Tech Talk

Recent posts

People today expect to be connected always and everywhere; sometimes it’s hard to believe that there was a world before smartphones and Wi-Fi. In the time since Wi-Fi became ubiquitous in hotels, apartments, and public spaces, it has fueled the evolution of connectivity in a lot of ways. Just like Maslow’s hierarchy of needs, the most basic needs start at the bottom, and you can’t get to the next level without a strong foundation. 

By now, everyone is aware that hotel giant Marriott International announced on Friday a massive data breach that goes back more than four years and may have affected up to 500 million customers worldwide. 

After two years of preparation, the FlyZoo Hotel — a futuristic property that uses interactive technologies to do everything from greet guests to deliver room service — is ready for business. 

Mobile technology is fast becoming central to the entire travel experience. Consumers are increasingly using their smartphones to research trips, book accommodation, check in at the airport, and access their hotel room. But one of the next big roles mobile has to play in the travel process is mobile payment. The idea of an entirely cashless society might still seem some way off, but mobile payment is gaining popularity. As it becomes more widely used, its fast and frictionless nature will bring benefits before, during and after a trip. 

Digital marketing, also known as internet marketing, plays a significant role to boost hotel website traffic and online bookings. Recently, many big announcements were made in the digital industry, for example when Facebook introduced a new video format for marketers, or when Google announced a board core algorithm. If you are a new hotelier and want to stay ahead in the industry, then you should know what’s going on in the hotel digital marketing industry. 
 



want to read more articles like this?

want to read more articles like this?

Sign up to receive our twice-a-month Watercooler and Siegel Sez Newsletters and never miss another article or news story.

x
 

The Hospitality Industry's Cybersecurity Problem: Making Your Hotel Undesirable for Hackers

10/19/2016

It’s no secret that the hospitality industry has a serious cybersecurity problem. In the past few months alone, there have been dozens of hotel data breaches reported. Hotels and resorts have long been a hot target for criminals, and that trend shows no signs of slowing down anytime soon.

Hospitality payment security is hard to implement successfully and requires a specialized knowledge and approach. Why? Let’s look at an example.

Hotels have to store guest records from reservation to check out. Some of my clients on the Vegas Strip book rooms a year or more in advance for events like New Year’s Eve. That’s an awfully long time to store card data, especially because the bad guys know it’s there and actively go after it. Unfortunately, it only gets more complex from there. Think about the potential sources of payment data in a large resort. There are folios and cards on file, electronic third-party reservations that contain card data in clear text, faxes and emails with card numbers sent to the banquet and events team, a concierge using the guests’ card to buy concert tickets, and potentially hundreds of swipe devices (or, these days, maybe EMV devices) capturing card data at the front desk, restaurants, gift shops, spas and who knows where else.

EMV’s ROLE IN IT ALL

Securing an environment like this is a Herculean undertaking, and one that many of you are taking positive strives toward. Undoubtedly, you’re all considering – if not actively working toward – implementing EMV. A few of you already have it up and running, although Mastercard’s most recent data shows that only about a third of U.S. merchants can actually process chip-based transactions, and based on my experience, that number is likely much lower in hospitality. 

Let’s talk about EMV for a moment. Do you know what it does? If your answer was anything about preventing breaches, you are misinformed. EMV was designed to prevent card-present fraud. Specifically, to make it much harder (if not impossible) for thieves to encrypt the card data they had previously stolen onto a new card in order to make illegitimate purchases.

STOPPING THE TIDE OF BREACHES

To avoid becoming a victim of a payment data breach,
remove the card data from your environment
and leave nothing for the hackers to steal.
 
So if EMV protects us from thieves trying to use card data they’ve harvested in previous breaches, what protects us from becoming the source of the next breach?

The easiest way, in my experience, to avoid becoming victim to a payment data breach is to remove the card data from your environment and leave nothing for the hackers to steal. We do this through a combination of tokenization, which replaces the card data you used to store in folios and card-on-file databases with a meaningless value that only references the original data, and point-to-point encryption (P2PE), which encrypts the card data at the moment it enters the credit card terminal and prevents the actual data from ever getting into your point of sale or property management system. With these two tools, properly employed, hoteliers can eliminate the vast majority of their breach profile and make themselves much less desirable targets for thieves.

The remainder of the card data from things like websites, online and call-center reservations, catering faxes or concierge phone calls, can likewise be eliminated with the use of specialized tools that leverage P2PE and/or tokenization to leave a hotel completely free of sensitive cardholder data. This should be your goal. Imagine the resources you could reallocate to growing your business, wowing your guests, and coming up with the next differentiator to set you apart from your competition, if you didn’t have to invest in securing and maintaining all of this data.

With P2PE and tokenization as your secure foundation, you are free to implement new technologies like mobile payments by the pool, app-based payments to order room service from your phone, or whatever comes next – without putting your guests and your brand at risk.

A FINAL WARNING

EMV has been a tall order for the hospitality industry. New terminals come at a considerable cost and new business processes are difficult to implement. And the whole thing has come with relatively little measurable benefit to hoteliers. With the increase in friendly fraud, hotels are now seeing financial reasons to adopt EMV. As you do, please take the time to find a solution that integrates with all point-of-sale and property management systems that are at use in your environment. Moving to a non-integrated solution is asking for increased fraud and complaints from your accounting team as you drastically increase their workload.

Also, if you’re making the capital investment into new EMV terminals, ensure that they support P2PE so that you are enhancing your security capabilities as you take steps to fight fraud. Together, EMV, tokenization, and P2PE form the foundation that will protect you today and for years to come.

About The Author
J.D. Oder
CTO and SVP of Research and Development
Shift4 Corporation


J.D. Oder II serves as Shift4’s CTO and SVP of research and development. J.D. is a certified network engineer with more than 15 years of experience. He leads Shift4’s systems operations and development efforts as well as the security and compliance teams. J.D. is the architect of the DOLLARS ON THE NET® payment gateway solution. He is credited with introducing tokenization to the industry in 2005 and was also an early adopter/member of the PCI Security Standards Council.

 
Comments
Blog post currently doesn't have any comments.
Leave comment



 Security code