Should card terminals be on a separate network from office PCs?
Yes. Card terminals and tills should sit on their own network segment, with only the connections they need allowed, so that an infected office PC cannot reach them. Separation limits the damage of one compromised computer and is also how the card payment standard (PCI DSS) lets a business reduce the part of its network that falls under its requirements. In practice, use a separate VLAN or a separate router port for the payment devices, block traffic from the office network to that segment, and allow only the connections to the payment provider. Ask your payment provider and installer how they recommend doing it. Then verify that the separation holds, because configurations drift over time.
Read next
Related questions
- How can we check that office computers cannot reach our tills?
- What happens if an office PC infected with malware can reach the shop tills?
- Is a consumer router a security risk for a small office?
- What should we do with old devices nobody uses any more?
- What security questions will big customers ask a small supplier?