Making the decision to stay at a hotel involves a high level of trust. With the advent of Wi-Fi and IoT-embedded devices, e.g. televisions and refrigerators, today’s hotels need to protect their guest’s data security just as they do their physical belongings. It is no secret that accessing customer data, such as payment information – either in the lobby through hotel POS systems or in the guest hotel rooms – can be a goldmine for cybercriminals.
Once they have guest’s data, the rest is history. This article summarizes some essential best practices to improve your security practices and exploit data strength.
85.4 GB of Pyramid Hotel Group Data Exposed, Compromising Private Security Data
In May of 2019, security researchers discovered 85.4 GB of security audit log data for the Pyramid Hotel Group, a hotel and resort management company. Information that was exposed includes device names, server API and password, IP addresses (with geolocation), and firewall and open ports data. Full names of employees and email addresses, plus other sensitive information regarding the company’s data protection practices were also compromised, e.g. viruses detected on machines.
While no hack is known to have occurred, the risk of consumer privacy – and safety – is apparent, since some of the tech that was left exposed included devices that control hotel room locks and safes. The timeframe between breach discovery (May 27, 2019) and breach remediation (May 29) was only two days, making it a fast fix. However, the exposed data went back to April 19.
Best Cybersecurity Practices to Secure Hotel Data
From credit card numbers, passport information, flight details to hotel information, the list goes on for hackers retrieving information. Hotels, like any other organization, must implement adequate cybersecurity practices to protect from vulnerabilities, potential threats and cyberattacks. A flood of terrifying cybersecurity statistics is available for hotel executives to consider the best strategies to prepare their organization. Here are some tips to make your hotel information more secure.
Security Starts With Your Wifi
A key factor at hotels is the guest WiFi network. Many hotels have a private internet connection for guests to connect their devices to WiFi designated to their rooms. While there is a separation from the hotel’s main network, it is feasible to infiltrate the many different devices – and vulnerabilities tied to them. Hotels must look at network security as an investment in their industry, and not as an extra cost. This includes installing firewalls and enabling some kind of WPA2 encryption. Provide advice to customers to only use virtual private networks (VPNs) and share information with secured websites, as indicated by the HTTPS.
Hotel Network Infrastructure Contains Numerous Attack Vectors
For most hotels, the systems used for restaurants, convenience stores, spas, or other services, all require connections back to the hotel system where secure data is kept. This poses several points of vulnerability where a hacker can infiltrate the attack surface and navigate to its other important data assets. Designing a network that is segmented, with network devices can enable the flow of data with less likelihood of a breach or hack.
Encrypt the Payment System
The utilization of a payment method that is encrypted end-to-end also helps to guarantee the transaction. By implementing this kind of system, the card number is never present within the hotel installations, and the only data that moves across the network is encrypted. Because encryption always requires an internet connection, it is crucial that reliable broadband service is used to increase the trustworthiness of the payment methods.
Educate Employees with Best Cybersecurity Practices
With appropriate training, the chances of an employee giving a hacker access by mistake can be enormously reduced. Social engineering must be considered as hackers find ways to manipulate victims into opening attachments or letting unauthorized people into the secured perimeter. Training to ensure personnel adhere to hotel’s security and compliance policies is a great way to get started. Make sure they have reviewed and/or have an understanding of policy documentation.
Limit employees from downloading or installing software on company laptops. Reduce the amount of web surfing that’s permitted on computers holding company records or sensitive data. Educate employees to identify, remove, and report untrustworthy emails or links, and instruct them to generate strong passwords.
Time to Look for Insider Threats
Just like in any other organization, employees with access to hotel data can offer it to third parties. These types of breaches are tougher to find, since the perpetrator may have authorized access as an employee. You can avoid this by ensuring that employees are held accountable for adhering to cybersecurity policy. Identify responsibilities in terms of how much data it involves and restrict access to essential hotel data to a limited number of employees. Instill the least privilege access policy so that personnel only have access to the minimum information resources they need to get the job done.
Protect Hotel Data by Implementing a Proactive Strategy
The year 2019 was the worst for cybercrime, with cyberattacks escalating in frequency and severity. The time is now to determine organization-wide security processes, remediation plans and budget allowances. To conceal all viewpoints of the attack surface, a unified approach is necessary, which embeds security in every aspect of DevOps.
There needs to be an effective system for identifying threats and the security controls that can mitigate them. The only way to prevent the next hotel data breach is to be proactive. With a complete understanding of the key data security risks and some of the best practices for mitigating those threats, organizations in the hotel industry are better positioned to maintain effective cybersecurity.
ThreatModeler to Help Secure Your Hotel Data
Threat modeling can help the hospitality industry to prevent inconsistencies or errors in data handling, while preventing liabilities that may occur. Threat modeling helps organizations to better understand their attack surface, and the performance of their data storage. ThreatModeler has taken the guesswork out of the equation with its innovative, automated platform.
ThreatModeler enables security teams to build threat models out-of-the box with libraries that pull content from authoritative resources including OWASP, CAPEC, the NVD, AWS and Azure. To learn more about how ThreatModeler™ can help your organization build a scalable threat modeling process, book a demo to speak to a ThreatModeler expert today.
