromised the attacker could not get access to the internal network (here again cost/gain/risks)
• other possible actions (you know the actual environment, I do not, but Anthony's post describes some of them), and their cost/gain/risks

IMHO, your own responsability stops there. The decision to setup the mitigation ways belong to the company management. The responsability of applying the decided actions will be yours again, once they will be decided.

---

cost/gain/risk is the way to speak to a manager:

• cost: hardware of software to buy, work hours
• gain: protection against a threat - the harder part, speak of possible consequences of the attacks
• risks: additional delays/costs for parts that you cannot be sure, or have never done

Answer 2

How secure should it be

Given customer input their personal data into the kiosk owned by your company, it is critical that the kiosk be hardened to be as secure as possible.

What steps can I take to make it more secure?

1. Do not run the kiosk in Administrator mode unless such elevated privileges are critical to its functionality

The kiosk software currently runs in Administrator mode, which is ill-advised. Normally, systems should be run with the minimum set of privileges needed to perform its function, a concept known in IT security as Least Privilege. In this way, if an attacker were to compromise the machine, it would mitigate somewhat what he / she can do.

2. Implement a means to segregate the kiosk machine from your internal company network

You mention that the kiosk only needs Internet access. It is advised that you segregate this kiosk through a demilitarized zone (DMZ) and implement ACL rules through a firewall to prevent direct connections to your internal network. Any connections from the public facing Internet is by nature untrusted

3. Implement means to securely transmit customer data from when it is inputted into the kiosk to the destination where it will be processed.

Given the kiosk is Internet facing, if a secure method of data transmission is not used such as TLS 1.2+, sensitive customer information can be easily sniffed off the wire by attakers on the Internet.

4. Implement means to authenticate the user who remote logins to the kiosk.

You mention that the kiosk software is owned by a third party. Without a reliable means of authentication, you cannot trust that the individual connecting to is who he / she says they are. There should be means such as RADIUS or TACACS+ that centrally authenticates remote users. Only when their identity has being verified by the system should they be granted access.

5. Implement means to securely store customers information and mask information entered by the customer on screen.

Given customers enter their personal data into the kiosk, it is important that sensitive data such as SSN be masked when displayed on the screen. You did not describe the physical environment where the kiosk is located, but there could be a significant risk of leakage of customer data through shoulder - surfing. You would also want to verify that sensitive data is securely stored by the kiosk, ideally in encrypted and or hashed format, depending on whether access to the input data is important. Use a strong encryption or hashing algorithm such as AES with a long key length to maximize protection.

Answer 3

Frankly this is a lost cause. You should not be trying to focus your efforts on fixing something which is badly broken, which is (in effect) owned by someone else and which you're not going to be thanked for even if you did fix the problem.

Your responsibility is to make your employers aware of the risk and ensure that the only network access allowed by this machine is the remote access by the software company with both ingress and egress filtering, and that all network activity is monitored and packets other than those relating to the software company / DNS requests are producing alerts. That means putting it on its own physical LAN with a firewall which you control isolating it from the rest of the world.

Answer 4

Most of the points I would like to state are already mentioned by Anthony

1 But for further hardening of the security system. I would suggest you that you should encrypt the data at rest and the data in move so that even if there is a leak, no plain text data is revealed.

2. Configure the Anti-virus with auto-scanning of all the devices that are inserted into the system and turn on Auto update for both AV and the base Win 7 system.

3. Putting a firewall at the Kiosk end will also be help full so that only useful data is returned back to the kiosk and no mallicious files go in or out of the kiosk.

4 Moreover, check what kind of services and ports are opened on the Win 7 system because if non-operational ports or services are switched on, then this can increase the attack surface. Only Switch on those ports and services that are reguarly used.

Answer 5

I think many good answers and tips are given here, including remarks about not messing with the kiosk machine.

I have one tip that might make things easier to handle. For this tip I make one assumption, that no data is stored on it, at least no longer than until the end of the day.

There are applications that can reset the machine to a given state. I've used one of those apps to reset a Windows XP machine on a daily basis. So you could start it up, do whatever you liked, and the next day it's reset to the previous state. All virus infections are wiped by this action.

Installing updates should be handled by the application somehow, so if Windows updates are installed by you or the owners, a new image should be created that is loaded from that day on.

This doesn't prevent infection from the computer to your network, but it protects clients from getting their USB-sticks and documents infected, and in the case of a clear infection, the solution is simple.