A machine with telemetry and a card reader is a networked device. Like any such device, it needs basic security hygiene.
A connected machine should run up-to-date software, have protected access to its management system, and – if it uses the building's network – be properly separated from it. The reader supplier and payment provider are primarily responsible for payment security; the machine operator handles the rest of the system.
Good practices
- Strong passwords and limited access to the management panel.
- Regular software updates.
- A separate network for devices if the machine uses the building's Wi-Fi.
- Changing default access settings.
Who is responsible for what
It is worth spelling out responsibilities in the agreement between the site and the operator, especially when the machine uses the site's network.
A modem instead of the site network
A cellular modem keeps the machine off the building network. Device information is on the page with vending machines (publisher's site).
FAQ
Can a machine threaten the company network? Any networked device needs protection. Separating the machine reduces risk.
Is card data stored in the machine? Card data is handled by the reader and payment provider under payment industry standards.