Tech Talk

Recent posts

Enterprise System Pitfalls: Summary
Today I’m wrapping up a series of posts on the broad topic of Enterprise System Pitfalls. In this series, my hope was to help shed light on the primary problems that cause us to miss budgets, fall short on capabilities, or completely fail when implementing an enterprise system. 

The Year in Review
As 2019 comes to a close, it’s time to count our blessings. One of mine has been the privilege (and fun!) of being able to reach out to so many interesting companies and get them to tell me what they’re doing that’s different, disruptive, and game-changing. The list of things I have to write about in future columns has only gotten longer in the nine months since I started writing this column.

Sustainable Innovation
Sustainability can yield multiple benefits to hotels. Saving energy and water yields direct cost savings. Revenue can be generated by guests who prefer to deal with businesses that minimize their environmental impact. And many would argue that conserving scarce resources is simply the right thing to do.

Meetings Innovation
The sale and delivery of groups and meetings is perhaps the most significant and under-automated functions for many hotels. Even though groups often account for 30% to 60% of revenue, most group bookings are still handled manually for most if not all of steps, as they move from a meeting planner’s research to a confirmed booking.

The biggest enemy to any system is complexity. In a system of inputs and outputs, such as an enterprise system, more complexity means more parts are used in interaction with inputs to create the outputs. Every part that must be built and maintained costs time and money

want to read more articles like this?

want to read more articles like this?

Sign up to receive our twice-a-month Watercooler and Siegel Sez Newsletters and never miss another article or news story.


PCI-DSS Introduces QIR Requirements; Shadow Brokers, IHG and a Rise in Healthcare Breaches

by David Durko

In the latest version of the PCI-DSS the Council officially introduced the QIR (qualified integrators and resellers) requirements. Although they have been communicating the requirements and publishing the list of validated companies we haven’t read or heard much more about it… until now!

Many hotels have received communications in the last two months from the card brands (ironically from Discover) enforcing the use of qualified integration companies.

So what does this mean?

If you plan to upgrade or change any payment application you must use a vendor that is currently on The PCI Council’s list of validated Qualified Integrators and Resellers. These companies have gone through the Councils Certification process and have proven themselves to understand how to implement payment solutions in a complaint manner. The point is the card brands want to avoid the days of installing systems and leaving the default credentials in place (MICROS/MICROS or SA/SA, for example).

The upside for the merchant is that there is accountability, should something go awry with the install and leads to or facilitates a compromise. The downside is an increase in costs. QIR registration is not cheap and the integrators will most likely pass the added expense along to their clients.

QSAs will now be obligated to validate that payment applications were installed by a QIR. This requirement is in effect and will most likely impact your 2018 compliance activities.

This week we saw the effect of stolen hacking tools exposed by the Shadow Brokers, InterContinental Hotels Group (IHG) released the actual number of hotels breached from 2016; Healthcare breaches jumped in March 2017, compared to January/February 2017.

Shadow Brokers, a hacking group that have a record of publishing hacking tools believed to be used by the NSA, released a trove of vulnerabilities, new tools and exploits from The Equation Group. Exploit components included ETERNALBLUE and DOUBLEPULSAR which are already found to be used in the wild by script kiddies.

It is suspected that Microsoft had a heads up prior to this release and held back on February’s Patch Tuesday to address this latest trove of exploits released. However, unpatched systems remain a serious threat to organizations, as well as unsupported versions such as Windows XP and Server 2003 that continue to remain exploitable.

The domino effect and the severity of these tools going public, intensifies and makes it possible for script kiddies to pawn thousands of computers using one of the exposed exploitable vulnerabilities such as the SMB networking one.

IHG Breach Greater than Originally Reported

At the end of 2016, news broke that a credit card breach involving IHG hotels had occurred. In February, IHG acknowledged a breach occurred between August and December 2016 and initially thought the impact was limited to about a dozen hotels. In April 2017, the number of hotels affected by the breach was updated to nearly 1,200.

Attackers are targeting the hospitality industry due to lack of security measures, making it possible to infiltrate terminal's remote access software with multiple entry points such as front desk, gift shop, bar and restaurants.

Read the full story in Krebs on Security.

Healthcare Breaches

Healthcare breaches in March 2017, jumped 155 percent compared to healthcare breaches in January/February 2017.

The largest incident reported; 697,800 patient records affecting Commonwealth Health Corporation in Kentucky on March 1, 2017. Of the incidents reported, 28 percent were the result of hacking which affected 600,279 patient records.

Healthcare breaches will continue if budgets are cut, legislation is pushed, and there is an underestimated penalty for healthcare data breaches.

About The Author
David Durko
Security Validation, LLC

David Durko is the CEO and chief compliance officer for Security Validation’ Data Security Advisory Practice. Security Validation provides PCI and GDPR Assessment Services along with Virtual Data Privacy Officer services from its offices in the U.S. and U.K.

Blog post currently doesn't have any comments.
Leave comment

 Security code