Tech Talk

Recent posts

Love
Posted: 10/23/2020

"Friendship often ends in love, and love in friendship never ends. "

We’re hardly out of the woods with COVID-19, and that means many properties will have to make do with a customer base mostly derived from local leisure, staycations and workcations from drive-to markets. With fewer overall guests, outside of cost savings efforts we must simultaneously look at maximizing the revenue per available guest (RevPAG), and there’s no better way to go about this than by sharpening your use of the PMS.

This is the last issue of Siegel Sez before this year’s CYBER HITEC event. HITEC is an event I have not missed in 30 years, and historically it has always been a great place to find innovation.

Toxicity Kills
Posted: 10/07/2020

It doesn’t matter if it is toxins in your physical environment or toxins in your mental environment. This stuff kills! 

It’s said that when someone’s mindset shifts, everything around them can change at the same time, and in our current setting, the importance of being in the right headspace, both personally and as an organization, can’t be discussed enough.



want to read more articles like this?

want to read more articles like this?

Sign up to receive our twice-a-month Watercooler and Siegel Sez Newsletters and never miss another article or news story.

x
 

Data Security for the New Year – Who will be Prepared?

01/25/2017
by David Durko

The irony is that many were faced with similar situations as the final hours of 2015 ticked away.

What I find even more ironic is that it does not appear the hotel industry is any better off this year to face the onslaught of data security challenges. In general, hoteliers are ill prepared to deal with such a large threat surface. Network and system hygiene has been ignored and the industry has always viewed data security as someone else’s problem (the brands) to deal with. Few have accepted the harsh reality that franchised or not, branded or independent, compliance is the sole responsibility of whoever holds the merchant account. The time for proactive security measures is here. The question for 2017 is, “Who will be prepared?”

Unfortunately, 2017 will be another year of financial losses for consumers and property owners alike. Changes implemented by banks and card brands place the brunt of financial penalties squarely on the merchant’s back – the ambiguity of who is responsible is gone.

Rather than dwell on what we didn’t do in 2016, let’s focus on what we can do to help prevent data loss or at least mitigate the financial risk to our businesses. The focus must remain on protecting our brand, our guests and our businesses in 2017.

Topping the “to do list” is the roll out of chip and pin technologies. Mandated for all merchants, the roll out has been met with serious challenges. We all know why the rollout has been delayed but the reality is hotel and food and beverage merchants are seeing an alarming rise in non-EMV chargebacks. The industry expects the incidence of fraudulent chargebacks to continue to rise as consumers know they are been given a window to cheat the system. Although EMV is not directly tied to data security best practices, it will present one of the largest sources of losses to the property aside from a data breach.

Training and awareness remains at the top of the list in 2017. However, it is not the be all and end all for PCI compliance. Stop spending every penny of your data security budget on these high priced and often ineffective training programs. A solid and basic training program much like the one offered by the PCI Council is more than sufficient if coupled with periodic reinforcement. Many hotels do not have an unlimited budget to devote to data security. The goal is to balance your dollars to best protect your business.

Stop self-assessing. For years’ hotel staff have been checking the box and attesting to PCI compliance. In a survey of hotel general managers charged with filing self-assessment questionnaires, less than 2 percent understood what they were clicking, attesting to or actually signing. Use your compliance budget effectively. Take some of that money you saved on those expensive training programs and hire a firm to evaluate your data security posture.

We don’t know where the holes are! This is the biggest gap for most merchants. They are good at running a business but they do not have the ability or technical context to identify where their properties are most vulnerable. Enlisting the help of a third-party to evaluate the data security posture of the property and to develop a sensible remediation plan is the best money a hotel can spend. Ignorance is not bliss and can cost you more in fines and penalties than you would ever spend on an assessment and remediation. If you don’t know where the holes are how can you self-assess?

Great progress has been made to tokenize cardholder data. This is a great win for the merchant and will help protect from the exfiltration of guest data should the property management system be compromised.  The problem is that far too often the point of sales systems are not included in the roll out of tokenization products. This leaves the POS exposed and vulnerable. 2016 was the year of point of sales breaches.

Point 2 Point Encryption (P2PE) seems to be golden ticket for hoteliers. Removing themselves from the data flow effectively eliminates data breach exposure and reduces the cost associated with remediation and compliance significantly. Although currently there are very few vendors with approved P2PE solutions, we expect the list to grow in 2017. Remember the safest bet is to only use P2PE solutions that have been vetted and approved by the PCI council.

The reality is 2017 will be a difficult year for hoteliers. Before we have a chance to evaluate, remediate and upgrade our properties there will be many more data security incidents. The goal is to protect your properties and your brand in the most effective way.

About The Author
David Durko
CEO
Security Validation


David Durko is the CEO of Security Validation a leading managed data security and privacy firm servicing the hospitality industry.

 
Comments
Blog post currently doesn't have any comments.
Leave comment



 Security code