Store Firewalls
IT systems in the internal LAN of the store are only allowed to be connected to the Internet by using sufficient security mechanisms. Such mechanisms are called "Firewalls".
A firewall controls the network connections between the company network and the Internet and blocks all connections that are not explicitly declared as "allowed". Firewalls are available in various models and at different prices, ranging from broadband routers with an integrated packet filter firewall to high-performance firewall appliances with different protection zones. They differ greatly regarding performance and protective effect:
- Devices with packet filter firewalls are very simple firewalls that provide only a limited amount of protection with a low flexibility. These firewalls are mainly intended for the protection of private PCs and are unsuitable for use in a store network.
- Multi-functional firewalls, often called security appliances, offer several services in addition to the firewall functionality. They are typically used to provide secure access for remote administration. Some of these devices can search for viruses in the network traffic or even repel spam emails. In the case of usual requirements, they are suitable for small or medium-sized stores.
- Complex firewall systems are used when it is necessary to secure important company applications – e.g. publicly accessible web and database servers – when a large number of users access high-performance Internet connections or when the highest possible failure safety should be achieved by a double firewall design.
Each firewall must be installed and configured correctly, in order to effectively provide protection. Furthermore, it must be continually administered. The following basic rules must be fulfilled:
- Each communication between the store network and Internet must always be carried out via the firewall. It is not allowed to bypass the firewall via modem, WLAN or mobile Internet connections.
- Regular security-related updates of the firewall software are necessary to prevent a weak point in the firewall jeopardizing the whole store network.
- The firewall configuration and administration requires a secure connection. Internet attackers must not be able to change or read out the firewall configuration. The access must also be limited to authorized persons of the store network.
- The firewall configuration must be documented. This document must be updated after each modification. The reason, time and the name of the executing employee must be noted in the event of configuration changes.
- A correctly configured firewall only allows connections that are absolutely necessary and actually used. All other connections are blocked.
Store Firewall Setting Recommendations
The store firewall must deny access to all unnecessary ports on Store PC and POS systems. Closing as many communication ports as possible minimizes the number of possible attacker points on store systems. These restrictions increase the security of store systems.
Here is the list of ports and services in the store that should not be accessible from the Internet or WAN:
| TCP Port to Deny Access | Host | Application | Service | Explanation |
|---|---|---|---|---|
| 8090 | Store PC | Infoserver | HTTP software download | Restrict the access to this port for POS stations only inside of the store network. This port should not be accessible from the Internet or WAN. |
| 18016 | Store PC | Infoserver | JMX monitoring | Restrict the access to this port from localhost only. This port should not be accessible from the Internet or WAN. |
| 8008 | Store PC | RVM | JMX monitoring | Restrict the access to this port from the local store network only. This port should not be accessible from the Internet or WAN. |
| 3050 | Store PC | Firebird | Database server | Restrict the access to this port from localhost only. This port should not be accessible from the Internet or WAN. |
| 18017 | POS | Infoclient | JMX monitoring | Restrict the access to this port from localhost only. This port should not be accessible from the Internet or WAN. |
| 3333 4333 |
POS | OmniPOS | JMX monitoring | Restrict the access to this port from the local store network only. This port should not be accessible from the Internet or WAN. |
| 1527 | POS | Derby DB | POS database | Restrict the access to this port from localhost only. This port should not be accessible from the Internet or WAN. |
Some ports may differ in the target installation on the customer system because port numbers are configurable in the software. Port numbers mentioned in this table refer to the default product setting. The host setup could also differ in the target customer installation, for example, if Master POS installation takes place. It is possible to allow temporary access from the central system to local store or POS databases for support cases. The allowed access should be limited to the minimum support time necessary in this case.