I have a problem that I hope is easy for you guys to help me with.
At work we have 4 computers that currently are not connected to the internet, only to a local network for our point of sale system. Our debit machines are connected to the PoS computers by RJ45 to serial cables and the debit terminals are connected through an unmanaged switch to our modem to access the internet. Our debit processing company is forcing us to change terminals and these new ones take ethernet in and send it to the computers to communicate through TCP/IP instead of serial. That will force the PoS computers to have access to the internet. We would rather they didn’t have access to the net. I called our ISP today to see if MAC address filtering was a possibility on our modem and it is not. So I am looking for a simple solution to keep the NIC of each of the computers functional but prevent them from accessing the internet.
Would simply upgrading the switch they are on to a managed one or a router, be all I need to do so I can set up a MAC filter? If so any suggestions on one would be appreciated. Is it even possible for wired connections? If not any help would be greatly appreciated. Thanks in advance!
Yeah I got that. I don’t see the issue though. The previous connection could still be exploited, it’s not like the serial cable stops comms.
I don’t see the issue with the POS terminals having access to the internet. It’s not going to allow inbound connections and the outbound connections will make it much easier to keep them up to date.
Unless I’m missing something here it sounds like they’re trying to make their network unnecessarily complex for no security gain.
you are 100% correct that his systems arent air gapped before and they arent air gapped going forward.
that doesnt mean that there is no point doing anything in the middle.
some people are very paranoid about having financial data on any system that can access the internet. i was treating this as besides the point of the question OP asked and was keeping status quo. it is possible they are running outdated software that cannot have security vulnerabilities patched and that a decision somewhere has been made to keep these devices off of direct internet access.
there is nothing wrong with that.
Absolutely agree. If he’s running POSs with outdated software then keeping it away from the internet is sensible. I think we’re all making assumptions and we need more info on the devices, software, and the other use cases for the network before we can give any concrete advice.