SECURITY IN A POS SYSTEM — WHAT MUST BE PROTECTED AND HOW.
SECURITY IN A POS SYSTEM — WHAT MUST BE PROTECTED AND HOW.
A POS system handles some of the most sensitive data in a business.
Customer personal information. Payment records. Staff details. Revenue figures. Supplier costs and margins.
It also handles the actual flow of money — every sale, every refund, every void.
A poorly secured POS is not just a technical problem. It is a business risk. Data breaches. Financial fraud. Regulatory penalties. Reputational damage.
What a POS must protect
Financial transaction data — every sale, payment, void, and refund must be immutable, audit logged, and access controlled.
Customer personal data — names, phone numbers, purchase history — stored with access limited to staff who need it and compliant with Kenya's Data Protection Act 2019.
Staff credentials — passwords and PINs hashed, never stored in plain text. Session management with automatic logout after inactivity.
Business financial information — revenue, costs, and margins visible only to owner and senior management.
Authentication security
✅ Passwords hashed with bcrypt or Argon2 — never MD5 or SHA1
✅ PINs hashed — not stored as plain numbers
✅ Session timeout after inactivity — shorter for cashiers, longer for managers
✅ Multi-factor authentication for admin and owner access
✅ Failed login attempt limiting — prevent brute force
Application security
✅ SQL injection prevention — parameterised queries always, never concatenate user input into SQL
✅ CSRF protection on all POST, PUT, DELETE requests
✅ XSS prevention — escape all user input before displaying
✅ HTTPS everywhere — no exceptions
✅ Rate limiting on login and payment endpoints
✅ Validate all incoming webhook data including M-Pesa callbacks
Data security
✅ Database not publicly accessible — only from application server
✅ Regular automated backups — encrypted and stored off-site
✅ Card numbers never stored — PCI DSS requirement
✅ Backup restoration tested regularly
Fraud prevention through system design
✅ No cashier can void their own transactions
✅ Discounts above threshold require second approval
✅ Every void, return, and discount creates immutable audit log
✅ Cash drawer opens only on completed transactions
✅ No-sale drawer opens logged and reviewed
✅ Unusual activity alerts — high void rate, high discount rate
Security is not a feature you add at the end.
It is architectural decisions you make from the beginning. Hash passwords from day one. Use parameterised queries from day one. Plan audit logging from day one.
Retrofitting security into an insecure system is expensive and incomplete.
Is your POS protecting your business — or is it a vulnerability waiting to be exploited?
🌐 www.bonniecomputerhub.co.ke
📲 +254 729 820 689
© Bonnie Computer Hub | Empowering Through Technology
