1

Now that Windows XP will stop being supported by Microsoft, it has become common knowledge that it should be abandoned for a modern operating system in most cases.

However, I have the corner case where I am using Windows XP to run a point of sales system (POS). If I am not going to perform any tasks other than using this POS program and it is behind a firewall that won't let the POS accept incoming connections, is there still a significant risk of the machine being exploited remotely? The article that I linked to seems to have stated that most vulnerabilities are exploited these days by going after web browsers and the like.

4

There's two areas of risk that you'll need to look at for this.

  • First, the security risk. If you have a firewall blocking all inbound connections and the appliance only runs "trusted" code which you validate before loading on to it, and doesn't run anything (like a web browser) that would allow the user to introduce new untrusted code onto the system, then in most circumstances you're probably not at serious risk with this appliance.

  • Second, is compliance/regulatory risk. If this is a PoS system does it process card holder data? If so then you need to worry about PCI compliance and unfortunately compliance doesn't tend to always go purely on risk. You should ask your QSA about XP and whether it's possible to have a PCI compliance XP system (my non-QSA guess is that it's not as it's an unpatchable unsupported system...)

  • To add my grain of salt: that POS is probably somewhat connected to a server of some kind to be able to process payments. While I do not know of any attacks on the network stack itself, that doesn’t mean there are none and will never be; additionally, POS software that only supports windows XP may be unmaintained for a while and coming from a time that may allow MITM attacks on that connection (either because there is no authentication or the ancient TLS version that is used is no longer considered secure). So I wouldn’t go straight for negligible risk. – Tobi Nary Nov 25 '17 at 7:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.