Why does the Hospitality Sector Roll Out the Welcome Mat for Hackers?

Posted by Geraldine Hunt on Thu, Apr 13th, 2017

Cyber attacks targeting businesses in the hospitality sector have been on the rise for the past few years.  Businesses in this sector primarily targeted by hackers have been restaurants and hotels.  In order to understand the driving force behind why these types of organizations are prime targets, one must only consider the data at stake. 

Masses of customer data

Restaurants and hotels alike handle a tremendous amount of customer data on a daily basis.  Hotels and restaurants typically store full primary account numbers and other payment information like addresses, CVV numbers, driver’s license information, key card information, and email addresses.  This data is particularly valuable to hackers trying to sell valid payment data and steal an individual’s identity.  When you combine the theft of this data with the average time to discovery of a breach, the picture becomes even more worrying.  Verizon’s Data Breach Investigations Report (DBIR) for 2016 indicates that 74% of breaches in the hospitality sector in 2016 were caused by Point of Sale systems (PoS).

Easy for hackers to gain entry

 In 100% of the breaches, it took hackers less than an hour to gain entry and merely days to exfiltrate the stolen data.  Unfortunately, the report also found that it took weeks before the users were made aware of their victimhood.  This report analyzed over 100,000 incidents spanning 82 different countries and found that 63% of the confirmed breaches were due to weak, default, or stolen credentials.  In addition, 85% of successful exploit traffic was attributed to the top 10 vulnerabilities.  These two statistics point to a larger issue within the hospitality sector—a lack of due diligence and due care for cyber security.  These organizations are so focused on providing great service to their customers that they forget to provide them a crucial service—the security of the data their customers trust them to keep safe. 

Of course, it is easy to understand that businesses in the hospitality sector are in a difficult position when it comes to securing customer data .  Hotels in particular are expected to provide Wi-Fi for their guests, business centers, and other access that necessitates the reduction of an overall security posture for those devices and networks.  However, as noted in the Verizon DBIR, these amenities played little to no role in breaches for 2016.

General security best practices should be followed to prevent the top causes of these breaches.  First, the shared systems should, of course, never be on the same network with company information and customer data.  The companies should take care to change default passwords for newly implemented PoS systems, devices, and other components on the network.  The PoS systems should have further protections on them such as two-factor authentication, antivirus, anti malware, web security, and should be patched on some sort of schedule.  As noted in the DBIR, these organizations should also perform regular vulnerability assessments and penetration tests to ensure they are secure at the basest of levels.

PoS security

There are few excuses to be made when 85% of successful exploits were using well-known vulnerabilities with available patches.  Obviously, monitoring and controlling who has access to the PoS systems should also be a priority.  It’s wise to reduce the attack surface area even further by ensuring that PoS systems are not used as end-user workstations for checking email and web browsing.  This opens the customer data up to all sorts of potential attack vectors.

Understandably, hackers are targeting the hospitality sector more and more as they see great efficiency in compromising their systems and they enjoy a great return on investment.  Since businesses in this sector typically do high volumes of transactions and generally have a very weak security posture due to either lack of knowledge or lack of care, they are high value targets.  Fortunately, the bar has been set fairly low and the industry as a whole can enjoy very rapid gains in security by implementing very basic security measures. 

As cyber security and hackers become more advanced, customers will become less tolerant of businesses throwing their data to the wolves and these businesses will die out if they do not take steps to protect the trust of their customers.  These steps are very simple and if the key stakeholders in these businesses do not understand the world is full of qualified and knowledgeable security professionals ready and willing to help .

TitanHQ’s suite of security products provide the protection that will stop hackers in their tracks. No need for an onsite IT security specialist, as these solutions are easy to install and include automatic updates. To find out how TitanHQ can protect your restaurant or diner, you can email us at info@titanhq.com.