Point-of-Sale (POS) System Security Review

B.

Of the given options, the IS auditor should be most concerned about option C, which is the storage of Credit card verification value (CVV) information on local POS systems.

Explanation:

A point-of-sale (POS) system is an electronic system used to process financial transactions, such as credit card payments. POS systems are vulnerable to various security threats, including data theft, hacking, and fraud, which can result in financial loss, reputation damage, and legal liability.

Option A suggests that the management of POS systems is outsourced to a vendor based in another country. While outsourcing can introduce some security risks, it is not necessarily a significant concern if the vendor has adequate security measures in place and if the outsourcing agreement includes appropriate security and privacy clauses. Therefore, option A is not the greatest concern for the IS auditor.

Option B suggests that POS systems are not integrated with accounting applications for data transfer. While integration can improve efficiency and accuracy, it is not necessarily a security concern, as long as the data transfer is secured and controlled. Therefore, option B is not the greatest concern for the IS auditor.

Option D suggests that an optical scanner is not used to read barcodes for generating sales invoices. While an optical scanner can improve the accuracy and speed of transaction processing, its absence is not a significant security concern, as long as the alternative method used is reliable and secure. Therefore, option D is not the greatest concern for the IS auditor.

Option C suggests that Credit card verification value (CVV) information is stored on local POS systems. CVV information is a three- or four-digit code printed on credit cards that is used as an additional security measure to prevent fraud. Storing CVV information on local POS systems is a violation of the Payment Card Industry Data Security Standard (PCI DSS), which requires that CVV information not be stored after authorization. Storing CVV information on local POS systems increases the risk of data theft and fraud, as it provides an additional target for attackers. Therefore, option C is the greatest concern for the IS auditor.

In summary, while all the options listed have security implications for a POS system, storing CVV information on local POS systems is the greatest concern for the IS auditor conducting a security review of a point-of-sale (POS) system.