14

In many "big box" stores like Walmart, Home Depot, etc. I see many store computers just sitting empty. A black hat could install a payload on one of these computers, and potentially wreak havoc on the company. Why do stores have these out in the open, when they seem so insecure?

  • 1
    With Macs, you can also reboot them, then hold the "special" key combo to open the recovery system, then wipe them with Disk Utility. – Cole Johnson Jan 2 '15 at 4:29
12

This is a great question and one that these organizations have probably put varying amount of thought into. I can think of a few different scenarios regarding systems being out in the open like that. I'll outline them and my thoughts.

  1. It's the most expedient thing to do - Placing these computers where they are is efficient for their business processes. They didn't consider security in any way, shape or form.
  2. These systems are basically considered terminals These systems may be somewhat locked down. They may replace explorer.exe with some home-grown app or just run a few programs on the system with a limited desktop profile. This is a little better but still not where it needs to be. There are plenty of ways to compromise a system when you are physically at it.
  3. They have good network segmentation - These systems have little or no ability to access the rest of the network. They are logically or physically separate from other systems, and have little or no ability to access the internet.
  4. They have a complete workstation Security Program - They have network segmentation, but additionally they've really considered this as an attack vector. These workstations are hardened, locked-down, have full disk encryption, resident agents to detect malware, and they are limited in their ability to access the rest of the network or the internet. This is more work but of course improves the security posture of your network significantly and greatly reduces the risk of exposing these systems physically.
  • Option 3 (or 4) is a must for PCI compliance, isn't it? – Iszi Jan 7 '15 at 21:25
  • If I were concerned with PCI, I would personally always have those things. However, it's possible for written policy and implementation to diverge. As with most things, the diligence of a specific auditor can vary. I've seen environments that were certified to be PCI compliant which were breached due to their failure to actually adhere to the standards set forth. – theterribletrivium Jan 7 '15 at 22:48
6

You're making a lot of assumptions in your question.

Without knowing where and how those systems connect into their corporate network you don't have enough information to assess the risk.

One possibility is that those systems are connected directly into their inventory and order systems and if you had access to one of those computers you could access or modify all kinds of data.

The second possibility is those terminals are all isolated on a special network that only has access to some well-designs, well-built, well-reviewed APIs that provide back low-sensitivity information like inventory counts and product details.

The first option sounds terrible. The second doesn't sound so bad. The reality is that staffers in those stores need to be able to provide support and information to customers. By placing those terminals around the store you empower the employees and benefit the customer. If you can do it without increasing the risk (too much) to your sensitive data and systems then it's the smart business move.

Alternatively, lets say you place those terminals in a "secure" room in the back of the store past a few "Employee only" signs and a door with a badge reader. Here's the fallout:

  1. They aren't that much more secure. A motivated attacker will walk past the signs and "borrow" a security badge.
  2. It will take much longer for an employee to provide information to customers, losing you sales and customer satisfaction.
  3. You're still vulnerable to insider attacks and you have a large number of insiders. A big-box chain is going to have 40+ employees per store times 200 stores across the country on shift at any one time. Do you really think you can filter out any "black hat" that creates a fake ID and a fake resume and tries to get hired?

I think your question and your assumptions focus on the wrong problem. Assume someone will try to mis-use the terminals and go from there. What mitigations do you want to have in place to account for that?

  • 1
    Some big box chains are holding food drives for their own employees (businessinsider.com/walmart-employee-food-drive-2014-11). Individuals will tend to place their family's food security above their employer's data security - assuming they actually have access to anything worth selling. – emory Jan 1 '15 at 23:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.