Tech Talk

Recent posts

With the news cycle laser-focused on the looming threat of a COVID-19 second wave happening in nearly every territory, it is up to each and every hotel to ensure we are all fully compliant with virus safety guidelines in order to restore group booking confidence. And the only way to ensure compliance with these safety guidelines is through contactless and compliance technologies to give guests a strong guarantee of proper sanitization as well as peace of mind.

A great deal has been written over the years about the viability of moving a hotel’s property-management system (PMS) to the cloud to take advantage of the latest technologies, but hoteliers need to realize that it’s not the only viable option. All platforms have advantages, including self-hosted, private cloud and on-premise solutions that leverage the latest mobile, contact free and web-based technologies. Independent operators can still enhance the digital guest experience, support personalized and mobile check-in, deploy contact free technologies, and secure hotel/guest data even if their PMS does not reside in the cloud. It should not be a question of “Cloud or On Premise?” but rather “Does the PMS solve your business objectives in both technology and service?”

Much has been written in the mainstream hospitality press about the challenges COVID-19 has presented to the industry. Hotels are in more pain than at any time in our memories. Because of the extensive media coverage, I won’t dwell on this topic further in what is primarily a technology column. But it’s the background for this week’s column, and so merits acknowledgement.

Are You All In?
Posted: 07/27/2020

Imagine everyone in your organization engaged, aligned, and performing to their potential. Imagine everyone playing “All In.”

Great organizations have synergy. Their culture allows them to play to a rhythm at a different tempo than the average organization. How do you get that at your organization?

Many front-line hospitality workers rely on tips for a significant part of their paychecks. If not for tips, many hotel associates who serve as waitstaff, bartenders, housekeepers, bell staff, concierges and pool attendants would soon be looking for other jobs. This is a regional issue: in most of Asia and Europe, staff get higher base pay, and tips are either not expected at all, or are truly discretionary. But in the U.S., Canada, Britain and other countries, tips are an important reality, and one that’s not likely to change anytime soon.

want to read more articles like this?

want to read more articles like this?

Sign up to receive our twice-a-month Watercooler and Siegel Sez Newsletters and never miss another article or news story.


Data Security for the New Year – Who will be Prepared?

by David Durko

The irony is that many were faced with similar situations as the final hours of 2015 ticked away.

What I find even more ironic is that it does not appear the hotel industry is any better off this year to face the onslaught of data security challenges. In general, hoteliers are ill prepared to deal with such a large threat surface. Network and system hygiene has been ignored and the industry has always viewed data security as someone else’s problem (the brands) to deal with. Few have accepted the harsh reality that franchised or not, branded or independent, compliance is the sole responsibility of whoever holds the merchant account. The time for proactive security measures is here. The question for 2017 is, “Who will be prepared?”

Unfortunately, 2017 will be another year of financial losses for consumers and property owners alike. Changes implemented by banks and card brands place the brunt of financial penalties squarely on the merchant’s back – the ambiguity of who is responsible is gone.

Rather than dwell on what we didn’t do in 2016, let’s focus on what we can do to help prevent data loss or at least mitigate the financial risk to our businesses. The focus must remain on protecting our brand, our guests and our businesses in 2017.

Topping the “to do list” is the roll out of chip and pin technologies. Mandated for all merchants, the roll out has been met with serious challenges. We all know why the rollout has been delayed but the reality is hotel and food and beverage merchants are seeing an alarming rise in non-EMV chargebacks. The industry expects the incidence of fraudulent chargebacks to continue to rise as consumers know they are been given a window to cheat the system. Although EMV is not directly tied to data security best practices, it will present one of the largest sources of losses to the property aside from a data breach.

Training and awareness remains at the top of the list in 2017. However, it is not the be all and end all for PCI compliance. Stop spending every penny of your data security budget on these high priced and often ineffective training programs. A solid and basic training program much like the one offered by the PCI Council is more than sufficient if coupled with periodic reinforcement. Many hotels do not have an unlimited budget to devote to data security. The goal is to balance your dollars to best protect your business.

Stop self-assessing. For years’ hotel staff have been checking the box and attesting to PCI compliance. In a survey of hotel general managers charged with filing self-assessment questionnaires, less than 2 percent understood what they were clicking, attesting to or actually signing. Use your compliance budget effectively. Take some of that money you saved on those expensive training programs and hire a firm to evaluate your data security posture.

We don’t know where the holes are! This is the biggest gap for most merchants. They are good at running a business but they do not have the ability or technical context to identify where their properties are most vulnerable. Enlisting the help of a third-party to evaluate the data security posture of the property and to develop a sensible remediation plan is the best money a hotel can spend. Ignorance is not bliss and can cost you more in fines and penalties than you would ever spend on an assessment and remediation. If you don’t know where the holes are how can you self-assess?

Great progress has been made to tokenize cardholder data. This is a great win for the merchant and will help protect from the exfiltration of guest data should the property management system be compromised.  The problem is that far too often the point of sales systems are not included in the roll out of tokenization products. This leaves the POS exposed and vulnerable. 2016 was the year of point of sales breaches.

Point 2 Point Encryption (P2PE) seems to be golden ticket for hoteliers. Removing themselves from the data flow effectively eliminates data breach exposure and reduces the cost associated with remediation and compliance significantly. Although currently there are very few vendors with approved P2PE solutions, we expect the list to grow in 2017. Remember the safest bet is to only use P2PE solutions that have been vetted and approved by the PCI council.

The reality is 2017 will be a difficult year for hoteliers. Before we have a chance to evaluate, remediate and upgrade our properties there will be many more data security incidents. The goal is to protect your properties and your brand in the most effective way.

About The Author
David Durko
Security Validation

David Durko is the CEO of Security Validation a leading managed data security and privacy firm servicing the hospitality industry.

Blog post currently doesn't have any comments.
Leave comment

 Security code