Self-Service Kiosks and Payment Terminals: Practical Security Controls for Australian SMEs

Self-service kiosks and payment terminals can improve customer service, but they also connect public-facing devices to business networks, payment processes and personal information. That makes them part of the business security and privacy environment.

Map every connected component

Keep an inventory of each kiosk, EFTPOS terminal, receipt printer, camera, wireless gateway, cloud account and supplier connection. Record where equipment is installed, what it can access, how it is updated and who can support it. Include devices managed by a payment provider or technology contractor.

Separate public devices from core systems

Where practical, keep kiosks and payment equipment on a controlled network separate from office computers, file storage, administration and other critical systems. Disable unused services, restrict management access and avoid shared administrator credentials.

Control remote support

Remote management can speed up maintenance, but it should use named accounts, strong authentication, limited permissions and clear start and finish points for supplier access. Review active vendor accounts after installation, upgrades and support work.

Protect customer information

Check what the kiosk collects, displays, prints, stores or sends to a third party. Minimise information where possible, limit staff access, protect records and explain the process to customers when personal information is required. Check cameras and receipts as well as the main application.

Plan for failure

Document what staff should do if a kiosk, terminal, internet connection or payment provider is unavailable. Keep a safe manual service and payment fallback, supplier contacts and a process for checking that equipment is restored securely after an outage.

Customer-facing technology is useful when it is convenient and dependable. Treating every kiosk and terminal as a managed business system helps reduce privacy, payment and operational risk.

Sources

• business.gov.au: Cyber security for business
• OAIC: Privacy guidance for organisations and government agencies