An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the

upcoming 2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances

Deep CyberSecurity Hacking, Analysis

and Solution in Hospitality Industry –
Protecting all layers Privacy and
Vulnerability followed by GDPR, CIS
V7.1, ISO27001 compliances.
Eylon Raz, CTO; eylon@secure-stay.com

Abstract
This review aims to emphasize the importance of cybersecurity in the hospitality industry,
followed by GDPR, CIS v7.1, ISO27001 compliances. This study further identifies and
analyzes the urgency, needs, and several common network threats and recommends applicable
security practices and techniques to prevent cyber-attacks in hotels at all layers Data-
>Application->End-Points->LAN->Perimeter->WAN->Cloud. The methodology of this
article is a unique combination of qualitative method and review method for an in-depth
understanding of real-life issues within the industry and the most recent technical and
practical solutions that hotels use to handle and solve these issues. The findings of this paper
show that the techniques currently utilized by hotels to prevent cyber-attacks are mostly
rudimentary and outdated.
Furthermore, it indicates that most hotel staff lack the knowledge and expertise to handle
potential threats. Thus, hospitality industry becomes even more vulnerable to cyber threats
and attacks. Finally, the paper discusses some implications and recommendations to hotel
policymakers to help secure the hotels and guests’ information from security attacks.

This analysis is a rich source of information for Information Technology (IT) directors and
Chief Information Officers (CISO) to advance their policies and procedures for security and
data in hotels using the most recent and updated information available in the hospitality
industry.

Secure Hospitality Data - https://secure-stay.com/

 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
Introduction Data Privacy and Cybersecurity
needs in the hospitality industry are taking the
manifest of data-HUB, driven by increasing
transaction volumes, complex reporting
requirements, e-marketing, and international
communication needs. Information technology (IT)
can improve almost all areas of the hospitality
industry, such as guest services, reservations, room
and data access, sales, services, maintenance,
security, and accounting. More recently, the internet
of things (IoT) is shaping the future of the
hospitality management industry by opening up
new avenues for immediate, personalized, and
localized services. For example, in-room IoT units
like an electrical key for room access, In-TV
cameras, and motion sensors can penetrate
customers’ privacy. Moreover, edge/fog computing
can be utilized to provide location-based services
for the hospitality industry. Although technology
incorporation in the hospitality industry has
transformed the way services are provided and
received and has helped improve guest experiences,
it has also given rise to various challenges, among
which ensuring the cybersecurity of these
incorporated technologies in the hospitality industry
is of paramount significance.
The use of technology in the hospitality industry
often requires gathering guest information and
thus can lead to data breaches and information
loss. To prevent losses, organizations monitor
their computer networks for many security
threats, such as computer-assisted fraud,
espionage, sabotage, hacking, system failures,
fire, flood, etc. Since t h e hospitality industry
is data-HUB, a consumer-centric business where
consumer loyalty and trust directly translate to
revenue, hence to retain the public trust and to
prevent copycat hackers from hacking into an
organization’s computer systems, most of the
hospitality organizations try not to reveal the data
breaches and cyber-attacks against their
computer systems.
Research Purpose and Research Questions
The purpose of this paper is to e x p l o r e the
significance of cybersecurity in the hospitality
industry and the way of meeting standard
cybersecurity compliances (GDPR, CIS V7.1,
ISO 27001, etc.). This could be enabled by
identifying and analyzing data privacy upon all
layers as well as threats assessments and
recommending useful security practices and
techniques to prevent cyber-attacks.
The following research questions were created to
be answered leveraged by this study:
1. What methods, standards, compliances, tools,
and techniques are currently used in hotels
regarding data privacy and security?
2. What are the current threats and the ways of
handling security attacks at all layers (Data,
Application, end-points, LAN, perimeter, WAN,
cloud in the hospitality industry?
3. What is the importance of network security in
hotels?
4. Which actions do hotels need to take in order to
secure their websites for data and financial
transactions privacy?
5. What are the actions/steps that hoteliers need
to take, and what areas need to be covered to
keep their guests’ data private and secure?
The remainder of this paper is organized as
follows. Section 1 provides an in-depth
background review of cybersecurity issues in the
hospitality industry. Section 2 outlines the Hotel
security – main data assets to protect. Section 3
details the most common compliances that the
hospitality industries need to meet to keep away
hackers and meet the world’s best protection
practices. The Practical Steps How Hoteliers Can
Improve Privacy and Data Protection which are
the findings and results of this paper are
presented in Section 4. Section 5 concludes this
study and provides recommendations for the
hospitality industry to help secure hotels and
customers’ data from potential security attacks.
1. Background and Literature Review
1.1 Hotels industry in review – segments, key
players, and annual revenues
The hotel industry provides short-term lodging,
such as hotels and motels, as well as
accommodation-related services. It is divided
into two main types of companies: C-
corporation hotels and hotel real estate
investment trusts (REITs)[1]. C-corp hotels
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances

offer hotel management, branding and But why are hotels particularly vulnerable to
marketing, and franchise licensing, while hotel these attacks?
REITs focus on the acquisition, ownership, and IntSights believes this is because of the volume
operation of hotel real estate. The table below of financial transactions that hotels carry out,
includes both types. use of loyalty programs, their database of
sensitive personal data and finally, their national
and international spread.
1-Year
Revenue Net Income Market Cap
Trailing Total Exchange
Put plainly, the bigger the organization, the more
(billion $) (million $) (billion $)
Return (%) of a target it becomes for hackers due to the
Marriott International volume of information held. And that’s
10.6 267 49.4 114.8 NASDAQ
Inc. (MAR) why cybersecurity is so important; protecting
Hilton Worldwide
4.3 715 35.2 98.5 NYSE your customers’ data should be a primary
Holdings Inc. (HLT)
InterContinental Hotels concern - right alongside safeguarding against
2.4 260 13.1 80.6 NYSE
Group PLC (IHG) COVID-19.[5]
Hyatt Hotels Corp. (H) 2.1 703 8.7 85.4 NYSE In this day and age, your customers will be more
Host Hotels & Resorts
Inc. (HST)
1.6 732 12.2 66.3 NASDAQ cybersecurity savvy, and this may impact their
Huazhu Group Ltd. choice of hotel.
1.5 307.7 18.2 94.3 NASDAQ
(HTHT) In May 2021, one of the leading hospitality
Wyndham Hotels &
1.3 132 6.8 145.3 NYSE chains claimed on hotel cyberattack: an
Resorts Inc. (WH)
Service Properties “unauthorized party” got access to the personal
1.3 311.4 2 162.6 NASDAQ
Trust (SVC) information of 150 million customers.
Extended Stay America
1 23.3 3.5 192.7 NASDAQ Unfortunately, breaches like these are a feature
Inc. (STAY)
Park Hotels & Resorts of life in the online age, and cases are rising.
0.852 -1400 5.2 203.5 NYSE
Inc. (PK) Cybercrime costs will grow to $6 trillion by
Total 27 2021.
Business becomes a cybercrime victim every 40
According to research and markets, the world’s seconds. There are more than 170 million
largest market research store[2], The global malware incidents per year. Earlier, hotel
hospitality market is expected to grow from management reported receiving a notification
$3486.77 billion in 2020 to $4132.5 billion in 2021 from an internal security tool specifying that
at a compound annual growth rate (CAGR) of someone had attempted to connect the hotel
18.5%, and Expected to Reach $5297.78 Billion in guest reservation database. The unauthorized
2025 Which mean that the growth at all segments in party had copied and encrypted guests’
the hospitality CAGR of 6%. information, including passwords, e-mail
addresses, departure/arrival dates, and passport
information. Unfortunately, this breach was only
1.2 A Hotel is Under Cyberattack
detected after the fact. The typical time to detect
The threat of cybercrime and data breaches has
a data breach is over 8.5 months.
never been so prominent. By 2021, damages
related to cybercrime is set to hit $6 trillion,
Hospitality industries plan to put more resources
according to Cybersecurity Ventures. In the
into security.
hospitality industry, hotel cybersecurity is a
There are several reasons why hospitality
matter that shouldn’t be taken lightly.
organizations have a more challenging time
That’s because security experts now estimate
securing their assets than similarly sized businesses
that cyberattacks cost businesses $1.6 million to
in different sectors.[6]
recover. And what’s scarier: in 2019, the
Hospitality industries have extensive networks.
average time it took to identify a breach was 7
A hospitality firm has several end-points, plenty of
months, according to IBM [3].
them located in publicly accessible areas. They also
A study by IntSights [4] found that in the past
use various automated systems for functions like
three years, the hospitality industry has had 13
venting and heating, which are just another entry
“notable data breaches”. They also looked into
point for attackers. Most hospitality businesses have
the dark web hacker forums (a section of the
large guest databases that are regularly accessed
internet that isn’t visible to search engines and
directly by a booking system by requirement. Any
requires an anonymizing browser to access) and
compromise into the reservation system will place
revealed that Hilton had 31% share of mentions,
the database in danger.
followed by Marriot at 28% and IHG at 19%.

Secure Hospitality Data - https://secure-stay.com/

 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
Hackers also, as clients might be on-site too -
Both airlines and hotels have clients on-site
constantly, providing the chance to receive direct
access to entry points to attackers. Many offer free
Wi-Fi services, together with Wi-Fi for the
company and employee usage. There is nothing
”wrong” with this. However, it needs additional
layers of safety to make sure no unauthorized access
is permitted to sensitive areas of a network.
1. Staff churn.
When you have high personnel numbers and high
churn, it becomes challenging to guarantee that staff
members are accurately trained to handle cyber
threats. Worse, it is common practice in the
hospitality sector to utilize group e-mail accounts
(e.g., Reception, Client Services, etc.), which are
shared with a constantly changing staff member.
This makes it impossible for proper password
change procedures. There is no wonder that
credentials for these accounts are often leaked via
the dark web.
2. Franchising.
Franchising is normal in the hospitality sector —
especially for resorts — and franchise owners take
responsibility for safety. Most franchise owners do
not always take the appropriate precautions to
protect sensitive assets and have minimal
comprehension of cyber danger.
3. Third-party risk.
Hospitality companies have significant ecosystems,
including a variety of technology suppliers and
partners. Possession or the transfer of digital assets
or information may open hospitality businesses up
to a considerable amount of risk. It can be tricky to
discover the risk profile of a third party –
significantly since every company’s profile will
change over time, and lots of businesses in the
hospitality sector don’t have a proper way to
measure how much risk they’re accepting when
picking and building connections with third parties.
Why is it essential?
According to statistics from the hospitality industry,
the average number of rooms per hotel in Europe in
2019 was sixty-two. With the occupancy rate for the
same period at around 72%, it’s easy to see why
hotels would be a prime target for hackers. The
sheer volume of people going in and out daily,
and more importantly, the amount of credit card
transactions being processed around the clock
every single day of the year, make for a much
bigger pay-day for the successful hacker.
Combine that with the amount of personal data
involved in hotel stays, and a successful hacker
could potentially get access to credit card details,
passport or ID numbers, and addresses. That
could result in not only fraudulent credit card
transactions but identity theft as well, the effects of
which are almost impossible to assess.
We live in what has effectively become a cashless
society. Compared to the norm from even a few
years ago, today’s consumers are much more likely
to make all their transactions via a credit card or an
app on their smartphone. Even the process has
changed. You don’t even need a PIN confirmation
for small purchases anymore, as contactless
payments have become such a normal part of our
life.
Our life has become much more connected. But,
unfortunately, all that connectivity gives hackers an
almost limitless number of access points to attack,
including Wi-Fi, Bluetooth, LANS, Cloud, hotel
security cameras, check-in and out systems, hotel
POS systems, and more. Every single one of these
could be an entry point for a hacker.
People go on holiday to relax. Hotel guests will
probably not be at their most diligent. Even
security-savvy individuals will likely let their guard
down a bit when on holiday, and that creates a
particularly tempting target for hackers.
It starts as a vast majority of room bookings tend to
be for short-stay visitors, who, typically, will use
credit cards for the bulk of their charges and use the
hotel’s Wi-Fi extensively.[7]
1. We are rapidly moving to a cashless society -
Most people carry more and more information on
their mobile devices. That could be banking or other
financial information, including credit card
numbers and personal information, including
sensitive identity information such as a passport or
ID copies.
2. Guests connecting to your hotel network are
potentially opening themselves up to what could
a severe privacy breach -
If your hotel Wi-Fi isn’t secure, guests accessing
their data over the network or even just using their
mobile phones could be exposing their data to any
hacker with access to your systems. If your hotel
cybersecurity isn’t up to the job, your guest data is
at risk.
3. The problem with hotel Wi-Fi or any hotel
system, for that matter, is that it has to be secure
while still being accessible for your guests to
connect to and use -
How many complaints would your front-office desk
get if you made your guests use sixty-four-character
passwords, for example? Your booking.com and
Agoda reviews probably would not be glowing!
Never mind that hotel guests are usually too busy
enjoying their holiday to pay any attention to extra
security steps.
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
4. All of the Sub-Systems links to the hotel
network - Booking and reservation systems, POS
in restaurants, coffee shops, bars, etc., So the
systems’ security will only ever be as strong as the
weakest link.
2. Hotel security – main data assets to
protect.
Even when hotels have robust security policies and
procedures in place, [8] they’re still vulnerable
to cyber-attacks, fraud, theft, and other crimes.
When guest’s check-in, they are probably more
worried about sightseeing or making meetings.
Security should not be on their heads during or after
their trip.
Technology is currently changing, improving, and
easing the traveling experience. However, to
permanently update the hotel’s cybersecurity, you
must stay aware of what is happening and track the
changes.[9]
1. Facial Recognition System
The main challenge for hotel managers and many
others within the hospitality sector looking to
implement facial recognition is balancing the
benefits with privacy for clients. Indeed, a lot of
customers have worries about facial recognition due
to the simple fact that it means more information
about them being gathered and stored by hotels.
2. Payment system encryption
The payment transactions must be end-to-end
encrypted. The number of a credit card will never
appear in the hotel installations, and the only
information that travels within the network is
scrambled. Encryption always needs an internet
connection, and a stable large-scale service must be
used to make the reliability of payment methods
more probable.
3. Service Automation
Self-service automation plans to put the decision-
making procedure from the hands of their guests
rather than hotel employees. This directly follows
tendencies that have been seen across several
businesses. Self-service kiosks, online enrollment,
targeted feedback surveys are now starting to take
center stage. Nonetheless, this isn’t to say that
conventional employees are eliminated from the
equation. Their services are rather being
strengthened with in-house automation.
4. Guest Apps
Smartphones have taken center stage in daily
communications. From chatting with friends to
answering e-mails and buying products on the
internet, the simple fact is that the ordinary
consumer has begun to rely upon these advanced
applications. This innovation hasn’t yet been lost
inside the hospitality industry. Hotels are now
creating their own choice of branded programs so
that guests may enjoy a much more excellent way
of correspondence and connectivity. Modern apps
provide features like virtual payments, 360-degree
hotel tours, and instant contact with a concierge.
5. Artificial Intelligence
It may be argued that AI represents the most
profound example of how hotel technology is
progressing. The best objective of artificial
intelligence is to provide guests with a smoother and
streamlined experience throughout their stay.
Artificial intelligence plays a profound role in resort
technology and, despite this technique, has just
lately entered into the mainstream market, and its
existence grows.
6. Big Data
Big data represents the capacity to collect, interpret,
disseminate, and react to essential information for
hotels. This is very important for large businesses,
which may cater to the requirements of tens of
thousands of visitors every month. Through a blend
of the information they collect themselves and
information available online, hotels can use huge
information (big data) that assists them with
revenue management strategy, identifying offers
that could suit specific travelers or hotel guests.
In summary, technologies are developing, and
cybercrime is developing along with them. In order
to be able to repel cyber-attacks and offer the best
hotel room security, stay up to date with the
innovations.
3.
3.1 Hotel Industry under ISO/IEC 27001
compliance
ISO/IEC 27001:2013 (also known as ISO27001) is
the international standard for information security.
It sets out the specification for an information
security management system (ISMS). The
information security management system
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances

standard’s best-practice approach helps 1. Identify stakeholders and their expectations of

organizations manage their information security by the company in terms of information security.
addressing people, processes, and technology. It is 2. Identify which risks exist for the information.
the leading international standard focused on 3. Define controls (safeguards) and other
information security, published by the International mitigation methods to meet the identified
Organization for Standardization (ISO), in expectations and handle risks.
partnership with the International Electrotechnical 4. Set clear objectives on what needs to be achieved
Commission (IEC). Both are leading international with information security.
organizations that develop international standards. 5. Implement all the controls and other risk
Certification to the ISO 27001 Standard is treatment methods.
recognized worldwide to indicate that your ISMS 6. Continuously measure if the implemented
has aligned with information security best practices. controls perform as expected.
Part of the ISO 27000 series of information security 7. Make a continuous improvement to make the
standards, ISO 27001 is a framework that helps whole ISMS work better. This set of rules can be
organizations “establish, implement, operate, written down in the form of policies, procedures,
monitor, review, maintain and continually improve and other types of documents, or it can be in the
an ISMS.” form of established processes and technologies that
are not documented. ISO 27001 defines which
The latest version of the ISO 27001 information documents are required, i.e., which must exist at a
security standard was published in September 2013, minimum.
replacing the 2005 iteration.
What is the purpose of ISO 27001?
ISO 27001 was developed to help organizations of
any size or industry protect their information
systematically and cost-effectively through
adopting an Information Security Management
System (ISMS).
Why is ISO 27001 important to the Hospitality
industry?
Not only does the standard provide organizations
(either Hotels or companies) with the necessary
know-how for protecting their data and their
customers/clients’ most valuable information, but a
company can also get certified against ISO 27001
and, in this way, prove to its customers and partners
that it safeguards their data.
Individuals can also get ISO 27001- certified by
attending a course and passing the exam and, in this
way, help their organization to be recognized and
well protected. In addition, because it is an
international standard, ISO 27001 is easily
recognized worldwide, increasing business
opportunities for organizations and professionals.

What is an ISMS?
An ISMS is a holistic approach to securing the
confidentiality, integrity, and availability (CIA) of
corporate information assets. It consists of policies,
procedures, and other controls involving people,
processes, and technology. Informed by regular The framework of ISMS Process
information security risk assessments, an ISMS is
an efficient, risk-based, and technology-neutral What are the 3 ISMS security objectives?
approach to keeping your information assets secure. The basic goal of ISO 27001 is to protect three
An Information Security Management System aspects of information:
- Confidentiality: only authorized persons have the
(ISMS) is a set of rules that an organization needs
to establish to: right to access information.

Secure Hospitality Data - https://secure-stay.com/

 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances

- Integrity: only authorized persons can change the security controls, and countless security checklists,
information. benchmarks, and recommendations.
- Availability: the information must be accessible So, we have a better understanding of the threat, as
to authorized persons whenever it is needed.
there is the emergence of threat information feeds,
reports, tools, alert services, standards, and threat
3.2 Hotel Industry under CIS V7.1 compliance sharing frameworks. To top it all off, security
requirements, risk management frameworks,
When a guest chooses your hotel, there’s a high
compliance regimes, regulatory mandates, and so
volume of trust involved. Clients trust that the bed
forth are required. Thus, there is no shortage of
they’ll be sleeping in and the toilet they’ll be using
information available to security practitioners on
are clean at a core level. Additionally, they trust that
what they should do to secure their infrastructure.
their favorite and private goods are secure inside the
hotel and the hotel room security has the best level.
If they have any reason to doubt these basic
requirements, they’d probably staying elsewhere.
In the present technological revolution, an
individual may feel that the hospitality sector has
entered the golden era. But instead of a futuristic
renewal and renaissance, hoteliers are experiencing
declining data safety issues.

The CIS Controls™ is a prioritized set of actions

that collectively form a defense-in-depth group of
best practices that mitigate the most common
attacks against systems and networks. The CIS
Controls are developed by a community of IT
experts who apply their first-hand experience as
cyber defenders to create these globally accepted
security best practices. The experts who develop the
CIS Controls come from a wide range of sectors,
including retail, manufacturing, healthcare,
education, government, defense, and others.
As we are at a fascinating point in the evolution of
what we now call cyber defense. Massive data - A family-owned business with ~10 employees
losses, theft of intellectual property, credit card may self-classify as IG1;
breaches, identity theft, threats to our privacy, - A regional organization providing a service may
denial of service – these have become a way of life classify itself as IG2; or
for all of us in cyberspace. - A large corporation with thousands of
employees may be labeled IG3.
As for defending main organization assets, there is
a need to have access to an extraordinary array of Most of the Hospitality industry, by its nature,
security tools and technology, security standards, categorized under class IG3 as the daily Data and
training and classes, certifications, vulnerability Guests Traffic and data sensitivity complied the
databases, guidance, best practices, catalogs of amount of “thousand”. Nevertheless, some are

Secure Hospitality Data - https://secure-stay.com/

 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
“Small-Mid” size or related to the “Boutique”
category and will be under IG2 compliance.
3.2.1 All Layers Security
The main of the described above usually involved
attacks on several layers which need to be protected.
Some of the known cyber-threats due to
Cybersecurity vulnerabilities include:
- Phishing attacks
- Ransomware
- Distributed denial-of-service (DDoS)
- Remote hacking through third-party vendors/point
of sale malware
- Botnet attacks
- Man-in-the-Middle (MiTM) attacks
- Location tracking and call interception
- More…
As to face with the daily cyber-attacks and threats
on the highest level, new there is a need to give a
well protective infrastructure and environment for
all layers:
3.2.2 Layers 1-4: Data 2 Local Area Network
(LAN) Security
Data security is among the most challenging tasks
for hoteliers. Every year, hotels of all sizes invest a
sizable part of the IT security budgets protecting
their businesses from hackers’ intent to access
information through brute force, exploiting any kind
of vulnerabilities.
3.2.2.1 Data security is a trend for the hotel
industry.
Data security is a critical part of cybersecurity. First,
breaches will cost millions of dollars, including
government fines and loss of reputation.
Data protection has countless aspects that protect
data at rest, in use, and in movement. Below are
several technologies widely used by businesses to
safeguard information. But, first, let’s have a quick
look at types of data security:
3.2.2.1.2 Data loss prevention
DLP prevents users from transferring sensitive
information, and organizations may roll out it as a
business security program. DLP technology
provides a mechanism to help guard against a
sensitive information loss – and consequently
could be a mitigating element when dealing with
compliance agencies in the track of a data breach.
Therefore, DLP has come to be a top IT spending
priority.
Data security will remain a vital challenge in the
future, but modern cybersecurity companies will
always help you stay current.
3.2.2.1.3 Encryption
Among the basic concepts of data security is
encryption, as just encrypting sensitive
information may go a long way toward meeting
privacy and compliance mandates. However,
organizations need to choose the encryption
algorithm which matches their business security
conditions because encryption is not a one-size-
fits-all proposition. The most typical encryption –
symmetric – entails converting plaintext into
ciphertext with the same key for encryption and
decryption. Asymmetric encryption uses two
interdependent keys, one to encrypt the data and
you to decrypt it as x.509 security and key
management methods.
3.2.2.1.4 Tokenization
Credit card data protection is a priority in hotel
cyberattack prevention. Hotel’s experience
challenges in protecting the card information. The
main problem is the necessity to keep card data for
later charges. Storing credit card data should
always be avoided.
Hotels must use a card processor that implements
a tokenization service. With tokenization, when
the hotel transfers credit card data to be
authorized, they send back the permission and a
token that can be used for later charges. Even if
the token is compromised, it is only useful for
transactions between that client and that hotel, so
it is secure to be stored.
3.2.2.1.5 LAN Protection
Wi-Fi is typically a weak link in a hotel’s
cybersecurity. There is no isolation between the
devices connected to the hotel network, meaning
every guest can potentially be exposed to cyber-
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
attacks. Since the Wi-Fi password is visible, hackers
could easily gain access, infect the entire network,
and spy on the traffic of all the guests. As such,
Hotel owners should consider an investment into
hotel network security to be essential and not an
extra cost. The security includes setting up firewalls
and WPA2 encryption.
3.2.3 Layers 4- 6: Perimeter 2 Wide Area
Network (WAN) Security
Intrusion detection systems and intrusion
prevention methods (IPS/IDS), together with access
control lists (White/Blacklists), stronger a hotel
security perimeter and lower the possibility of
attacks that undergo. Meanwhile, security
management can monitor malware signatures and
prevent them from causing injury.
3.2.3.1 Types of perimeter security systems
1. CCTV Security System
2. Access control systems
3. Ground Radar Systems
4. Local and remote servers
5. Mobile devices
3.2.3.2 End-to-end encryption
The usage of a payment system that’s end-to-end
encrypted also can help protect the transaction. With
that plan, the card number is not present inside the
POS or hospitality system, and the data that goes
across the network is encrypted. Encryption,
however, requires a link between the two ends so
that they can negotiate the encryption key that is
derived.
Due to tokenization and encryption, the hotel’s net
connection must stay up constantly.
No payments could be processed if the web is down.
It is necessary to get support to maximize the
payment systems ’reliability. Therefore, it is
essential to have a dual-WAN or SD-WAN
broadband service to optimize the safety of payment
systems as well as cloud infrastructure and WAF
and DBWAF protections.
3.2.3.3 Addressing vulnerabilities.
At all hotels, the hospitality administration system
functions as a central hub for payments. In addition,
the point-of-sale systems for restaurants, stores, or
other services demand communication paths back to
the hospitality system, where protected information
is collected. This presents several weak points
where a cybercriminal can find their route into the
hotel’s storehouse of data. There are two safe ways
to keep data protected:
- First, designing the network with company
segmentation and particular pinholes between
network devices to ease the circulation of
information.
- Secondly, there has to be a stateful review of
their traffic between segments to detect anything
that might be trying to collect data or send it
outbound. Just about any hotel chain has a loyalty
platform in which data is stored in the cloud or a
data center. It’s strongly suggested to utilize
encrypted connectivity between websites to avoid
that information being intercepted. These can be in
the form of SD-WAN, an MPLS Network, or
direct Virtual Private Network connections.
3.3 PCI Compliance and General Data
Protection Regulation (GDPR) [11]
Nowadays, hotels store massive amounts of data.
Every hospitality brand needs to take steps to
protect itself from hackers. Hotels have customer-
sensitive information such as credit cards and e-mail
addresses or personnel information such as
employee Social Security numbers and other
details.
The European Union’s new General Data Protection
Legislation, called GDPR, requires businesses to
capture and manage customer data in entirely new
and intricate ways. It requires that they socialize
with clients based on very specific and time-
consuming requirements and respect their privacy
rights and freedom. Despite where they’re
headquartered, organizations with EU-based
customers or prospects need to comply.
Additionally, they must appoint a representative
within the company to assume whole responsibility
for fulfilling GDPR’s many requirements.
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
- For many companies in the hospitality
business, either CIS or PCI compliance is required.
You just can’t expect your visitors to give you their
private information without safety assurance.
- GDPR, or The General Data Protection
Regulation, is essentially a law that addresses data
privacy and protection for everybody that resides in
a country that’s a member of the European Union.
Essentially, it regulates any type of private data that
is exported out of the EU.
- Every internal and external account must be
appropriately encrypted. Unfortunately, encryption
can be hacked too, but encrypted network devices
can’t be breached as easily as those without any
level of security at all.
3.3.1 Building a cybersecurity culture.
Today a hotel Wi-Fi is public access network, and
employee computers allowing access into this cloud
database. All those factors higher the worries about
cybersecurity in the hospitality sector. Despite
security measures in place, the hotel network may
continue to be vulnerable. The only reliable way to
stop cyberattacks initially is a holistic strategy that
includes both trustworthy technology and
cybersecurity awareness. Ensure all your workers
are well trained to utilize hotel software and the web
in a secure and responsible way.
3.3.2 Reliable software
If guest information is being saved on the cloud, you
cannot do much about keeping it secure. Each
reputable hospitality software company that
provides cloud-based hotel PMS solutions provides
24/7 technical assistance and performs routine
software maintenance for your benefit.
These firms are maintenance and safety specialists.
But you should keep an open dialogue with their
technical assistance, remain informed about their
detection and prevention services.
3.3.3 Does this apply to my hotel business located
outside the EU?
GDPR applies to information collected and stored
on EU citizens, wherever they are in the world. It
will have an impact on the whole global hospitality
industry.
The hotel market is very vulnerable to information
threats on account of the numerous factors of (1)
payment, (2) e-mail, (3) internet booking systems
and (4) files comprising card information. A rather
large quantity of charge card transactions occurs
daily. Every single guest’s information may
frequently be saved long-term. Ordinarily, a hotel
database may hold guests’ names, addresses, and
dates of birth, credit card information, passport
information, etc. This is a good deal of sensitive
information that may be utilized fraudulently.
Couple that with information obtained from several
resources, such as point of sale programs, third party
reservations, e-mails, own website inquiries, and
walk-ins, hoteliers are a simple target for cyber
offenders.
3.3.4 A person’s rights and hotel response
It is a hotelier’s duty to recognize that information
belongs to the guest and specify a core data security
policy. Here are some individual rights under the
GDPR and what actions you can take to guarantee
compliance:
3.3.4.1 The right to be informed - Clearly
describe what data you are collecting, why, and for
how long.
3.3.4.2 The right to access and modify data -
Give access to personal data promptly, in a simple
format, and edit on request.
3.3.4.3 The right for data deletion - Respect the
individual’s rights against public interest when
receiving a deletion request and delete where
relevant.
3.3.4.4 Hotelier’s steps to action - Hoteliers need
to initiate action immediately to support data
security and avoid the risk of breaches.
3.3.4.5 Be Clear and Transparent
3.3.4.5.1All data collection must meet GDPR
conditions.
3.3.4.5.2 Collect the minimum amount of data
demanded that purpose.
3.3.4.5.3 The user must be notified of the
purpose of data collection and the time of
processing.
3.3.4.5.4 Only use the data for that allowed
purpose.
3.3.4.5.5 Store data for a restricted period and
then delete it.
3.3.4.5.6 Data must be kept in appropriate
security, which includes protection against
illegal processing or accidental loss.
3.3.4.5.7 Confirm your compliance with
GDPR – Companies must be able to show
documents that prove their compliance with
GDPR.
3.3.5. Report Keeping
3.3.5.1 Build a clear guideline for how PII
is collected and handled. A hotel must
follow technical and organizational reports
to prove it is protecting data and have that
ready to show.
3.3.5.2 Mark on your website – to enable
your hotel to store PII data. Describe the
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
process and allow access and modification
or deletion.
3.3.5.3 Know the location of all PII held
and guarantee strict guidelines in
accordance with the hotel data protection
policy.
3.3.5.4 Ensure effective security systems
are in place for the highest data protection.
3.3.6 Regular Training
3.3.6.1 Every staff member in your
organization who deals with Personal Guest
Information should be informed of GDPR.
Hotel staff must be informed of how to
collect, access, use, and disclose personal
information.
3.3.6.2 Additionally, how to limit access to
cardholder data. Employees must also be
notified on how to create solid passwords
and know-how to accurately dispose of
records containing payment card data.
3.3.7 PCI Compliance and GDPR
If you’re already PCI compliant, then this
accreditation places the basis for GDPR
compliance. To be PCI DSS compliant, a hotel
must have taken proper steps when processing
payments. Secure stay can consistently help to
deal with this.
4. Findings and Results: Practical Steps to
How Hoteliers Can Improve Privacy and
Data Protection [12]
Most of the Cyber virtual attacks are focused around
these next top five areas:
1. Remote hacking through third parties –
Cybercriminals might break in through a remote
access point. Hotel IT representatives should
control vendor access to sustain a constant
observation of all activity coming from the third
party. The largest data breach was performed by
third-party vendors when hackers obtained access to
more than 70 million credit cards.
2. Phishing scam-
Some fake websites pose legitimate booking
websites while trying to obtain guests’ personal
information and credit card information. Also, hotel
owners are being tricked into a similar scam when
they pay fees to fake websites. These days it is
important to make sure that the websites used both
by customers and hotels are legitimate and are not
run by hackers.
3. Ransomware –
Hotels are at risk when it comes to ransomware
attacks. As we mentioned earlier, hotels use PoS
systems with applications that are not as secure as
modern payment systems. There are other
weaknesses hotel systems have that might cause
ransomware attacks.
4. Access to personal information through guest
Wi-Fi – The attack is called “man in the middle,”
and it imitates a legitimate Wi-Fi access point. It
allows cyber criminals to view all the online activity
of users of this fake connection. It includes their
logins to banking systems, entering credit card
information on websites, or reading e-mail. It also
happens that hackers incite users of guest Wi-Fi
networks to visit websites that are actually scam
versions of original websites. They gain more
access to guests’ personal devices when
cybercriminals trick users into installing so-called
“critical” updates.
There are now enormous amounts of private data
shared online. As a result, client privacy and data
security have become significant issues in industries
worldwide, including hospitality.
Data Inspection processes
The very first step is to comprehend all the private
information your property accumulates, why it is
gathered, how the information is stored and
managed, who of your team gets access to it, and
some other outside partners or providers suppliers
with whom the information is shared (and what are
their policies and safety methods are). Identify the
manager who’s in charge of privacy and
information security in your hotel.
This can provide you a beginning point to
understand what things you might want to alter to
guarantee compliance with all the CIS V7.1/GDPR
and how you can normally improve procedures,
reduce information collection, and enhance
security.
An assessment of IT infrastructure and safety
[13]
Stay assured that your data is protected. Have you
got relevant security systems that minimize the risk
of external access (hacking) to sensitive information
and prevent access to data by staff members that
should not access it? Even though there’s absolutely
no way to eliminate hotel cyberattacks, there are
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
lots of practical measures to guarantee guest
information storage.
Guarantee data transparency and guest control
Ensure data transparency by establishing clear
privacy policies, communicating them to guests,
and making sure that employees take them. Reduce
the amount of unnecessary information gathered
and stored and make sure that the processes are set
up for guests to ask that their information be deleted
or request copies of the information.
Train the staff on cybersecurity processes.
Compliance with all the GDPR and CIS V7.1 will
need staff training and the execution of procedures
and the policies set from the laws[14]. A number of
these resources will give more detail. It is crucial to
develop a culture that respects guest privacy and
considers data security at every level. IT
infrastructure is ever-changing. That’s why
continued monitoring is required to ensure that
processes are kept up to date.
It is often the case that hotel employees accidentally
provide access to hackers, although, with proper
training, the chances are enormously lower. Stuff
training needs to be done in order to avoid such
incidents and protect the hospitality business. They
have to keep up with the security standards and
compliance rules and understand all applicable
documentation:
1. Establish the cybersecurity needs for your
hotel needs - Outlining your needs is the first step.
Next, a suitable training package should meet your
industry and company needs. You may need to set
up a separate program for different departments. For
example, the staff that has access to computers
should be trained on how to detect phishing. Most
likely, you will have to conduct simulated exercises
for better results.
2. Include cybersecurity training during the
hiring process - The training for the hotel staff
cannot and should not wait. Data breaches or other
cyberattacks may occur at any given moment, and
new employees are the most vulnerable to them.
Providing training during onboarding will help you
make sure that there are fewer weak spots. Staff
members should understand that cybersecurity is a
fundamental issue. Encourage them to use the given
tips to protect not only company technology but also
their personal devices.
3. Make employees ’cybersecurity education a
continuous process - Conduct instructions
regularly so your staff will always be on guard. This
way, your employees will always be ready for an
attack. You may send them e-mails with
cybersecurity precautions, so your hotel safety is
always on their mind.
Insider dangers
Staff members might purposely share hotel data
with third parties. Such data breaches are more
difficult to identify as the access can be granted to a
hacker by an employee. For that purpose, there is a
need to:
1. Restrict access to downloading software to the
staff’s computers, minimize web browsing on
company laptops and PCs that hold sensitive
information, instructing staff to use strong
passwords, and identify potential malware.
2. Hold employees accountable for their adherence
to the cybersecurity policy.
3. Provide access to the company’s systems only to
a small number of staff members.
4. Ensure that your employees can access only as
much information as they need to get their job done.
5.Conclusion, Implications, and
Recommendations
This article aims at emphasizing the importance of
cybersecurity for the hospitality industry. The study
discusses the tools and techniques that can help
prevent cyberattacks in the hospitality industry[15].
Findings and results from this study reveal some of
the main causes that create security vulnerabilities
for the hospitality industry. However, due to the
sensitivity and confidentiality of the topic, the
authors certainly cannot figure out many other
factors during the interviews that may affect the
information security of hotels.
After reviewing many academic and professional
resources, we summarize five significant risks and
challenges that hotels have faced so far.
As noted by Neda Shabani and Arslan Munir [16],
these five challenges are:
1. Identity theft leading to credit card fraud
has caused many data breaches and information
stealing from hotel’s network systems.
2. Silent invasions are cyber-crime attacks that
employ powerful tactics such as social
engineering (e.g., phishing) and recently
advanced persistence threats (APTs) that bypass
the defenses in place by hotels.
3. Most hotels have either no security audit or
longer security audit cycles that put the investors
and guests at high risk for security attacks.
4. Physical crimes like terrorism put hotels at
risk.
5. Loss of competitive advantage and negative
outlook that hotels experience after cybersecurity
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
attacks.
In general, cyber-attacks can occur in any of the
following three forms:
1. The intruder may obtain unauthorized access
to the network.
2. The intruder may destroy, otherwise corrupt,
or alter the data.
3. The intruder may acquire fake permission
for t h e system user and then implement some
malicious procedures to fail, hang, or reboot the
system.
There are many implications and
recommendations available for users in the
hospitality industry to take advantage of.
However, in this paper, we present a few
important ones.
Checking a website domain and secure socket
layer (SSL) certification of websites plays a
significant role in the Internet era. Users must be
cautious in entering their personal and financial
information on websites. We suggest a few tips
and advice for hotel customers while traveling
and especially during the hotel stay: (i) not use
online banking on public computers and public
Wi-Fi, (ii) not access e-mail inbox when traveling
and connected to an unsecured Wi-Fi, (iii)
prevent computer or smartphone from automatic
connection to unknown Wi-Fi networks, (iv) use
remote desktop applications instead of saving
sensitive information on the laptop or smartphone
when traveling, and as well as utilizing WAF
upon the WEB application Server and DBWAF
before the customers’ data (v) utilize a VPN
network for browsing and entering personal
information on websites when connected to an
unsecured Wi-Fi network (vi) complying with all
compliances and standards (CIS v7.1, ISO27001,
GDPR) as well as cybersecurity communities.
Research has shown that hotels with loyalty
programs are more vulnerable to security attacks
because attackers know that these hotels have
access to more consumer data than those that do
not have this program. Thus, the information of
guests and customers of the hospitality industry
who are members of these loyalty programs is
more vulnerable. Managers of those hotels can
take a few measures to protect the information
and data of loyal customers:
1.Giving the customers information about the
possibility of being hacked by cyber attackers and
advise/notify them to regularly change their
passwords. Further, managers can inform the
customers to avoid using the same password for
several websites. Also, customers can be
informed to check and monitor their account
activity more often. Managers can also reward
customers for being security cautious.
2. Sending the customers an automatic e-mail and
notification in case of a password change or login
to their account. If they have not logged in to their
account or change the password, they can
immediately be aware of potential abuse and
report it.
3. Empowering the system to employ two-factor
authentication so that for log- going into
accounts, in addition to providing username and
passwords, guests would also be required to
submit the security code that they will receive on
the same e-mail address or phone number that
they provided while singing up for the account.
Hence, in case of attempted masquerade attacks,
a cyber attacker will not be able to access the
account if they do not have the e-mail account or
the phone (number) that the account was
registered with as the attacker will not be able to
acquire the passcode sent by the authentication
system.
There are various tools and techniques available
to scan the vulnerability of the computer system
and network. The hotels can utilize these tools
and techniques depending on the affordability to
protect guests’ data and personal information.
Furthermore, it is advised that each hotel should
have a contract with an IT company or a
dedicated IT manager whom the hotel trusts so
that the hotel computer systems and networks are
security audited on a regular basis. Additionally,
hotels should dictate internal regulations and
policies for the hotel’s employees regarding
cybersecurity and computer network usage. The
hotels should also have a cybersecurity training
program for employees whose job is computer-
related and are tasked with handling e-mails and
social media.
Furthermore, hotels must have a secure and
certified website that leverages extended
validation or at least domain validation. The
guests must book the rooms or amenities
provided by the hotel online without being
concerned about being hacked or abused. Finally,
the hotels should acquire cyber insurance to cover
the loss and liabilities if the hotel experiences a
data breach or cyber-attack.
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances

References
12. Hiller, S.: Top 5 Risks and Security Challenges
for Hotels in 2015
1. https://www.investopedia.com/articles/investing/0
https://insights.ehotelier.com/insights/2015/01/22/
61015/top-5-most-profitable-hotel-companies.asp -
top-5-risks-and-security-challenges-for-hotels-in-
MAR, HLT, and IHG lead the 10 biggest hotel
2015/ (January 2015), Last visited on December 26,
companies and REITs list
2019
2. https://www.globenewswire.com/news-
13. Kansakar, P., Munir, A., Shabani, N.: A Fog-
release/2021/06/08/2243615/28124/en/Global-
Assisted Architecture to Support an Evolving
Hospitality-Market-Report-2021-Market-is-Expected-
Hospitality Industry in Smart Cities. In: Proc. of the
to-Reach-5297-78-Billion-in-2025-Forecast-to-
16th International Conference on Frontiers of
2030.html
Information Technology (FIT). IEEE, Islamabad,
Pak- istan (December 2018)
3. Bilgihan, A., Karadag, E., Cobanoglu, C.,
Okumus, F.: Research Note: Biometric Technology
14. Kansakar, P., Munir, A., Shabani, N.: Technology
Applications and Trends in Hotels. FIU Hospitality
in Hospitality Industry: Prospects and Challenges.
Review 31(2), 1–18 (2013)
IEEE Consumer Electronics Magazine 8(3), 60–65
(May 2019)
4. Hotel Cybersecurity: A Guide to Avoiding Threats
August 21, 2020 Hospitality Technology; By Olivia
15. Rusch, J.J.: Computer and Internet Fraud: A Risk
Cal; https://www.cvent.com/uk/blog/hospitality/hotel-
Identification Overview. Elsevier Computer Fraud &
cybersecurity
Security 2003(6), 6–9 (June 2003)
5. Butler, J.: Not Just Heads In Beds –
16. Neda Shabani and Arslan Munir, A Review of
Cybersecurity for Hotel Owners. https://
Cyber Security Issues in Hospitality Industry. Kansas
www.hospitalitynet.org/opinion/4073687.html
State University, Manhattan, July 2020
(2016), Last visited on December 26, 2019

6. Clark, C.:The Serious Cyber Security Threat That

Could Hurt Hotels
http://www.pcma.org/news/newslanding/2015/04/13/
the-serious-cyber-security-threat-that-could-hurt-
hotels#.VqhHLGCZaJV (2015), Last visited on
February 26, 2016

7. Cobanoglu, C., Demicco, F.J.: To Be Secure or

Not to Be: Isn’t This the Question? A Critical Look at
Hotel’s Network Security. International Journal of
Hospitality & Tourism Administration 8(1), 43–59
(2007)

8. Collins, G.R., Cobanoglu, C., Bilgihan, A.,

Berezina, K.: Hospitality Information Technology:
Learning How to Use It. Kendall Hunt Publishing
(2017)

9. Eubanks, N.: The True Cost Of Cybercrime For

Businesses. https://www.
forbes.com/sites/theyec/2017/07/13/the-true-cost-of-
cybercrime-for-businesses/ #764083449476 (July
2017), Last visited on December 26, 2019.

10. Greenberg, A.: Cybercrime Checks into Hotels.

https://www.forbes.com/2010/02/01/cybersecurity-
breaches-trustwave-technology-security-hotels.html#
4f1684853c8c (2010), Last visited on December 26,
2019.

11. Hahn, D.A., Munir, A., Mohanty, S.P.: Security

and Privacy Issues in Contemporary Consumer
Electronics. IEEE Consumer Electronics Magazine
8(1), 95–99 (January 2019)

Secure Hospitality Data - https://secure-stay.com/

 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
Appendix A: Case Study
1. Choice Hotels Data Breach
The Choice Hotel chain does seem to have an
unhappy (or very happy – depending on your point
of view, of course) relationship with data security,
over the last few years, the chain has been the victim
of at least two data breaches of varying magnitude
and severity, involving different entry points.
Data breaches at the Maryland lodging giant have a
far broader impact than their hotel guests. Choice
Hotels manages bookings for over seven thousand
hotels and properties around the world. These
bookings include major hotel and hospitality chains
such as:
- Ascend Hotel Collection
- Cambria Hotels
- Clarion, Comfort
- Econo Lodge
- MainStay Suites
- Roadway Inn
- Sleep Inn
- Woodspring Suites
In December 2019, an unsecured database exposed
guest data after a metasearch engine indexed the
database contents. The data set included full names,
e-mail addresses, and home phone numbers. The
irony was the data breach happened during a
planned security data test run!
According to Choose Hotels, approximately 5.6
million records were affected, but only 700,000 of
these had to do with real guest information. The
bulk of the exposed data comprised dummy
information the chain had created specifically for
their security test run. That may well have been the
case, but even if that was the situation, Choice
Hotels should have secured or excluded any real
guest information from what a trial of an untested
system was.
A subsequent investigation into the breach by
cyber-attack protection researchers discovered a
ransom note, purportedly from a hacker, who
claimed the 700,000 exposed records had been
backed up and demanded approximately $4,000
from the hotel chain to delete his files.
An earlier data breach incident at the hotel chain
involved a technical issue on one of Choice Hotel’s
websites, which left guest information accessible to
hackers.
Visitors to the hotel website using the Safari
browser left their entered information exposed to
third parties. This exposure only occurred if the
Safari browser crashed, but it seems to have been
quite a frequent event, taking place approximately
88,000 times from June 2015 through November
2019. Choice Hotels did identify the guests involved
and notified them of the data breach for their further
action.
Nobody needs this kind of publicity. With hotel
guests increasingly sharing their experiences on
online review boards, the effects of a data breach
can be costly and very far-reaching. An ounce of
prevention is worth a pound of cure, so drop us a
line and let our security experts show you how to
keep your data safe and secure!
2. Cyber Security Threats in Hotels And Lessons
We Learned
The hospitality business represents a profitable
target for hackers cyberattacks: Hotels, casinos, and
restaurants are interesting to cyber thieves as they
frequently handle large amounts of financial
transactions containing client information.
Compared to banks and insurance companies which
handle similar information, restaurants and resorts
aren’t bound by regulations to maintain the
maximum safety standards. Moreover, they don’t
have the resources to develop the optimal cyber
defenses. Therefore, it’s not surprising that the
hospitality industry ranks highly in the “Data
Breach” listing.
The hospitality industry, restaurants, and casinos
experience crises in cyber defense for a long
time. Let’s have a look at the most resonant cases
(includes phishing attacks, hacktivism, malware,
and identity theft) that have occurred over the past
few years.
a. 2016: Kimpton Hotels and Restaurants
Malware on the point of sale
Kimpton Hotel and restaurant is a part of the
Intercontinental Hotels Group (IHG) declared that
their payment terminals had been harmed by
malware. In this way, the guest’s credit card
information might be compromised. Later, the
company determined and removed the malicious
software that took credit and debit card details. But
who knows, it wasn’t too late.
b. 2017: InterContinental Hotel Group
Remote installation of malware on point-of-sale
InterContinental Hotels Group Plc (IHG.L) claimed
1,200 hotels in the United States, including Crowne
Plaza and Holiday Inn, were victims of cyber-
attacks for 3 months. In that period, cyber thieves
attempted to steal customer payment card data. The
expertise conducted by an independent cyber
defense team revealed that criminals were able to
install malware on the servers that the hotels’
payment card processing systems relied upon,
which in turn collected the data contained in credit
card tracks such as card numbers, cardholder names,
and verification codes. Such information may well
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
be used to make fraudulent payments through
cloned cards.
c. 2018: Marriott International Hotel Chain
Eavesdropping attack
The Marriott International Hotel chain faced an
enormous security breach. Sensitive data of 500
million hotel guests globally was stolen and
exposed.
This compromised information had details
regarding credit cards, passports, and birthdays. By
2018, it had been among the biggest data breaches
reported in the media. However, the most
frightening fact about this story is when the
criminals had access to the network – about 4 years.
Cyber analysts discovered weaknesses and
vulnerabilities while the Starwood reservation
system had merged with the Marriot chain.
Lessons we learned.
As we know from the above-mentioned cases, many
cyberattacks against the hospitality industry follow
a common pattern: sending malware or viruses via
e-mail.
The Marriot resort chain might have been alerted to
unusual entry action, even prior to the Starwood
merger. Utilizing automated analysis tools,
organizations could ascertain whether the source of
the attack was external or internal. Suspicious links
that are not easy to detect with human intervention
would have averted malicious malware at the
Kimpton hotel instances. Smaller hospitality
companies with limited human resources need to
put money into highly automated, artificial
intelligence and machine learning options which
may imitate specialist analysts and operate round
the clock to restrict unauthorized remote access,
enhance network security and protect against
infiltration of IoT apparatus and systems.
The matters of regulations remain unsolved. With
the huge degree of financial transactions and their
vulnerabilities due to millions of travel websites, it’s
the right time to get regulated at the same level as
the financial industry.
3. The security team for demonstrating hacking
vulnerabilities in 2019
In a recent hotel cyberattack simulation, our attack
team managed to take full control of the hotel just
from the minibar’s network connection. This is how
it was done:
1. Our attack team connected their computers to the
minibar’s ethernet port. They discovered a router
and managed to gain access to it by guessing its
password.
2. From there, they managed to jump to the
corporate network and breach their way into the
corporate structure of the network.
3. During the reconnaissance, they also managed to
gather several user accounts with their credentials.
4. Eventually, one of the harvested credentials led
the attacking team to an internal server in the hotel
network, which was managing the PMS system of
the hotel. The attacking team now had full control
of the hotel’s network and could make bookings,
control the smart TVs of all of the rooms in the
hotel, and extract sensitive guest details.
Appendix B: Why cybersecurity matters in
hotels.
In an era in which personal data is worth more than any
bank heist, industries processing massive amounts of
personal information are the preferred target for
cyberattacks.
Hackers breaching systems in the hospitality and tourism
industry are reported regularly, as the amount of
information processed through the industry’s systems
daily makes them a major target.
The data processed by the industry is a gold mine
for cybercriminals looking to carry out credit card fraud
and identity theft crimes, as the information customers
provide to hospitality companies often includes a copy of
the client’s passport, including its full name, address,
date of birth, country of origin as well as its e-mail, and
credit card details – to name only the most frequently
gathered and documented details.
Although credit card data seems the most coveted,
personally identifiable information (PII) is considered the
most valuable.
Failing to guarantee your guest’s confidentiality and data
safety would cause major detriment to your organization,
whether it be to its reputation, legal or financial standing.
Published research from Cisco determined that 22% of
breached companies lost clients following the attack,
showing just how seriously customers take the
commitment of a company to secure their data.
It is estimated by The World Tourism Organization
(UNWTO) that by 2030, there will be approximately 1.8
billion international tourists crossing borders; keep in
mind that these numbers don’t include local tourism.
With these numbers in mind, the understanding of the
need for immediate actions regarding handling the
gargantuan amount of data that is being collected,
processed, and safeguarded becomes clear.
Typically, when you think about cybersecurity, virus
attacks through malicious malware come to mind.
Despite these common security threats, human error
remains the underlying concern for business owners.
In fact, according to Decode the Human Threat, only
18% of data breaches are caused by an external threat,
and up to 82% of all cyber-attack claims are due to
human error.
1. The primary factor of security breaches: human
error
The business structure of the hospitality industry is often
built out of complex ownership collaborations, consisting
of a management company that runs the business, a group
of owners, and often a franchisor.
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances
Each of the entities above is storing crucial data in
different computer systems, moving it around frequently,
and possibly sharing it with different external third
parties.
This complex ownership structure is on its own a possible
source of breaches, as proven in the case of the Wyndham
Worldwide breaches, which occurred back in 2008 and
2010: by gaining access to the entire corporate network
of the organization, hackers stole credit card and other
details about customers resulting in $10.6 million in
fraudulent charges.
As the primary form of payment in the hospitality
industry is a credit card, infecting point-of-sale systems
with malware is one of the preferred practices of hackers
to reach a massive amount of credit card details.
The breach doesn’t need to occur remotely. It can very
well be carried by affecting an unattended device and
spreading the virus to the whole computer system from
that one location.
Protecting this sensitive data becomes particularly tricky
when considering that when talking about keeping
personal data safe, human error is the number one
reason for breaches. It implies that business owners must
invest more in employees, both through the provision of
education & awareness; a full reeducation needs to be
carried amongst all personnel and third-party service
providers. In addition, recurrent training programs and
new Protocols need to be implemented as well.
Considering that one-third of hospitality business owners
admit to not having protocols or even policies in place to
store and dispose of confidential information stored on
devices, enforcing policies for document destruction and
their digital storage is the first step in creating a more
secure line of protection for customer information.
These numbers should be a great source of concern for
customers who trust these hosting companies with their
sensitive information, and this should be a strong
incentive for those brands to protect their clients and
understand that although 36% of them believe that data
breaches are not a real issue and are blown out of
proportion… It isn’t so: instead, it is a genuine threat that
needs to be addressed by intensive training programs and
the implementation of strict protocols.
2. Falling Culprit to fraudulent e-mails
Another way of taking advantage of employees’ lack of
training and supervision is through fraudulent e-mails,
commonly known as phishing. It is one of the most
dangerous security threats. Regardless of how skilled
your employees may be and despite what they may think
they know about phishing, the skills of cybercriminals
invested in creating extremely sophisticated e-mails
replicating trusted business communication can fool an
untrained and gullible clerk. Opening such an e-mail or
its attachment would launch a trojan horse or a virus
which will extend its ramifications through the whole
computer network of the organization, giving attackers a
foothold into the business from which they can extract
sensitive client data, account passwords, intellectual
property and much more.
McAfee estimates that 97% of people are unable to
identify a sophisticated phishing e-mail making phishing
the most dangerous and successful of all cyberattacks (
91% of all cyberattacks start with a phishing e-mail).
3. How Can Businesses Mitigate Exposure?
Beyond the imposed requirements, data management is a
business reality, and it is imperative as a hospitality
company to take care of your guests the best you can. For
this reason, securing data must be a strategic process
involving everyone within the organization.
The company’s first step is to implement a cybersecurity
management plan, with actions to prevent data loss and a
continuity plan ready to go in the case of a breach.
The main defense will be to train staff on the security
risks, how to minimize them, and how to detect
infiltration. This is an ongoing process that needs
continual maintenance: making sure software and
systems are up to date, as well as firewalls and antivirus
programs.
It’s imperative that business owners put together a form
of a training plan for new and old employees alike to keep
them up to date with cybersecurity basics that may
prevent the loss of crucial information.
Joining forces with an experimented cyber risk
management company that offers business owners and
their employees with the training, the knowledge, the
tools, and the support to building a healthy and efficient
safety policy around their existing IT infrastructure will
not only help hotel owners reduce the likelihood of a
cyber-related incident, but it also offers valuable training
services to ensure employees are up to date with the latest
security policies.
Always remember that being compliant is not the
same as being secure!
Appendix C: Dependability on IoT devices
manufactured with a lack of security together
with 5G Require New Approaches To
Cybersecurity
5G is the “Fifth Generation” mobile network, the latest
global wireless standard. It will eventually replace or at
least augment the 4G LTE existing connection standard.
With 5G, you’ll be able to experience exponentially
faster download and upload speeds, and the time it will
take for devices to communicate with wireless networks
(Latency) will drastically decrease.
It is designed to connect everything and everyone at
higher data transfer speeds:
1. First and foremost, speed is the most attractive perk
of this new generation network!
Secure Hospitality Data - https://secure-stay.com/
 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances

5G should reach a speed of 10 gigabits per second,

5G is more responsive
which means 20 times faster than 4G.

Latency- milliseconds
than 4G with lower
2. The second reason is latency: by shortening the “lag latency, referring to the
time” between device communications, the possibility of time taken for device-to-
performing remote live actions such as remote surgery, 20-30 >10 network
or coordinating the communication between self-driving communications. Since
cars, is now something that can be seriously considered. devices can “talk” to the
3. The third reason would be connectivity. While the network faster, you’ll get
existing Network 4G LTE is powerful, we are quickly data faster.
outgrowing this network by overloading it and pushing it
to its limits. Current LTE networks are becoming 5G is faster than 4G with
overloaded at peak hours in major cities; 5G could more bits-per-second
support 100 times more devices per square mile versus able to travel the

Average Speed
200- network. With the new
4G, and with the rise of internet-connected “smart” 25mbps
400mbps upload and download
gadgets, such as IoT (Internet of Things) there is a need speeds, you could be
for a faster and higher-capacity system to support the downloading movies in
billions of devices already in use and the many more to seconds versus minutes.
come.
mMTC (Massive Machine-Type Communications) is a 5G uses less power than
brand-new service category of 5G that can support an 4G since it can rapidly
extremely high connection density of online devices. switch to low-energy use
Currently, IoT is communicating through sensors; those when cellular radios are
LTE Developing

Technology
sensors require a lot of resources and are quickly not in use. This extends
depleting the existing 4G LTE data capacity. the device battery life to
let devices stay
Compared to current smart devices on the market, MTC
unplugged for longer.
devices will require fewer resources since a huge number
of these devices will be able to connect to a single base
station, making them much more efficient by using the Incredibly
5G can carry more
speed and the low latency of the 5G network. fast
Ultra-fast devices than 4G as it
download
internet, low- expands the available
5G vs. 4G for speeds
latency and radio waves. Congestion
paved the
5G transmits tons of data over shorter distances than 4G improved issues that lead to slow
way for
Features

LTE.This helps speed and increase the consistency of HD

reliability. service will be reduced
connection signals and the network itself — even when Streaming.
once 5G steps in.
in motion. The 5G network can also support more
devices due to the use of new signal spectrums.
On top of all of this, energy-efficient tech allows less
power to be used. That being said, there is one major downside to the 5G,
4G 5G Impact which is keeping 4G from being fully replaced right now:

1. 5G is hard to install and deploy. There is a need for

Deployment

more transmitters to cover the same area as the current

2006-2010 >2020 4G networks. Placement sites for some of these “cells”
are very challenging for cellular companies to come up
with. This delay in coverage might seem negative for the
future of 5G, but it gives a window of time for providers
5G gives vital, fast to address another big concern: security.
service more reliably 2. 5G cybersecurity needs to undergo some meaningful
than 4G due to better improvements to avoid the growing risks of
bandwidth and more
200mbps >1gbps connection points. With
hacking. While some of the security worries are about the
network itself, others concern the devices connecting
Bandwidth

less stress on the

network, data costs can
fall lower than 4G
networks.
to the network.
3. Traffic routing points –
Pre-5G networks had fewer hardware traffic points of
contact, which made security checks and maintenance
easier. To be completely secure, all the Traffic routing
points need to be closely monitored, as any unsecured
areas might allow the threat to spread to other parts of the
vulnerable network.
4. Dependability on IoT devices manufactured with
a lack of security – With many low-end smart devices

Secure Hospitality Data - https://secure-stay.com/

 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming
2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1 Standards Compliances

available on the market, originating from manufacturers - Turn off Universal Plug and Play (UPnP)
with low concern about cybersecurity, the use of 5G will - Set a clear Bring your own device (BYOD) policy
encourage the connection of more devices between them for your employees.
and ultimately through its network. Each unsecured
device translates to possible breach points. Every
portable speaker, Smartwatch, smart lights, smart locks,
and thermostats, and even minor devices like a fish tank
thermometer can be a network vulnerable breaching
point.
A lack of control and security standards over IoT devices
implies infinite potential network breaches and hacking.
5. Focus on networks first - Network providers will
have to invest in software protections and will need to
collaborate with cybersecurity firms to develop solutions
for encryption and network monitoring to cover the
unique risks of 5G.
6. Manufacturers need to invest in their security
efforts - The high costs of developing and implementing
secure tech don’t motivate low-end product
manufacturers to focus on cybersecurity.
Many IoT devices used by the population have been
bought prioritizing the use above the tech, not
understanding that the potential breach originating from
those unsafe devices could cost them a thousand times
the saving made on the purchase of the device; and if used
in a public place such as a hotel in our case, this could
also affect other guests or the organization’s network as
a whole
7. Consumer education - Product labeling standards
will be a necessity. Because users have no intuitive way
to know how safe IoT devices are, smart tech
manufacturers might start to be held accountable with a
label system.

The FCC grades other forms of radio transmission, so the

growing market of IoT devices may soon be included as
well. Last, users need to be educated and warned about
the importance of securing all internet devices with
software updates.
How You Should Prepare for 5G
It is never too early to prepare by taking the security and
privacy of your system network into your own hands as
much as possible:
- Install antivirus solutions on all your devices.
- Use a VPN
- Practice strong password security
- Use Two-Factor Authentication (2FA)
- Password Management Vaults
- Focus on protecting yourself from breaches
originating from IoT
- Update the default backend passwords on all
your IoT devices.
- Create a separate network on your router for
guests as well as all the facility’s IoT devices
- Keep all your IoT devices updated with security
applications (This includes mobile phones,
computers, all smart devices, and even your car’s
infotainment system. Remember, any device that
connects to the internet, Bluetooth, or other data
radio should have all the latest updates (apps,
firmware, OS, etc.))

Secure Hospitality Data - https://secure-stay.com/

 An E2E hospitality Cybersecurity solutions - architecture, attacks/threats, and defense development for the upcoming 2021/2022 at all layers, followed by ISO27001, GDPR, and CIS V7.1
Standards Compliances

4.Appendix D: CIS V7.1 compliance Checklist

Secure Hospitality Data - https://secure-stay.com/

Secure Hospitality Data - https://secure-stay.com/
Secure Hospitality Data - https://secure-stay.com/
Secure Hospitality Data - https://secure-stay.com/
Secure Hospitality Data - https://secure-stay.com/
Secure Hospitality Data - https://secure-stay.com/
Secure Hospitality Data - https://secure-stay.com/
Secure Hospitality Data - https://secure-stay.com/