What the assessment covers
The tests a device has to survive before it is put on a street corner with money in it.
Device hardening review
Operating system build, kiosk lockdown, USB and peripheral controls, patch state and local privilege boundaries.
Boot and protection bypass
Attempts to escape kiosk mode, boot alternative media, disable protection software and reach the underlying system.
Dispenser and peripheral attacks
Unauthorised dispense commands, peripheral communication tampering and physical interface abuse attempted end to end.
Card reader attacks
Skimming and shimming feasibility, card data handling in memory and on disk, and EMV implementation weaknesses.
Network path testing
What the device can reach and what can reach it, including segmentation, exposed services and management access.
Host connection and transaction logic
Manipulation of messages between device and host, authorisation bypass attempts and transaction integrity checks.
Encryption and key management
Cryptographic implementation, key injection, storage and rotation examined against the standard rather than the brochure.
POS terminal testing
Terminal hardening, communications, tamper response and integration with the payment application.
Switch and card management review
Payment switch, card management system and host configuration assessed for the paths that reach them.
From a device on a test bench to a remediation plan for the fleet
One device model is assessed properly, then the findings are applied across every unit of that build.
Assessment
A defined engagement per device build: physical, logical and transaction testing, with a fleet remediation plan and retest.
Ongoing assurance
Reassessment on each build change or vendor update, so a hardened fleet does not quietly drift back.
Related work
Penetration testing
The network the devices sit on deserves the same scrutiny as the devices themselves.
Source code review
Payment application logic is best examined where it is written, not only where it runs.
PCI DSS and PCI-S3
Findings map directly to the requirements your acquirer and card schemes assess you against.