McAfee:  POS Security That Pays Its Own Way

Version 4


    A McAfee White Paper

    Retailers are experiencing runaway spending on securing and managing their POS systems, in large part because organized criminals around the world have discovered that point-of-sale (POS) systems are low-risk, high-reward targets that are often poorly defended. Internet-facing POS systems, physically exposed ATMs, automated gas pumps, and other self-serve terminals have repeatedly exposed hundreds or thousands of victims to relatively simple sting operations. Criminals are increasingly targeting smaller organizations with fewer IT resources where POS systems are often poorly configured and inadequately defended. Widespread vulnerabilities include default passwords and remote access software installed to allow off-site management by third-party service providers. Automated port scans are used to identify POS systems with remote access support followed by automated password cracking and automated spyware installation to capture and export payment card information. Compromised payment accounts have resulted in staggering losses for retailers and payment processors.


    Taken together, the dual challenges of POS security, management, and PCI compliance are a giant headache for retailers—and a perfect opportunity for POS vendors. Those that can integrate security controls into their product offerings that demonstrably reduce their vulnerability to compromise, decrease the costs of management, and streamline regulatory compliance will gain a significant competitive advantage in the marketplace.

    From the retailer’s perspective, an airtight business case for such controls can be made solely on the basis of lower system management and support costs, provided that the control set in question is a small-footprint solution that effectively locks down the POS system to prevent intrusion or unauthorized change without imposing significant overhead on the system itself, the network, or the IT staff.

    This description fits McAfee® Integrity Control, an application-independent security solution that provides lifetime deploy-and-forget protection for retail POS systems, kiosks, ATMs, and other embedded systems. This tightly integrated bundle of McAfee Application Control, McAfee Change Control, and McAfee® ePolicy Orchestrator® (McAfee ePO) software turns a potentially vulnerable system built on commercial operating systems (OS) software into an impenetrable black box. Intruders and malicious application code see only an apparently closed system built on a proprietary operating system.

    Adding McAfee Integrity Control to your POS solution simply makes your offering more appealing to your retailer customers. It not only secures their POS infrastructure and data, it significantly reduces POS management and compliance costs, pays for the entire incremental cost in just under 16 months, and continues to add bottom line value throughout the entire system lifecycle.


    Read the attached white paper (.pdf link below) for a technical description of the solution plus a complete cost and ROI analysis. 


    For more information visit