The hospitality sector, with a turnover in the trillions of dollars, stores a huge amount of highly sensitive and compromising data. That is why the hotel industry is a very rich target for attackers.
It has become a prime target for organized gangs of cybercriminals with malware specifically designed to steal information from cards used at point-of-sale terminals.
These make up no less than 13% of all cyberattacks on organizations and the costs in some cases are very high. The type of threats hotels face is varied, but the most common are:
- Data breaches: two years ago, the Marriott Group was fined £18.4 million by the UK authorities for not complying with data protection regulations that resulted in an exfiltration of its customers' personal data including names, passport numbers and telephone numbers.
- Ransomware: as in other sectors, this malware has blocked hotel systems, compromising business operations and the well-being of guests on occasions. In a cyberattack earlier this year, the Nordic Choice Hotels chain had to manually open guest room doors because magnetic cards were not working as a result of ransomware in the room management system.
- Phishing: a luxury hotel chain in Macau received a very sophisticated spear phishing attack from the North Korean APT group DarkHotel. Members of the management of several resorts received emails impersonating real identities of other members of the organization with malicious Excel files attached.
- Vulnerable Wi-Fi networks: a few weeks ago, we discussed a cybersecurity analyst’s unexpected discovery in a hotel in Qatar while using the Wi-Fi network. He was able to access an FTP server containing sensitive customer information not only from the resort where he was staying but from the entire group consisting of 629 hotels in 40 countries.
It is clear that the attacks suffered by this sector are not casual or transient, but that there is a real economic interest behind them.
As these threats are growing more frequent and sophisticated, it is essential that hotels seek out partners to advise them on how to implement the best security measures in their organizations:
- Training in good cybersecurity practices for all hotel staff, because this will reduce the risk of phishing and other cyberattacks that use social engineering.
- Frequent and always-on back-ups of systems and sensitive data that are not linked to the main servers, in order to avoid exfiltration of guest data and to restore systems as soon as possible in the event of a ransomware blockage.
- Updating all systems and third-party software, with the aim of minimizing the possibility of malicious cyber actors exploiting vulnerabilities.
- Use of comprehensive cybersecurity platforms that have tools that provide the following:
- Secure Wi-Fi solution: to manage all guest external device connections reliably, even in high-density situations, such as when professional conferences take place in hotels.
- Network security with advanced firewalls that also have DNS filtering to block access by guests accessing malicious content that could compromise hotel systems.
- Advanced endpoint protection, detection and response capable of detecting both known and unknown threats through continuous monitoring and proactive searching for anomalous behavior patterns.
Protect your business. Protect your customers
WatchGuard is here to provide the layered protection your customers need against the most advanced types of malware and deliver it in way that is simple to maintain.
WatchGuard Cloud was designed to help you meet your customers’ needs faster and better, with streamlined operations, built-in roles and permissions, automated alerts, and so on.
Centralizing all these actions will enable you to improve overall business operations rather than managing service licenses, handling support tickets, or setting up complex policies. That will differentiate your business from the competitors, because you will be able to spend more time giving your customers other higher value services more profitable for you.
Instantly, anywhere and anytime, it’s also easy to initiate client trials and grow each customer's protection to include products from WatchGuard’s full portfolio.
More: Stay up to date with the latest cybersecurity news from this and other industries on our WatchGuard Blog
Guest blog courtesy of WatchGuard Technologies. Read more WatchGuard guest blogs here. Regularly contributed guest blogs are part of ChannelE2E’s sponsorship program.
