Broadband Wifi PDQ Machines Security Issues

[NeilOx]

I have been trying to get an answer from our Card processor but having no luck without agreeing to spend a fee first with them!. Does anybody know if there are any security issues with using a stand alone PDQ machine which connects via wifi and transmits over our broadband. So theoretically the PDQ is part of our small office network. My question is if there was ever any weakness in our firewalls / router settings could the PDQ be hacked and cardholder data be at risk? As far as I can tell the PDQ is not visible on the network and surely the data it sends is encrypted at source isn't it?

Any advice would be much appreciated

 

[Payments Guy]

Hi

As long as the actual terminal is a fairly recent PCI-DSS compliant one, any data floating around would be highly encrypted anyway.

 

[NeilOx]

Hi, It is about two years old, they are saying that our network is not compliant but the PDQ is the only card processing point, so am scrathing my head as to what to do.

 

[LMDServicesUK]

Hi Neil

Simple answer is NO,

PCI DSS does not currently allow for cardholder data to be transmitted over Wi-Fi from a physical terminal terminal Bluetooth or desktop.

These terminals are designed to be used with hard wired Ethernet or PSTN dial up connections only.

There are discussions ongoing currently but Wi-Fi from a physical desktop terminal is a no go at this time as far as I am aware.

I am also not aware of any mainstream manufacturers (Ingenico, Verifone, Spire etc) who have released a terminal that has such a capability in the UK currently.

If you want to use your BB service you will need to provide a hard wired Ethernet path through your network from the terminal to your router ( via a switch if required).

Re your your provider saying you are not Compliant have they provided you details e.g. a Scan report re your network environment ?

Hope this helps, and please PM if you need any assistance..

Mark