Hospitality

What is Risk Management in Hospitality?

Libby Bevin · November 29, 2021 ·

The hospitality industry has been hit hard with challenges during the COVID pandemic. For a sector that prides itself on customer service and adapting to change, the last few years have been rough.

As a sector, hospitality includes restaurants, bars, and hotel businesses; but as well as other types of lodging and travel businesses, such as AirBnB operators, real estate managers, and tour guides.

On the best of days – and without having to adapt to coronavirus restrictions –

Under the best of circumstances — and without COVID-19 restrictions to complicate matters — the hospitality industry must take myriad precautions to protect guest information from prying eyes and hackers. Hotels routinely store a wealth of personal information such as addresses, credit card information and passport numbers, making hoteliers a desirable target for hackers.

For example, Wired recently reported that Marriott International has been hacked twice in recent years. Once in early 2020, compromising the sensitive information of an estimated 5.2 million guests; and a massive breach in 2018 that had exposed the information of 500 million people who had made reservations through one of the hotel giant’s portals.

Hoteliers aren’t the only ones with cybersecurity challenges, but let’s start with taking a look at what hotel chains can do to better their risk management.

How do you manage risk in the hotel Industry?

Whether we stay in a hotel room for business or pleasure, the goal of hotel management is for customers to have a smooth experience that will entice them to return for another stay and, ideally, to share positive reviews on social media.

What are specific risk areas for hotel owners and managers to consider?

Safety. Hotel companies are busy environments, every hour of every day. Personal security of guests is a paramount issue. Staff are often at risk for falling, tripping or straining themselves while lifting luggage. An unsafe work environment can lead to costly healthcare premiums, workers’ compensation claims, or complaints (and even lawsuits) from guests who perceive that they were hurt on the property.
Cybersecurity. The hospitality industry collects increasing amounts of customer data, such as tracking guests’ spending habits and choices so the hotel can provide more personalized service. Guest profiles are designed to make rebooking easy, and the profiles often contain a treasure trove of private data, such as credit card numbers, email addresses and personal preferences. Guests share this detailed data assuming that hotel owners and hotel management will keep it safe, and it is a critical risk area that must be addressed by the hospitality industry.
Privacy. Credit card and payment data protection is crucial. The hospitality industry itself does not have a set of privacy rules to protect any data collected. Rather, payment card and credit card management is regulated by the Payment Card Industry (PCI) standards for compliance, which must be followed to best protect the privacy of guests.

How do you manage risks in the restaurant industry?

Many of the risks in the restaurant industry are the same as those in the hotel industry, but one deserves to be highlighted:

Payment apps. Point-of-sale systems that run on wifi are convenient for bar and restaurant staff, but do raise cybersecurity concerns. Some apps are simply not safe to begin with, or they become unsafe because they aren’t properly updated when patches are issued for known cyber risks.

How do you manage risks in the travel industry?

Travel and weather go hand in hand, and natural disasters create some of the biggest threats to travel. It’s in the best interest of travel planners and hotel owners to dissuade people to stay when, for instance, a hurricane is threatening to cause a major business interruption. Other points to consider:

Climate change is bringing more volatile weather to some parts of the globe.
Coronavirus outbreaks and restrictions mean that more travelers are taking out travel insurance policies.
Cyber risks, especially associated with the hacking of client and guests’ private information, means that travel agencies must be extra vigilant to keep that information secure.

Hospitality businesses are especially vulnerable to reputational risk

As consumers leave more detailed social media reviews and travelers search online consumer platforms for these reviews, reputational risk is something all hospitality businesses are acutely aware of and must monitor closely.

It doesn’t matter which branch of the hospitality industry you work in; a poor online review may hurt your business for a long time. New hotels and restaurants can be especially vulnerable to a harsh review, and it’s super important that hospitality companies dedicate time to monitoring how, when, and where they are mentioned online.

Let ZenGRC monitor risks in the hospitality business for you!

ZenGRC’s compliance, risk, and workflow management software is an intuitive, easy-to-understand platform that never takes a break or needs a day off. Let us handle risk management while you take care of your guests.

Worry-free risk management is the Zen way. For more information on how ZenGRC can enable your CMS, contact us for a free demo.

What is Hotel Risk Management?

Libby Bevin · December 10, 2019 ·

Hotel risk management entails identifying, evaluating, prioritizing, and controlling risks to enterprises in the hotel industry. Hotel management faces several types of risk:

Operational risk to day-to day operations
Project risk, encountered when building or expanding a hotel
Strategic risk, to the hotel’s ability to achieve strategic objectives
Security risk, including cybersecurity

Hospitality businesses including hoteliers face the same risk management process as those in other industries, starting with a risk assessment and including decisions about whether to avoid, mitigate, or accept the risks that assessment reveals.

But hotel owners do face risks unique to the hospitality industry. Cybersecurity can be especially challenging. Renting hotel rooms to travelers from around the world means collecting personal data and payment card information from many people and businesses every day, and hackers are eager to exploit that data. Marriott International, Hilton, Hyatt, and Holiday Inn have all been victims of cyberattacks, and have revamped their risk management strategies.

Although there is no risk management framework specially developed for the hospitality industry, a number of frameworks are beneficial for secure hotel management. These include:

Payment Card Industry Data Security Standard (PCI DSS), compliance with which is required for all who store, process, or transmit payments by credit or debit card
General Data Protection Regulation (GDPR) for those processing the personal data of European Union residents
California Consumer Privacy Act (CCPA), for hotels processing the personal data of California residents or those with locations in California.

PCI Log Management Requirements For CISO’s

ZenGRC Team · September 4, 2018 ·

Whether you’re in the healthcare, retail, or hospitality industry, you’re going to need to protect your customer information if you collect payments. The Payment Card Industry Data Security Standard (PCI DSS) not only sets the standard for cardholder data (CD), but it also enforces the standard with penalties.

PCI DSS Logging and Log Monitoring Requirements

What is the Payment Card Industry Data Security Standard (PCI DSS)?

In the early 2000’s, the five major payment card companies, American Express, Discover Financial Services, JCB International, MasterCard, and Visa, Inc. banded together to create the Payment Card Industry Security Standards Council (PCI SSC). The organization wanted to create a series of information security standards processing payments that protected customers from identity theft and the card industry from paying for data breaches.

PCI SSC worked together to establish “best practices” for protecting information which became standardized as PCI DSS.

What Are The Penalties for Noncompliance?

While PCI DSS is considered a “standard” and not a regulation, many merchants incorrectly assume compliance is optional. Noncompliance leads to consequences that can cause business failure.

Card brands and acquiring banks can, at their discretion, fine noncompliant merchants anywhere from $5,000 to $100,000 per month for a violation. Depending on an organization’s size, these fines can be either crippling or devastating.

Who Needs to Be PCI DSS Compliant?

Regardless of your size or industry, any company accepting, transmitting, or storing cardholder data must maintain PCI DSS compliance.

What is PCI DSS Requirement 10?

PCI DSS Requirement 10 focuses on monitoring access to networks and data. In its most broad definition, Requirement 10 states:

Requirement 10: Track and monitor all access to network resources and cardholder data

Logging mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise. The presence of logs in all environments allows thorough tracking, alerting, and analysis when something does go wrong. Determining the cause of a compromise is very difficult, if not impossible, without system activity logs.

Essentially, Requirement 10 requires you to continuously monitor the user access to your environment. Setting up user access controls is the first step to maintaining a secure cardholder data environment (CDE), but you also need to ensure that those controls work.

Embedded within Requirement 10, however, are 39 subparts. Since PCI DSS is a highly prescriptive standard, it sets out a clear list of the steps and documents needed to meet its requirements.

What records are necessary for Requirement 10 Compliance?

If you’re looking to be PCI DSS compliant, the standard not only lists the sections and subsections and parts of subsections, but it also incorporates Guidance to help understand effective control review. As such, the following steps can help you log data necessary to prove your compliance:

Create a system or process linking user access to the system components accessed and make sure you can trace suspicious user activity to a specific user.
Generate audit trails that prove the system administrator receives suspicious activity alerts and follows up on them.
Record all individual accesses to the CDE to show that new or unauthorized user accounts have not accessed the systems and networks.
Ensure you collect records of activities performed by “administrator” or “root” accounts that show potential misuse of these accounts and can trace the issue to a specific action and individual
Maintain file integrity of audit logs by having a way to identify changes, additions, and deletions to them.
Record invalid login attempts to trace “brute force” attacks or password guesses.
Maintain records that allow you to trace activities indicating manipulation of authentication controls by attempting to bypass them or impersonating a valid account, including but not limited to records that verify mechanisms, elevation of privileges, and any changes/additions/deletions to root or administrative accounts.
Document any pauses or restarts to your audit logging processes.
Maintain records to show that system-level object, such as databases or stored procedures, have not been created or deleted by unauthorized accounts.
For all system components, maintain an event log that records user identification, event type, date/time stamp, success/failure indication, event origination, and affected data, system component or resource identity/name.
Synchronize clocks across systems to maintain exact sequences of events for forensics teams.
Use “principle of least privilege” for audit log access to maintain security and integrity of the information.
Backup logs to a centralized server or media that maintains data integrity.
Write logs directly, or offload or copy from external systems to a secure internal system or media.
Use file-integrity monitoring or change-detection systems to ensure notification of audit log changes that may indicate a compromise.
Engage in regular log reviews either manually or by using a log harvesting, parsing, and alerting tool.
Engage in daily review of security daily for notifications or alerts indicating suspicious activity and critical system component logs.
Schedule periodic reviews for all system components that indicate potential issues or attempt to gain access to sensitive systems by using less sensitive systems.
Document investigations of exceptions and anomalies.
Retain all records for at least a year.
Ensure employees are trained and aware of security policies and monitoring.

Service providers are subject to the following additional requirements:

Establish formal procedures to detect and alert critical security control failures, such as a firewall erasing rules or going offline.
Document evidence supporting the response to a security failure, including the processes and procedures as well as the actions and responses.

How ZenGRC Eases Best Practices For PCI DSS Audit Log Management

ZenGRC’s system-of-record enables organizations to store all their information in a single location. Collecting all your audit log information in a single place allows you to manage audit information and document your compliance activities.

With a single source of information, your audit logging staff can communicate efficiently with one another. Our role-based authentications enable audit log security and integrity since only the people who need access can interact with the information.

Finally, our system-of-record enables your audit log review staff to trace outstanding tasks without emails. This capability not only makes communication easier but protects the data by keeping it within our protected platform rather than insecure emails.

Managing audit information in a single location helps you detect real-time risks and prove continuous monitoring by documenting all your ongoing compliance activities.
For more information about how ZenGRC eases the burden of audit log management and analysis, contact ZenGRC to schedule a demo.