Tech Talk

Recent posts

With the news cycle laser-focused on the looming threat of a COVID-19 second wave happening in nearly every territory, it is up to each and every hotel to ensure we are all fully compliant with virus safety guidelines in order to restore group booking confidence. And the only way to ensure compliance with these safety guidelines is through contactless and compliance technologies to give guests a strong guarantee of proper sanitization as well as peace of mind.

A great deal has been written over the years about the viability of moving a hotel’s property-management system (PMS) to the cloud to take advantage of the latest technologies, but hoteliers need to realize that it’s not the only viable option. All platforms have advantages, including self-hosted, private cloud and on-premise solutions that leverage the latest mobile, contact free and web-based technologies. Independent operators can still enhance the digital guest experience, support personalized and mobile check-in, deploy contact free technologies, and secure hotel/guest data even if their PMS does not reside in the cloud. It should not be a question of “Cloud or On Premise?” but rather “Does the PMS solve your business objectives in both technology and service?”

Much has been written in the mainstream hospitality press about the challenges COVID-19 has presented to the industry. Hotels are in more pain than at any time in our memories. Because of the extensive media coverage, I won’t dwell on this topic further in what is primarily a technology column. But it’s the background for this week’s column, and so merits acknowledgement.

Are You All In?
Posted: 07/27/2020

Imagine everyone in your organization engaged, aligned, and performing to their potential. Imagine everyone playing “All In.”

Great organizations have synergy. Their culture allows them to play to a rhythm at a different tempo than the average organization. How do you get that at your organization?

Many front-line hospitality workers rely on tips for a significant part of their paychecks. If not for tips, many hotel associates who serve as waitstaff, bartenders, housekeepers, bell staff, concierges and pool attendants would soon be looking for other jobs. This is a regional issue: in most of Asia and Europe, staff get higher base pay, and tips are either not expected at all, or are truly discretionary. But in the U.S., Canada, Britain and other countries, tips are an important reality, and one that’s not likely to change anytime soon.

want to read more articles like this?

want to read more articles like this?

Sign up to receive our twice-a-month Watercooler and Siegel Sez Newsletters and never miss another article or news story.


PCI-DSS Introduces QIR Requirements; Shadow Brokers, IHG and a Rise in Healthcare Breaches

by David Durko

In the latest version of the PCI-DSS the Council officially introduced the QIR (qualified integrators and resellers) requirements. Although they have been communicating the requirements and publishing the list of validated companies we haven’t read or heard much more about it… until now!

Many hotels have received communications in the last two months from the card brands (ironically from Discover) enforcing the use of qualified integration companies.

So what does this mean?

If you plan to upgrade or change any payment application you must use a vendor that is currently on The PCI Council’s list of validated Qualified Integrators and Resellers. These companies have gone through the Councils Certification process and have proven themselves to understand how to implement payment solutions in a complaint manner. The point is the card brands want to avoid the days of installing systems and leaving the default credentials in place (MICROS/MICROS or SA/SA, for example).

The upside for the merchant is that there is accountability, should something go awry with the install and leads to or facilitates a compromise. The downside is an increase in costs. QIR registration is not cheap and the integrators will most likely pass the added expense along to their clients.

QSAs will now be obligated to validate that payment applications were installed by a QIR. This requirement is in effect and will most likely impact your 2018 compliance activities.

This week we saw the effect of stolen hacking tools exposed by the Shadow Brokers, InterContinental Hotels Group (IHG) released the actual number of hotels breached from 2016; Healthcare breaches jumped in March 2017, compared to January/February 2017.

Shadow Brokers, a hacking group that have a record of publishing hacking tools believed to be used by the NSA, released a trove of vulnerabilities, new tools and exploits from The Equation Group. Exploit components included ETERNALBLUE and DOUBLEPULSAR which are already found to be used in the wild by script kiddies.

It is suspected that Microsoft had a heads up prior to this release and held back on February’s Patch Tuesday to address this latest trove of exploits released. However, unpatched systems remain a serious threat to organizations, as well as unsupported versions such as Windows XP and Server 2003 that continue to remain exploitable.

The domino effect and the severity of these tools going public, intensifies and makes it possible for script kiddies to pawn thousands of computers using one of the exposed exploitable vulnerabilities such as the SMB networking one.

IHG Breach Greater than Originally Reported

At the end of 2016, news broke that a credit card breach involving IHG hotels had occurred. In February, IHG acknowledged a breach occurred between August and December 2016 and initially thought the impact was limited to about a dozen hotels. In April 2017, the number of hotels affected by the breach was updated to nearly 1,200.

Attackers are targeting the hospitality industry due to lack of security measures, making it possible to infiltrate terminal's remote access software with multiple entry points such as front desk, gift shop, bar and restaurants.

Read the full story in Krebs on Security.

Healthcare Breaches

Healthcare breaches in March 2017, jumped 155 percent compared to healthcare breaches in January/February 2017.

The largest incident reported; 697,800 patient records affecting Commonwealth Health Corporation in Kentucky on March 1, 2017. Of the incidents reported, 28 percent were the result of hacking which affected 600,279 patient records.

Healthcare breaches will continue if budgets are cut, legislation is pushed, and there is an underestimated penalty for healthcare data breaches.

About The Author
David Durko
Security Validation

David Durko is the CEO of Security Validation a leading managed data security and privacy firm servicing the hospitality industry.

Blog post currently doesn't have any comments.
Leave comment

 Security code