IT/Physical Security
-
That button would make for an epic rage-quit.
-
@MattSpeller said:
@thecreativeone91 If they get in could they actually get access to banking stuff? I don't get why you'd be concerned about them accessing your stuff.
Edit: again, just a noob asking questions - genuinely curious.
Banking no, credit card but would be hard. Credit card info (as far as the whole number) is stored in the Data center payment processing systems only until the payment clears and then after that it is removed. only the last four is stored along with the name after that (for returns and such). If you save save your CC in your account online it's stored in a non reversible encryption. Neither we nor you can see the card number more than the last four digits. you can only use it or remove it.
-
@Nic said:
That button would make for an epic rage-quit.
I know right. It's a felony offense to push them already. It does currently allow drawers to be opened without manager approval for employee safety and call the police.
-
@thecreativeone91 If they have physical access to your system, you can never be 100% sure of anything. I know of tools that will allow you to boot a computer from USB or CD or $otherstoragemedia and log in with any username and password you want. It works both with Windows and Linux.
-
I still don't understand wtf they would be doing messing with the registers when they could be taking the cash. If they wanted user data, shit, it's available by the gigabyte on forums for pennies. Usually WITH credit card info. I'd watch the cams carefully and see if they were just idiots trying to get the drawer to eject.
None of this adds up for me.
I think your security setup sounds kick ass.
-
@dafyre said:
@thecreativeone91 If they have physical access to your system, you can never be 100% sure of anything. I know of tools that will allow you to boot a computer from USB or CD or $otherstoragemedia and log in with any username and password you want. It works both with Windows and Linux.
They couldn't boot to another media on these easily. It's blocked. And they don't have CD rom Drives. USB ports are disabled.
-
@MattSpeller said:
I still don't understand wtf they would be doing messing with the registers when they could be taking the cash. If they wanted user data, shit, it's available by the gigabyte on forums for pennies. Usually WITH credit card info. I'd watch the cams carefully and see if they were just idiots trying to get the drawer to eject.
I suppose it's possible. The current system still requires you to hit the "open cash" button even once it's pushed but will do so without a transaction or manager override.
They were also trying to use a USB drive (but couldn't). And also figure out (probally by chance) how to close the Linux GUI and get to terminal. where they typed some random stuff much of which did nothing aside from a few pings.
-
Now we get to explain to them why we don't need the other stuff happing. Management really wants the sites somehow disconnected when the buttons are pushed.
-
you can do that from the central site.
-
@scottalanmiller said:
you can do that from the central site.
Yeah we do currently if we need to, just not automated.
-
It really seems like they are simply throwing money away fighting a nearly non-existent threat. Wiping a router? Really?
When you take security to such a level that it becomes intrusive to getting work done, you are intentionally trying to drive your business under.
-
@JaredBusch said:
When you take security to such a level that it becomes intrusive to getting work done, you are intentionally trying to drive your business under.
Exactly. Who is the bigger thread, the "hackers" who failed of the managers doing tangible damage?
-
@JaredBusch said:
It really seems like they are simply throwing money away fighting a nearly non-existent threat. Wiping a router? Really?
When you take security to such a level that it becomes intrusive to getting work done, you are intentionally trying to drive your business under.
I agree. Though I kinda understand their reasons behind wanting to do it. But it's not like we have on site IT to reload the configs so we'd have to hire an MSP or in some locations we have analog lines with modems for terminal server (as in console terminal, not windows). But seems to be a waste of time to me.
I totally get the drawers being unlocked though, it's saved employees lives on multiple occasions.
-
Just got told they were people that worked as IT techs for some company and were heavily intoxicated when the held up the store. haha. I say worked because I'm sure the jail time if nothing else will cost them their jobs.
-
@thecreativeone91 So they actually got caught? That is awesome!
-
@dafyre said:
@thecreativeone91 So they actually got caught? That is awesome!
Yeah. I figured they would.
-
@thecreativeone91 said:
Just got told they were people that worked as IT techs for some company and were heavily intoxicated when the held up the store. haha. I say worked because I'm sure the jail time if nothing else will cost them their jobs.
Few places want to employ IT people, the ones trusted with the keys to the environment, who are involved with armed robbery
-
@scottalanmiller said:
@thecreativeone91 said:
Just got told they were people that worked as IT techs for some company and were heavily intoxicated when the held up the store. haha. I say worked because I'm sure the jail time if nothing else will cost them their jobs.
Few places want to employ IT people, the ones trusted with the keys to the environment, who are involved with armed robbery
One would hope.. But I know a felon who does maintenance & HVAC at the schools, you know around kids?
-
@thecreativeone91 said:
One would hope.. But I know a felon who does maintenance & HVAC at the schools, you know around kids?
Schools rarely care about kids. Kids are not the customers, they generate no money.
Businesses don't want felons handling their finances.
-
The less technical and more dangerous robbers may end up wanting to kill the clerk because the cash register is locked. It's easier and wiser to give them the little cash you have than to try to fight back, after all that's what insurance is for, and insurance for stolen cash is a lot better than insurance due to a lawsuit from a family with a dead relative. I'm not saying don't make things harder or don't protect things which may be taken from the property, but certainly don't put employee lives at risk to save $50.
