Sample Security Audit — The Copper Fork Restaurant

1 · Executive Summary

The Copper Fork's core mistake is also the most common restaurant finding in the industry: the guest Wi-Fi, the POS terminals, the security cameras, and the back-office payroll PC all live on one flat network — the ISP router out of the box. A guest with a phone can see the POS terminals. Card data per se never touches the restaurant's systems (Toast terminals, E2E encrypted — good vendor choice), so the classic card-breach path is narrow; what is wide open is operational sabotage and payroll fraud: with one open guest SSID a nuisance actor can take the POS offline on a Friday night, and the payroll app's weak shared PIN already let a (departed) employee alter a tip record in a consented review. Cameras use the manufacturer default password — the dining-room feed is publicly reachable.

2 · Assets & Crown Jewels

Asset	Data held	Impact if lost/public
Toast POS (3 terminals + kitchen display)	Transactional uptime; card flow (E2E to Toast)	HIGH POS outage on Fri/Sat = direct revenue loss; card-skimming surface narrow
Back-office PC (payroll, invoices, QuickBooks)	Employee PII, bank details, vendor payments	HIGH payroll-diversion fraud, bank detail theft
Security camera NVR (8 cameras)	Live + recorded dining/kitchen/office footage	HIGH publicly viewable interior feed (found live during audit)
Reservation platform (OpenTable) + waitlist	Guest names, phones, emails (≈9,400 guests)	MEDIUM vendor-managed; phishing-target list
Guest Wi-Fi	—	MEDIUM as attack platform into everything above

3 · Findings & Severity

#	Finding	Detail	Severity
F1	Cameras reachable from the public internet with default password	NVR port-forwarded by "the installer." The dining-room feed was viewable during the audit from outside credentials: admin/admin	CRITICAL
F2	Flat network: guest Wi-Fi sees POS + back-office	From a bar seat, the POS terminals and office PC respond to pings and expose service banners over guest Wi-Fi.	HIGH
F3	Back-office PC: no auto-lock, one shared login, Win 10 Home	Anyone near that desk (delivery drivers included) can browse payroll; Home edition lacks device encryption and central policy.	HIGH
F4	Payroll/scheduling apps use shared 4-digit PIN + no MFA on owner account	Departed-employee tip alteration found in logs (consented review) — the PIN survived two terminations unchanged.	HIGH
F5	No guest-network bandwidth/clients isolation	Client-to-client traffic allowed; a guest's infected phone could laterally touch other guests' devices — liability optics.	MEDIUM
F6	ISP router firmware 3 years stale; WPS enabled	WPS PIN attack is a parking-lot compromise of the single gateway everything hangs off.	MEDIUM
F7	No off-site copy of the office PC	Menus/templates are in Toast (safe); QuickBooks + HR files exist only on that C: drive.	MEDIUM
F8	POS staff PINs shared per-shift	Industry-normal but kills line-item accountability for comps/voids — a shrinkage investigation blocker.	LOW

4 · Threat Model — most probable attack paths

T1 · Payroll diversion / insider fraud

F3+F4: shared desk PC + shared PINs + no MFA on bank-linked payroll app. The departed-employee tip edit already happened once at dollar scale.

T2 · Guest-seat network mischief

F2: from a bar seat: kick POS terminals or the reservation tablet offline at 7:40 PM on a Friday; or intercept another guest's traffic (F5) — petty vandalism with direct revenue consequences.

T3 · Public camera feed

F1 is live now: the office (where the tip drawer lives) is streamed to anyone who finds the forwarded port. A break-in planner's perfect scouting tool.

Attack narrative · T1 mapped to MITRE ATT&CK

TA0042 Resource Development / knowledge — any recent ex-employee already knows credentials (F4 PIN unchanged)
TA0001 Initial Access — valid accounts (T1078) via unchanged shared PIN to the scheduling/payroll app
TA0005 Defense Evasion — edits to own historical tip/comp records at quiet hours; audit attribution impossible per F8
Impact — direct theft at low weekly volume + eroded ability to prove it. Detectable only because logs happened to be exported in this audit.

5 · Risk Matrix (likelihood × impact)

Impact →

LowModerateHighSevereExistential Likely

T1F3·F4

Possible

F6·F7

T2F2

T3F1

Unlikely

Rare

Overall 5.8/10 — materially lower than the other samples because Toast's E2E architecture keeps raw card data off the restaurant's gear (PCI burden effectively scoped to SAQ P2PE). The residual heavy weights are operational: insider fraud and uptime sabotage, plus a camera system already being misused by design.

6 · Remediation Roadmap

Day 1 — Cameras off the public internet ≈ $120 labor

Port-forward removed; default credentials burned; viewing via vendor secure relay or VPN only. Confirmed dead with an external scan.

Week 1 — Three proper networks ≈ $680 hardware + labor

POS network (Toast only) · Staff/office network · Guest network with client isolation and bandwidth shaping. Friday-night sabotage loses its chair.

Week 1 — Office PC discipline ≈ $140 Win Pro upgrade

Windows 10 Pro + device encryption, per-user logins, 1-minute auto-lock, no admin rights for daily use.

Week 2 — Payroll hardening + PIN per-person policy $0–$6/mo

Owner MFA on payroll/banking; individual staff PINs; departed-access removal becomes part of the day-one termination checklist (written card provided). Historical-tip review handed to ownership.

Week 2 — Router lifecycle included above

Business-class gateway replaces the ISP box; WPS off; firmware on auto-update; console creds in the owner's password manager only.

Week 3 — Office backups + quarterly access review $8/mo + calendar item

QuickBooks + HR folder to an immutable cloud backup; a 15-minute quarterly "who still has access" ritual the GM runs.

7 · Residual Risk Statement

After Phase 1: projected 2.6/10 (LOW). Remaining exposures: staff-PIN policy drift (countered by the termination checklist), and Toast/OpenTable vendor risk (transfer of trust — both have strong published security postures; monitor-only from here). Physical card-present flow was out of scope of exploitable findings thanks to P2PE terminals. Re-score in 6 months.