Restrict Hard Drive

Even with decent software to run a kiosk, there are many possible exploits. To do it right you need to involve quite a few low level restrictions. For some amusing reading on exploiting a kiosk, see: http://defcon.org/images/defcon-1...-craig.pdf
There are ways to mitigate many of the things covered in this pdf.

The biggest risks would be if they could gain access to important things on your network.

Ultimately a good, secure kiosk requires many layers of security:
-Network security, isolating machine on a network level and restricting access to malicious sites
-Physical security, prevent tampering / physical access / booting from alternate devices / installing devices / possibly going as for as a thin client with no hard drive. Use PS/2 mouse/keyboard if possible. Possibly a custom keyboard or mouse without most modifiers / f-keys.
-BIOS security, locked down with good password, boot options restricted, Unneeded I/O disabled
-Kernel level security with a program like Deep Freeze (makes it much harder for any successful exploits to survive a reboot) / Possibly custom keyboard mouse drivers that restrict input
-File system permissions, restrict the ability to read/write from places they shouldn't
-OS level security restrictions to prevent access to things that could compromise the kiosk, use Applocker to only whitelist a very limited set of processes (Also use an alternate shell and explicitly block explorer.exe, cmd.exe, regedit.exe from launching). Don't install Flash, Java, or Silverlight; Disable Active X in all zones. PDF viewers and plugins are another vulnerability vector.
-Browser / Kiosk software that simplifies tasks the kiosk user is expected to perform and prevents them from doing things they shouldn't. In most cases they things this level would strive to block should be blocked by one of the lower levels.

Another consideration is how the machine gets software and os updates, as many of the things you would do to make it a kiosk make this harder (generally some manual effort is required)