Tech Talk

Recent posts

Merging High Tech With High Touch to Create a New Hospitality Paradigm
Posted: 03/23/2023

One of the key challenges facing today’s hoteliers is that of high tech vs high touch. Does technology conflict with personalized service? Is it possible to offer both during the same visit? And can hotels that utilize technology in favor of human interaction achieve guest loyalty?

Business travel is picking back up and families may be taking their first or second real vacations since the pandemic cancelled so many plans just a few years ago. To ensure that guests have the best on-site experience possible, hoteliers are increasingly looking to new technologies to make their stay more comfortable than ever. With an advanced property management systems (PMS) and integration platforms, hoteliers can increase operational and staff efficiency, but also meet changing guest expectations for a high-value but relatively low-touch experience. We looked ahead to see what changes we expect to see sweeping the hospitality industry this year.

Long-term readers of this blog know that I rarely focus on a single company or product. My goal is to help readers understand new and emerging technologies, when and why they might be useful, and what to consider if you are buying them.

Read More +

The Future of Hotels
Posted: 02/21/2023

Hotels have always been a high-touch low-tech business. Today, and into the foreseeable future, hotels are moving away from the pure ‘people serving people’ model towards a more high-tech low-touch business, and doubling down on digitalization. In the paragraphs below, I envision ways in which tech can innovate and enhance the guest experience throughout the guests’ 6 stage hotel journey: Imagine-Book-Stay-Report-Recommend-Return.

Read More +

Definitely Doug 2/10/23: Planning for June
Posted: 02/10/2023

The question I have heard most often in recent months is “where are you going in the last week of June?”. As most readers are aware, two trade shows featuring hotel technology are scheduled during the same dates that week. Many of you are still undecided which to attend. Knowing that your decision will be based at least in part on where others are going (hoteliers and exhibitors both), I decided to try to get some real data that I could share.

Read More +

comment on this article

PCI-DSS Introduces QIR Requirements; Shadow Brokers, IHG and a Rise in Healthcare Breaches

04/27/2017

by David Durko

In the latest version of the PCI-DSS the Council officially introduced the QIR (qualified integrators and resellers) requirements. Although they have been communicating the requirements and publishing the list of validated companies we haven’t read or heard much more about it… until now!

Many hotels have received communications in the last two months from the card brands (ironically from Discover) enforcing the use of qualified integration companies.

So what does this mean?

If you plan to upgrade or change any payment application you must use a vendor that is currently on The PCI Council’s list of validated Qualified Integrators and Resellers. These companies have gone through the Councils Certification process and have proven themselves to understand how to implement payment solutions in a complaint manner. The point is the card brands want to avoid the days of installing systems and leaving the default credentials in place (MICROS/MICROS or SA/SA, for example).

The upside for the merchant is that there is accountability, should something go awry with the install and leads to or facilitates a compromise. The downside is an increase in costs. QIR registration is not cheap and the integrators will most likely pass the added expense along to their clients.

QSAs will now be obligated to validate that payment applications were installed by a QIR. This requirement is in effect and will most likely impact your 2018 compliance activities.

This week we saw the effect of stolen hacking tools exposed by the Shadow Brokers, InterContinental Hotels Group (IHG) released the actual number of hotels breached from 2016; Healthcare breaches jumped in March 2017, compared to January/February 2017.

Shadow Brokers, a hacking group that have a record of publishing hacking tools believed to be used by the NSA, released a trove of vulnerabilities, new tools and exploits from The Equation Group. Exploit components included ETERNALBLUE and DOUBLEPULSAR which are already found to be used in the wild by script kiddies.

It is suspected that Microsoft had a heads up prior to this release and held back on February’s Patch Tuesday to address this latest trove of exploits released. However, unpatched systems remain a serious threat to organizations, as well as unsupported versions such as Windows XP and Server 2003 that continue to remain exploitable.

The domino effect and the severity of these tools going public, intensifies and makes it possible for script kiddies to pawn thousands of computers using one of the exposed exploitable vulnerabilities such as the SMB networking one.

IHG Breach Greater than Originally Reported

At the end of 2016, news broke that a credit card breach involving IHG hotels had occurred. In February, IHG acknowledged a breach occurred between August and December 2016 and initially thought the impact was limited to about a dozen hotels. In April 2017, the number of hotels affected by the breach was updated to nearly 1,200.

Attackers are targeting the hospitality industry due to lack of security measures, making it possible to infiltrate terminal's remote access software with multiple entry points such as front desk, gift shop, bar and restaurants.

Read the full story in Krebs on Security.

Healthcare Breaches

Healthcare breaches in March 2017, jumped 155 percent compared to healthcare breaches in January/February 2017.

The largest incident reported; 697,800 patient records affecting Commonwealth Health Corporation in Kentucky on March 1, 2017. Of the incidents reported, 28 percent were the result of hacking which affected 600,279 patient records.

Healthcare breaches will continue if budgets are cut, legislation is pushed, and there is an underestimated penalty for healthcare data breaches.