A franchisee owned over 100 restaurants and shared files between locations using a server at their corporate office, which had an insecure VPN connection set up by their third-party IT company. This allowed a hacker to crack the weak password and access the file server connected to all restaurant POS systems, enabling the download of malware to steal customer payment card data from over 100 locations. The security risks could have been prevented by requiring two-factor authentication for remote access and unique, complex passwords for each restaurant's systems.

1. Auditing Archives Series
The Case of the File-Sharing
Franchisee

2. Business background
Successful franchisee
owns over 100
well-known restaurants
in the Midwest.

3. Business background
Shared files with restaurant
management across states
via a server at the corporate
location.

4. Business background
Used a third party IT company
to configure system hardware
and software for all restaurant
locations.

5. How hackers could get in
The corporate back office server
that shared files across restaurant
servers used an always-on,
insecure, virtual private network
(VPN) connection.
IT staff configured the corporate
office remote access insecurely,
which provided access to the ‘flat’
internal network structure.

6. What is remote access?
Remote access is the ability to
access a computer or server
from a remote location. It is
often used in mid-large
organizations among
employees who need access to
shared files and company
networks.
Unfortunately, it’s very common
for remote access to be set up
insecurely.

7. How hackers could get in
A hacker could break into the
insecure remote access at
corporate headquarters by
cracking an easily-guessable
password, and find the file server
connected to 100+ other
restaurants via the always-on
VPN connection.

8. How hackers could get in
Once in the file server he could
guess the in-store POS system
password.
One by one, he could download
malware into each restaurant’s
POS system and gain sensitive
payment card data.

9. What the business did wrong
Third party IT group
configured all
restaurant systems
identically and with
an easily guessable
password.

10. What makes a good password?
A password should not be found
in a dictionary in any language. It
should contain at least 8 upper
and lower case letters, numbers,
and special characters.
Passwords should be changed
every 90 days.

11. What they should have done
This problem could have been prevented through more
secure remote access at the corporate location.
Specifically, requiring two-factor authentication for each login
(e.g., a password and a one time code) and individual
complex system passwords for each restaurant location.

12. SecurityMetrics
We Protect Business
Services
PCI, HIPAA, & data
security solutions for
businesses of all sizes
Qualifications
Global provider of
ASV, QSA, PFI, PA
QSA, P2PE services
Experience
Assisted over 1 million
organizations with
compliance needs