Tech Talk

Recent posts

A great deal has been written over the years about the viability of moving a hotel’s property-management system (PMS) to the cloud to take advantage of the latest technologies, but hoteliers need to realize that it’s not the only viable option. All platforms have advantages, including self-hosted, private cloud and on-premise solutions that leverage the latest mobile, contact free and web-based technologies. Independent operators can still enhance the digital guest experience, support personalized and mobile check-in, deploy contact free technologies, and secure hotel/guest data even if their PMS does not reside in the cloud. It should not be a question of “Cloud or On Premise?” but rather “Does the PMS solve your business objectives in both technology and service?”

Much has been written in the mainstream hospitality press about the challenges COVID-19 has presented to the industry. Hotels are in more pain than at any time in our memories. Because of the extensive media coverage, I won’t dwell on this topic further in what is primarily a technology column. But it’s the background for this week’s column, and so merits acknowledgement.

Are You All In?
Posted: 07/27/2020

Imagine everyone in your organization engaged, aligned, and performing to their potential. Imagine everyone playing “All In.”

Great organizations have synergy. Their culture allows them to play to a rhythm at a different tempo than the average organization. How do you get that at your organization?

Many front-line hospitality workers rely on tips for a significant part of their paychecks. If not for tips, many hotel associates who serve as waitstaff, bartenders, housekeepers, bell staff, concierges and pool attendants would soon be looking for other jobs. This is a regional issue: in most of Asia and Europe, staff get higher base pay, and tips are either not expected at all, or are truly discretionary. But in the U.S., Canada, Britain and other countries, tips are an important reality, and one that’s not likely to change anytime soon.

As somebody who’s helped to grow a company from 13 people to nearly a thousand, I know very well the excitement that comes with having a mindset focused entirely on growth. Every newly acquired customer, every new office and every milestone means the gap between you and your nearest competitor is that much bigger and that much harder to overtake.

want to read more articles like this?

want to read more articles like this?

Sign up to receive our twice-a-month Watercooler and Siegel Sez Newsletters and never miss another article or news story.


Data Breaches — What is a Hotel Brand Supposed to Do?

by John Christly

Unfortunately, large hotel chains are ideal victims — enticing hackers with large quantities of valuable information such as credit card data for guests and sensitive employee data for staff. All owners and operators need to take proactive steps to protect consumer data.

A recent string of cybersecurity events affecting a surprising number of well-known hotel chains has been making headlines. First, it was revealed that a point-of-sale (POS) malware breach hit a total of 20 hotels run by HEI Hotels and Resorts, including Hyatt, Marriott, Starwood and Intercontinental properties. The attack was active March 1, 2015 through June 21, 2016, potentially affecting thousands of customers — according to a statement by HEI Hotels and Resorts.

In the same timeframe, a data breach was announced at Millennium Hotels & Resorts North America, involving food and beverage POS systems at 14 of its hotels in the U.S. Credit cards that were processed from early March 2016 to mid-June 2016 were affected.

Not long after this, credit information was reportedly compromised at Noble House Hotels & Resorts, affecting credit cards used at 11 different properties between April 25, 2016 and Aug. 3, 2016. Most recently, Kimpton Hotels confirmed that malware was found on payment terminals in more than 60 of its hotels and restaurants. Customers’ payment cards processed between Feb. 16, 2016 and July 7, 2016 were involved.

This string of hotel chain attacks indicates that many hospitality companies still are not implementing strong enough security measures — particularly when it comes to the POS systems.

So what is a hotel brand supposed to do?

Hospitality companies must realize that they are in a digital war with cybercriminals that are after payment card data. And it’s a harsh reality that the war is being won far too often by these hackers. Any business, regardless of size or vertical specialty, that processes payment data or offers free Wi-Fi to guests, is a lucrative breach target, but unfortunately, large chains like HEI or Kimpton are ideal victims — enticing hackers with large quantities of valuable information such as credit card data for patrons, sensitive employee data for staff, and sometimes even medical data used by in-house care facilities.

Cybercriminals have multiple opportunities
and points of entry for the hacks.

Hotels are generally more at risk for POS breaches because payment card data is used throughout each hotel location — most have multiple POS terminals. Plus card info is shared with the hotel before the guest even arrives through the booking process. All of this gives cybercriminals multiple opportunities and points of entry for the hacks.  In addition, hotels are made even more vulnerable thanks to other POS system provider breaches, like the recent one at Oracle that affected 330,000 merchants.

Regardless of the size of the hotel, all owners and operators need to take proactive steps to protect the consumer data they come into contact with.
Traditional cybersecurity defenses just aren’t cutting it anymore. And customers of these establishments deserve the best possible security of their data — and they should expect it too. New defensive approaches, advanced cybersecurity tools and increased cyber intelligence need to be deployed, which usually come from a relationship with an outside vendor due to the specialized knowledge needed to understand what the tools and resulting information being gathered is telling you. Possible tools include things like File Integrity Monitoring, Unified Threat Management (UTM) appliances, Security Information and Event Management (SIEM) and next-generation endpoint security solutions.
When systems like this are in place and managed appropriately, the processes within the programs,  the computer operating system and memory will be watched for suspicious activity — and those tools will talk to other tools that have even deeper threat intelligence from a network of other deployed sensors.

However, it’s very hard to do all of this on your own. Many hotels don’t have dedicated IT staff available to run these systems, and worse yet, those that have dedicated IT staff at a corporate level may not have the skills or cycles available to dedicate the required time needed to properly manage these types of defense systems.

Within the IT security world, there is a skills shortage going on. Beyond that, it is so hard to find people that are loyal, knowledgeable, and able to understand security related data that flows in at warp speed from computer systems. The trend seems to be to hire an external vendor that can do some of this ‘heavy lifting’ for you.

The cyber threats of tomorrow will require new ways of thinking and new tools to defend against hacking attempts and the resulting data loss. It’s time that the hospitality industry make use of these advanced tools and the vendors in the market that can help keep them safer and  better protected from the attacks on their POS systems that seem to keep coming. This proactive approach will help to keep organizations out of the breach headlines.

About The Author
John Christly
Chief Information Security Officer

John Christly is the chief information security officer for Netsurion, a provider of remotely managed security services for multi-location businesses. He is responsible for security and compliance for the firm and is an avid cyber threat researcher.

Blog post currently doesn't have any comments.
Leave comment

 Security code