1
10 steps
Kiosk systems run locked-down applications in public or semi-public spaces. A breakout - whether through a help dialog, keyboard shortcut, or peripheral device - can expose the underlying operating system, sensitive data, and adjacent network resources. These steps help you build and harden kiosk applications that stay securely contained.
Run the kiosk application as a shell replacement or in kiosk mode so that exiting the app returns directly to it. Disable Alt+F4, Ctrl+Alt+Del, and other system-level keyboard shortcuts at the OS or application level.
Disable file pickers, save dialogs, print dialogs, and help viewers that can be abused to browse the filesystem. If file operations are required, sandbox them to an application-specific directory with no access to system paths.
For browser-based kiosks, launch in full-screen kiosk mode with navigation bars, context menus, developer tools, and address bars disabled. Use a whitelist of allowed domains. Disable protocol handlers (file://, about://) that can leak local resources.
Disable USB mass storage, Bluetooth pairing, and NFC interfaces that are not required for kiosk operation. Physically seal or epoxy unused ports. Use OS-level policies to restrict which device classes can connect.
Automatically terminate and reset the kiosk session after a configurable idle period. Clear all cached credentials, form data, and session cookies on logout or timeout. Return the kiosk to a clean, default state for the next user.
Run the kiosk application under a dedicated low-privilege user account. Use AppLocker or software restriction policies to allow only the kiosk application and its required dependencies to execute. Remove unnecessary system utilities and shells.
Place kiosks on an isolated network segment with outbound-only access to required backend services. Block all inbound connections to the kiosk. Use a VPN or TLS tunnel for backend communication and disable unnecessary network services on the device.
Deploy file integrity monitoring on the kiosk filesystem to detect unauthorized modifications. Use hardware-level tamper detection where available. Configure the kiosk to alert or shut down when tampering is detected.
Conduct regular breakout testing using keyboard shortcut fuzzing, UI boundary testing, peripheral insertion, and network-based attack simulation. Document and close every discovered escape path before deployment.
Enroll kiosks in an MDM or management platform that uses mutual TLS and signed configuration profiles. Disable unused remote desktop, SSH, and VNC services, restrict management traffic to a dedicated network, and log every remote session for audit.