State-of-the-art testing: the first line of defense against fraudsters

Steve Gilde is the director of global product marketing at Paragon Application Systems.

By Steve Gilde

Security remains a significant issue for kiosk operators. Sophisticated hackers and cybercrooks are finding ever more creative ways to compromise these devices, both physically and logically. And as self-service kiosks see broader adoption across the globe, they are proving to be vulnerable to another growing threat: creative consumers.

While providing convenient access to cash, information, payments and other services is one of the key benefits of kiosks, it is also one of their biggest security flaws. These machines often sit unprotected and vulnerable for hours at a time. Also, these devices are readily available for purchase on the secondary market, making it rather easy for crooks to slice up a machine while looking for the best ways to compromise the equipment. To make matters worse, 3D printers can easily replicate component pieces, allowing fraudsters to insert their own skimmers, traps and other electronics. And, if a 3D printer is beyond their reach, the crooks can just buy OEM parts in bulk off of the internet.

The threat can't be overstated

Hackers will continue to search for and exploit any and every vulnerability they can find, whether it is in a kiosk, a network or anywhere else. These threats are not going to go away and they certainly can't be ignored. Not only do these attacks and thefts cause significant financial harm, they can also put sensitive corporate and consumer information at risk, creating the potential to erode trust in our financial systems. With the immediacy of social media and the power of the internet, reports of a single negative interaction can often spread like wildfire, quickly tarnishing a brand and impacting shareholder value. 

There are no silver bullets here. The best protection is to have a comprehensive security strategy that covers the entire kiosk ecosystem, including the site, the machines, the network, the authorization host, the consumer accounts, etc. Kiosk operators must implement locks, lights, cameras, encryption, alarms, transaction monitoring and processing rules and do everything they can to try and keep the crooks at bay. In this case, end-to-end really means just that.

Manual testing isn't sufficient

A rigorous approach to testing and device maintenance is a critical component in this overarching strategy, but it often gets overlooked or put on the back burner in favor of other priority initiatives. Unfortunately, many kiosk operators still rely on manual testing methods which are in some cases supported by technology that is several decades old. This may leave an organization exposed to unnecessary risk.

Because of the time and effort involved in manual testing, these organizations typically test only a fraction of the total transaction set and other operational scenarios, e.g., fault processing. In addition to being slow and expensive, manual testing also introduces the very real possibility of human error into the testing equation. 

Automation and virtualization have arrived

A better, safer and more cost-effective approach is to implement testing solutions that incorporate automation and virtualization. Automated testing will improve delivery time for new products and services while also increasing efficiency, accuracy and overall test coverage. Virtualization helps organizations expand their capabilities far beyond the limitations of a single test lab, allowing resources from across the globe to have 24/7 access to testing facilities. Test tools built on modern web-based architecture can also be easily integrated with other enterprise applications and systems.

As the industry wrestles with the effort to migrate devices to Windows 10, the need for a comprehensive testing strategy and robust tools becomes abundantly clear. Both will be critically important to completing the migration successfully, on time and with no negative impact on the customer experience. 

While a solid testing and maintenance strategy can't prevent all potential hacks or threats, smart operators recognize that a comprehensive security strategy along with a modern approach to testing and robust test tools does provide a solid first line of defense.