The Rising Tide of Cybersecurity Threats in Hospitality: Insights from Industry Leaders
In an era where technology is rapidly evolving, the hospitality industry finds itself at a crossroads. Social engineering, advancements in artificial intelligence (AI), and the proliferation of new tech streaming devices have made hotels more vulnerable than ever to cyberattacks. Industry insiders are sounding the alarm, emphasizing the urgent need for robust cybersecurity measures. To gain deeper insights into this pressing issue, LODGING recently interviewed three prominent figures in hotel management: Paul Bushman, Senior Vice President of Technology & Enterprise Solutions at Crescent Hotels & Resorts; Keryn McNamara, Chief Information Officer at Aimbridge Hospitality; and Jason Stead, Chief Information Security Officer at Choice Hotels International. Their perspectives shed light on the current state of cybersecurity in the hospitality sector and the proactive steps being taken to combat cybercrime.
The Landscape of Cybersecurity Concerns
When asked about the primary cybersecurity concerns facing their hotels, the executives highlighted a range of threats. Paul Bushman pointed out that ransomware, phishing attacks (both email and voice), Distributed Denial of Service (DDoS) attacks, and hacks targeting various systems, including Property Management Systems (PMS) and Point of Sale (POS) systems, are at the forefront. Notably, he emphasized that social engineering is a significant concern, with reports indicating that up to 98% of cyberattacks involve some form of social engineering. This method often targets individuals to gain access to sensitive information, making human awareness and training critical in the fight against cybercrime.
Keryn McNamara echoed this sentiment, stating that the security, safety, and privacy of guests are paramount. Aimbridge Hospitality prioritizes protecting guest information and hotel operations through advanced security measures and continuous monitoring for emerging threats. Jason Stead added that the lodging industry has become a prime target for hackers, likening it to sharks sensing blood in the water. The success of one attack often leads to a surge in similar attempts across the industry.
Investments in Cybersecurity Technology
In response to the growing threat landscape, hotel companies are making significant investments in cybersecurity technology and personnel. Bushman noted that Crescent Hotels & Resorts has intentionally invested in a diverse range of protective measures, creating "islands of protection" throughout their portfolio. This includes physical, virtual, logical, and human protection layers. Regular cybersecurity awareness training is also a cornerstone of their strategy, ensuring that employees are equipped to identify and respond to potential risks.
Aimbridge Hospitality has similarly committed to investing in top-tier tools and strengthening brand collaborations. McNamara highlighted the transition from traditional data centers to cloud-based operations, which enhances data integrity and recovery capabilities. The implementation of advanced firewalls, network intrusion detection systems, and a 24/7 Cyber Security Operations Center (C-SOC) has further fortified their defenses against cyber threats.
Choice Hotels International has focused on endpoint detection and response (EDR) capabilities, which Stead believes will significantly enhance the industry’s ability to thwart common attacks. By sharing knowledge and resources across the industry, hotels can collectively strengthen their defenses against cybercriminals.
Ensuring Guest Information Protection
At the property level, ensuring that guests feel secure about their personal information is a top priority. Bushman emphasized the importance of implementing both physical and virtual security measures, maintaining compliance with industry standards, and regularly updating software and antivirus programs. The rise of streaming services presents new challenges, as previous guests’ information can sometimes remain accessible through guestroom entertainment platforms. This underscores the need for hotels to ensure that sensitive data is properly deleted upon checkout.
McNamara highlighted Aimbridge’s commitment to safeguarding guest information through comprehensive training programs for associates. These programs cover essential topics such as Consumer Privacy Awareness, payment card industry standards, and fraud prevention. Regular vulnerability scans and security compliance checks further bolster their efforts to protect guest data.
The Role of Hotel Personnel in Cybersecurity
The executives unanimously agreed that hotel personnel play a critical role in combating cybercrime. Bushman stated that associates are the company’s most valuable asset in this fight. Educating staff on how to protect guests and identify potential threats is essential for success. Aimbridge’s ongoing training programs empower associates with the skills needed to recognize and respond to cybersecurity threats effectively.
Stead emphasized the importance of training across all hotel staff, from housekeeping to front desk personnel. By fostering a culture of awareness, hotels can significantly reduce the likelihood of successful cyberattacks, which often rely on social engineering tactics.
Looking Ahead: The Future of Cybersecurity in Hospitality
As the hospitality industry navigates an increasingly complex cybersecurity landscape, the outlook remains cautious yet proactive. Bushman warned that hackers will continue to evolve their tactics, particularly with the rise of AI. To stay ahead, hotels must prioritize investments in technology and employee education. A shift in attitude is necessary, as cybersecurity often faces budget cuts until a breach occurs.
McNamara emphasized the need for continuous vigilance and collaboration with technology partners and industry experts to develop effective solutions. Stead noted that the investment in cybersecurity controls has dramatically increased over the past decade, reflecting a growing recognition of the importance of safeguarding guest information.
Conclusion
The hospitality industry stands at a critical juncture in the fight against cybercrime. With the rise of sophisticated threats and the increasing reliance on technology, hotels must remain vigilant and proactive in their cybersecurity efforts. By investing in technology, training personnel, and fostering a culture of awareness, the industry can better protect itself and its guests from the ever-evolving landscape of cyber threats. As the insights from industry leaders reveal, the battle against cybercrime is ongoing, and collaboration and innovation will be key to ensuring a secure future for hospitality.