Lindby

Hospitality Industry has 2nd Highest number of Cyber breaches

The Hospitality industry is reported to have the second-highest number of Cybersecurity breaches[1]. How are they still being breached even with expensive technical point solutions?

Several reports indicate the hospitality industry is under attack, as are other sectors, and breaches are commonplace[2].  In 2017 Sabre Hospitality was a victim of a security breach which impacted its SynXis hotel reservation system which allowed unauthorised access to payment card information[3].

However, surely with advanced technology available today, you can mitigate the risk, right?  Well yes and no, technology is only part of the solution, often overlooked is the human factor. This can influence the attack vector to gain access and eventually compromise sensitive information within your organisation.

There are some excellent technical products in the market, and yet large corporates are still being breached even with these products being deployed, through no fault of the vendor providing the solution in the first place.

You cannot mitigate every Cyber risk in an organisation, and if anyone tells you, they can, then you should look elsewhere for advice.

So what can I do about it?

The solution should be tailored for your organisation as not one glove fits all!

Here are some, but not limited to, steps you might want to consider:

  • Conduct a Cyber Maturity Review to ascertain what areas may require further enhancements
  • Conduct a Cyber Risk Assessment to identify the critical assets you need to protect and how.
  • Train all staff in Cyber awareness, onboarding and refresher training can help and is cost-effective.
  • Train selected staff to attend professional Cyber training

So don’t just rely on a technical solution.

[1] PwC’s Hotels Outlook report 2018 to 2022

[2] Insights Study into Cyber threats in hospitality

[3] https://www.phocuswire.com/Sabre-updates-on-unauthorized-access-confirms-payment-details-hacked


Book a Strategy Call to discuss your first steps

Category: Cybersecurity, Safety

Abusive Customers

Under workplace safety legislation all businesses have a legal duty to provide a safe workplace, so they need to be thoroughly prepared for the possibility of abusive customers, violent customers and armed hold ups.

Most managers are aware that they must protect all staff members from workplace bullying, sexual harassment and violence between staff members but there is also a more urgent need to protect staff from customers!

Bar staff report that customer abuses is endemic and increasing.  Industries that must deal with the public are being subjected to all types of abuse.  Ranging from verbal insults and threats to all-out physical assault with weapons and in some cases sexual assault.

Managers need to be trained in how to defuse the situation and to back their staff.  The customer is not always right.  Managers need to make sure that their staff are safe and that they have the right to refuse service to customers who are abusive or making threats to them.

Conflict resolution is not just for internal use but needs to cover external influences.  The purpose of General Evacuation Training is to cover what to do in all types of emergencies.  Does your General Evacuation Training cover what to do in the event of armed hold up; active shooter or an aggressive person? 

What training does your staff need?  Are you supporting them? What behaviour will you not tolerate in your customers?  See how polite this manager was he orders his customers out of his restaurant.



Book a Strategy session to discuss your training needs

Category: Safety

Hackers are checking into hotel systems

It’s official, ‘hackers are checking into hotel Systems’, have you been Phished[1]?

Criminals are after your data so they can steal credentials and use them to get money, and this time it seems the gang associated with these attacks are the same as the ones who took USD 1Billlion from banks.

So how do they do it?

The first step is not hacking a computer but socially engineering[2] a person![3]

Step 1 – A phone call is received at a hotel reservation desk by a pretend hotel guest to discuss a problem confirming a reservation. They say they have a question, and can they help?

Step 2 – The caller says they have information about the reservation and would like an email to send to the reservation desk so the hotel can help them.

Step 3 – The caller sends an email to the reservation desk with an attachment.  The hotel opens the attachment, which has malicious software called ‘Malware’.  The malware is designed to find the sensitive information the caller wants and downloads more Malware tools to assist in its search.

Step 4 – The hotel system is now compromised and send all the information that the caller needed to them and the malware can stay on the system if they want to download future reservation information.

While this story was about a hotel chain, the same approach can be used for many businesses alike, and this is called a ‘Phishing Scam’.  There are different types of Phishing scams, depending on the intended victim.

Help me protect myself from a Phishing Scam!

All staff should be trained on how to spot a potential scam, for example, not posting information on social media such as vacation plans, phone numbers, your address.

[1] The fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.

“an email that is likely a phishing scam”

[2](In the context of information security) the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes.

[3] https://whatismyipaddress.com/hacking-hotels


Book a Strategy Call Today

Category: Safety Tags: ,

The UK might fine Marriot Hotel 99 Million Pounds for data breach

The UK might fine Marriot Hotel £99Million for Data Breach!

Following on from our previous article, it looks like countries are submitting claims against the Marriot Hotel Chain according to the Register UK.[1]

The UK’s Information Commissioners office is the first to file a claim for fining the hotel chain.

If other countries follow suit, it could be a very costly affair, not to mention the reputational damage to the hotel chain.

The Chief Executive of Marriot International stated:

“We deeply regret this incident happened. We take the privacy and security of guest information very seriously and continue to work hard to meet the standard of excellence that our guests expect from Marriott.”

Marriot had admitted to half a billion individuals data had been stolen.

Hotel guests who have previously made a reservation to stay at any of the following, Marriott or Starwood hotel (among others, the group also owns the Sheraton, Ritz-Carlton, and Renaissance brands) should go to the Starwood web page about the data breach.

Tips

Your data may be used by criminals who want to use your identity for financial gain.  Go to the website and check if the breach is relevant to you.

Some password managers and Antivirus products automatically tell you if they find your credentials being used elsewhere. This can include credit card information, email addresses and passwords for sites that you need a login.

Be proactive and get good security awareness advice

[1] https://www.theregister.co.uk/2019/07/09/marriott_hotels_ico_fine_intention_99m_starwood_breach/


Book now for a strategy call

Category: Safety Tags: ,

Could your business cope with a $650,000 fine?

Bradken Resources Limited was fined in the Melbourne County Court July 2019 after being found guilty by a Wangaratta County Court jury of failing to provide and maintain safe plant following a 10 day trial.

Although there had been no prior incidents of a casting falling back onto the windscreen of a skid steer loader, the court heard Bradken knew, or ought to have known, from previous similar incidents that this could happen.

The court was told it had been reasonably practicable for Bradken to reduce that risk by using alternative machinery, such as a rock excavator, that did not put its employees as close to the castings.

No matter the size of the business you MUST complete and document a Hazard & Risk Assessment.


Book a Strategy Call

Category: Safety

Turnover of staff in Hotel industry creates problems

Often the hotel industry is peppered with students and part time staff, whom for many it is there first job.  It is an industry that traditionally has a high turnover of staff.  The difficulty for many Chief Fire Wardens is the requirement to “train” staff in general evacuation training within two days of commencement.  Many Human Resource Managers “train” their staff in General Evacuation Training, BUT how good is the training.

Often the quality of the training will depend on how that person is feeling that day.  There is often no consistency.

I have had many people that say that they “train” their staff by telling them… “There is the door, get out”.  Or they show them where the exits are and think this is “training”.  General Evacuation Training is soooo much more than this.  To provide comprehensive training in General Evacuation Training should take around an hour and most HR Managers or Managers don’t have the time for this.

As hotels are often targets for armed hold up, you want to make sure that your General Evacuation Training includes something on what to do in the event of an armed hold up or an active shooter.  General Evacuation Training is about helping staff to make the right decision in all types of emergencies.

Some years ago I did some training in South Australia for a company that only wanted the Chief Warden’s trained as they did not believe the other staff needed training.  So I conducted a fire drill.  I went up to a workshop manager and said to him “This is a fire drill, pretend there is a fire there, what would you do?”  He looks at me for a second… you could see his brain thinking… he says “I know! I go to the assembly area and he takes off! …. I then went to the showroom and gave her the same spiel and she said “well I have no customers in the showroom at present so I go to the assembly area” and she takes off!…. No word of a lie… I went out to the warehouse and said the same thing to a warehouse person and he said “well I’m just a casual here, but hey, I can go to the assembly area and he took off!  IF you can’t see what the problem is… YOU need General Evacuation Training…

So, what is the solution?  The Answer is Yes has created a series of Online fire training courses.  What makes them unique is they are the only company that will (without charge) customise the training course to be specific to YOUR business.  A Fire Safety Adviser ensures that the training is consistent and complies with all legislation

Fire training does not have to be done face to face and staff can do the training online.  It could also be something that staff have to do before they start work!


More Info on Fire Training

Category: Safety

Book a Strategy Session Today to discuss your Training Needs

Book now