Introduction

You prepare your kiosk for harsh conditions, vandals, and intentional mischief, but have you thought about needed security for unintentional mishaps? Not all kiosk application failures are due to deliberate tomfoolery.

It may be caused by a child unable to see the screen but able to reach the keyboard, or a user inadvertently entering a key combination, or even a power outage. Some attacks are deliberate and within the control of the end-user while some incidents are accidental. Whatever the situation may be, the kiosk will no longer be able to serve its purpose.

The need for application protection is critical, but unfortunately it is usually an afterthought. Kiosk system software makes certain that your application is always running and secured, ensuring your ROI is truly reflective of application success rather than an application failure due to malfunctioning software or misuse. Specifically, kiosk system software secures the application by preventing users from ever reaching the Operating System (OS), desktop and browser. This prohibits users from changing systems settings, overwriting files stored locally on the kiosk, and surfing the Internet.

Break it Down for Me: How does Kiosk Software Work?

There are two types of kiosk software: application software and system software. The application software is designed specifically to interact with users and complete the function of the kiosk, while the system software protects the kiosk application from users. From what users can see, the kiosk application is constantly running and all other features are inaccessible. This is due to the kiosk system software wrapping around the kiosk application, blocking access to any other features available to kiosk managers. The system software will also loop through images or ads to attract users to the kiosk. When a user approaches the kiosk, they touch the screen, mouse or keyboard to start the application. Depending on how the kiosk system software is configured, the screen will either display the home page or more information on the particular ad that was playing when they approached the kiosk. After the user interacts with the application and leaves the kiosk, the system software will reset the application, clearing the users history, and beginning the attract screen loop to allow the cycle to start again.

On the deployer’s side, kiosk system software can produce usage statistics and survey data, which is sent to a central server for analysis. Kiosk system software also allows management of multiple kiosks from the central server, specifically remote monitoring and content updating. When deployers need to exit out of the kiosk application, the system software will allow them to do so typically through a mouse sequence or key combination followed by a password.

Kiosk System Software Features

How does kiosk system software restrict this access? Kiosk-specific features enable security that allows your application to remain unattended and function flawlessly. The most important protection features of kiosk software allow keyboard filtering, onscreen virtual keyboards, attract screens with session end handling, file download blocking and the integration of external security devices.

Keyboard Filtering: For applications that have a keyboard available to the user, it is critical to disable certain specialty keys and key combinations. The keys could open a new window, dialog box, menu, or allow users to escape the application altogether. This allows access to the OS where users can easily navigate to anywhere on the kiosk. Specific keys and key combinations that should be blocked are:

• CTRL+ALT+DEL – allows access to the task manager
• F1, F2, F3…F12 – can open a new window and can be customized to load windows that are not appropriate to the kiosks function
• Pause – a user could hit this and walk away from the kiosk, leaving an inappropriate screen on the kiosk • Esc - can allow the user to escape the entire application
• Windows – opens the start menu
• CTRL+P, CTRL+N, etc. – opens the print dialog, opens a new window
• ALT+F4 – exits the application
• Menu – opens a pull down menu of the application

 Virtual Keyboard : The virtual key board, which works with touch screen hardware, reduces hardware vulnerability by eliminating the need for a physical keyboard and mouse. The keyboard is kiosk-specific, meaning certain keys are not programmed into the virtual keyboard.

Attract Screens/Session End Features: Attract screens essentially replace the Windows screen saver, which would allow access to the OS, by rotating through images, ads or URLs instead. This feature can also be used to end a user’s session, by logging a user off after a certain period of idle time and beginning the attract screen loop. The previous user’s history, including the cookies, cache and print queue are then cleared. Clearing the previous user’s history is imperative in making both the previous and potential user feel safe, securing their personal information from the next user and any passerby.

File Download Blocking: Kiosk system software can prevent dialog boxes from being shown and ultimately prevent file downloading altogether. It is important to block dialog boxes from being shown; eventually a user could navigate to a Microsoft help link allowing access to browser windows and function-critical C: drive files.

External Device Support: Kiosk system software also supports the integration of external devices for added security. Session end devices, such as retractable printers, retract printed materials immediately back into the kiosk at the end of a session. Security devices, such as security mats or proximity switches, sense whether users are standing at the kiosk, and will reset the application and clear the previous users’ history as soon as the user steps away.

Application Software vs. System Software

So why is it necessary to use separate kiosk system software when it can be programmed into your application? Your application should constantly be changing. With new technology and kiosk user feedback, there will always be room for application improvement. Using separate kiosk system software will allow you to easily make these changes. Kiosk system software uses the application file path or URL in the configuration, so changes made to the application are automatically updated on the kiosk.

Why not run IE in Kiosk Mode?

The problem with using IE in kiosk mode is that many kiosk-specific security features are lacking. Many of the key combinations listed earlier will still allow users to open a new window or close the kiosk window. This again allows access to the entire machine, where users can overwrite files critical to the function of the kiosk. Additionally, IE in kiosk mode does not clear the history of the previous user, which is especially important when the user is entering or accessing any personal information. Lastly, IE in kiosk mode does not return to the start page after the session end and does not rotate through attract screens. Less of security concern and more of kiosk usage concern, the start page and attract screens show users how to use the kiosk and explain its purpose. After all, what is the point of security concerns if the kiosk is not attracting users?

Conclusion

If the kiosk is not secured, whether the attack is malicious or unintentional, costs will be incurred. The kiosk may be inoperable, users may feel unsafe using a kiosk where they notice their information is not secured, or sensitive information may be stolen from the kiosk. Protecting your kiosk application with kiosk system software protects potential victims, your application, and your bottom line.

Want more? Here are some related posts:
Kiosk Software Questions
The Three Main Components of a Self-Service Project
Kiosk Software: What is it and why do I need it?
Creating a Successful Self-Service Kiosk Project
What is "Kiosk mode"?
Why Using Your Browser in Kiosk Mode Isn’t Enough