--- title: "Be AWARE: Restricting Unauthorized Access" description: Restricting Unauthorized Access. As a small merchant, you can’t afford to “absorb” losses like a large corporation so it’s crucial to make sure you’re limiting opportunities for thieves to get into your system, by locking down who has access to your computers and data. image: https://blog.pcisecuritystandards.org/hubfs/step04.png --- [< Return to Blog Home](https://blog.pcisecuritystandards.org) [Print](https://blog.pcisecuritystandards.org/be-aware-restricting-unauthorized-access#) # [Be AWARE: Restricting Unauthorized Access](https://blog.pcisecuritystandards.org/be-aware-restricting-unauthorized-access) Posted by [Laura K. Gray](https://blog.pcisecuritystandards.org/author/laura-k-gray) on 17 Dec, 2015 in [Small Business](https://blog.pcisecuritystandards.org/topic/small-business) and [Holidays](https://blog.pcisecuritystandards.org/topic/holidays) and [Apps](https://blog.pcisecuritystandards.org/topic/apps) and [QIR](https://blog.pcisecuritystandards.org/topic/qir) and [Remote Access](https://blog.pcisecuritystandards.org/topic/remote-access) ![step04.png](https://blog.pcisecuritystandards.org/hs-fs/hubfs/step04.png?width=800&name=step04.png "step04.png") [mailto:?subject=Check%20out%20this%20article&body=https://blog.pcisecuritystandards.org/be-aware-restricting-unauthorized-access](mailto:?subject=Check%20out%20this%20article&body=https://blog.pcisecuritystandards.org/be-aware-restricting-unauthorized-access) *Our 12 Days of Tips series explores how small retailers can **ACT** now to repel data thieves during this prime shopping season.  **A**wareness, **C**hecking security controls and **T**esting security now will help your business lock down your systems during the holiday rush.* * **Merchants looking for more information on how to secure customer payment data should visit the    *[*PCI SSC merchant site*](https://www.pcisecuritystandards.org/merchants/)*.* **Restricting Unauthorized Access** As a small merchant, you can’t afford to “absorb” losses like a large corporation so it’s crucial to make sure you’re limiting opportunities for thieves to get into your system, by locking down who has access to your computers and data. With temporary staff coming in and out, and an increased number of transactions happening, controlling that access becomes even more important during the busy holiday shopping season. For example, after a card is used at the point-of-sale, a protected system will not print the entire card account number on the receipt. Usually it’s a subset of the last four digits. Same is true for what’s displayed on the point-of-sale monitor. You protect your customers’ data and your business by controlling access.  Protection is all about access control – setting up your system to grant access only on a “business need-to-know.” As the owner, you have access to everything. But most employees can do their job with access only to a subset of data and applications. Some should have no access at all. In addition to limiting employee access, you also need to protect your business against unauthorized access by vendors and partners. Weak passwords or weak “remote access” security contributed to 94% of point-of-sale breaches in 2014. Merchants are often not aware that remote access is left persistently running – that is, the ability for outside vendors to have access to their system whenever they want. Or the possibility that this remote access could be exploited by an attacker.   Remote access should only be enabled if and when it needs to be used. Here are three simple steps for preventing unauthorized access: 1.** Limit access**. Grant access privileges based on what’s required to do a job – and no more. Insist with your POS reseller that remote access is only turned on when it’s necessary, and when it is turned on that the service and tools used are safe– up to date, configured correctly and security best practices are applied. 2. **Use strong, unshared passwords**. Assign every person a unique ID so the system can track their activity. Require use of strong, unique passwords. Do not allow sharing of user IDs or passwords! 3. **Restrict physical access.** Use locks to control physical access to data, systems or hardcopies. Be sure customers have no access to your systems! If you need help, consult the person who installed your network and point-of-sale system.  Resources that can help you:  - [List](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_integrators_and_resellers) of trusted and PCI vetted technology partners (Qualified Integrators and Resellers) that are educated in secure installation of point-of-sale devices.  - [Infographic: Stay Smart on Protecting Against Card Fraud ](https://www.pcisecuritystandards.org/pdfs/PCI-Top-Ten.pdf) - [Infographic: It’s Time to Change Your Password ](https://www.pcisecuritystandards.org/pdfs/its_time_to_change_your_password_infographic.pdf) Merchants looking for more information on payment security essentials should start here: [![Payment Security Essentials for Merchants](https://no-cache.hubspot.com/cta/default/281302/07b993b4-2ba8-4a34-8bf5-afbb43bca162.png)](https://cta-redirect.hubspot.com/cta/redirect/281302/07b993b4-2ba8-4a34-8bf5-afbb43bca162)   ### LIKE WHAT YOU READ? Subscribe to the PCI Perspectives blog to receive insights, information and practical resources to help your organization protect payment data. [Subscribe Here](https://training.pcisecuritystandards.org/subscribe-to-pci-perspectives-blog) ![Laura K. Gray](https://blog.pcisecuritystandards.org/hubfs/Headshots/laura-gray.jpg) [ Laura K. Gray ](https://blog.pcisecuritystandards.org/author/laura-k-gray) [Twitter ](https://www.twitter.com/pcissc) [Email](mailto:blog@pcisecuritystandards.org) [Website](http://www.pcisecuritystandards.org) The PCI Security Standards Council (PCI SSC) is a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments worldwide. [< Return to Blog Home](https://blog.pcisecuritystandards.org) [Print](https://blog.pcisecuritystandards.org/be-aware-restricting-unauthorized-access#)