Protecting Personally Identifiable Information Webinar

Today we have a webinar with a group of panelists, and we'll be discussing protecting personally identifiable information. So without further ado, I will give it off to Evelyn of ATR Consulting.

Here in the US, October is National Cybersecurity Awareness Month. And cyberspace is woven into the fabric of our daily lives, and the world is more more interconnected today than ever before. We enjoy the benefits and convenience that it provides as we do everything on our computers these days, from shopping online, banking, using our smartphones, interacting with friends from around the world through social networks, and of course, booking and managing travel in cyberspace. So this month, we're all encouraged to take a look at our systems and networks to ensure that we create and maintain a safe and secure and resilient cyber environment for ourselves and our guests. My name is Evelyn Oreskovich. I've been in the hospitality business for more than 30 years, and I've been involved in the development of hotel systems since the very beginning of my career. Times and technology have certainly changed, but one thing hasn't: the amount of data that hotels routinely collect and store in order to ensure a personalized and custom experience for our guests. For some hoteliers, this is increasingly the most important thing they can do to ensure they deliver the level of service our guests require. The downside, of course, is that in today's interconnected world, it's easier than ever for criminals to get our guests' information. So it's more important than ever that we take a myriad of precautions, but also be ready to respond should we have a problem. So when we look at the definition of PII, it really means All the things that you see on the screen and more. Many of us are collecting a lot of this information about our guests and our staff.

Yeah.

In addition, you have personal information about your guests, especially frequent guests. That might include the company they work for, allergies, activities, and special requirements, not to mention credit card information and dates that they'll be away from home. It's important to ensure its security. Criminals use the information they collect for a variety of misdeeds. These are a few of the most common. These thieves are very strategic about who they target and how they go about getting the information. Hotels are a great target because of who our guests are, how much information about our guests we collect, as well as a welcoming environment since hotels are public places with accommodating services. So, let's talk about A little bit more of what makes hotels such a prime target. Guests are generally at ease. Many are not as observant about what's going on around them as they might otherwise be. We want them to relax, but when they do, they can inadvertently put themselves at risk. Of course, we try to do all we can in security, but things can still happen. Hotels are increasingly offering wireless networks that may not be as secure as needed.

Excuse me.

Sniffing is an increasing concern as hackers just sit in the lobby and they find vulnerable wireless networks to literally pull the data out of the air as the guests are transmitting them. Other threats can come from doing what we do best, serving a guest who asks us to print something from a USB drive, for example. You insert that USB drive into the hotel network and a thumb drive can cause But offline concerns are also present. Online is not the only place where we can be targeted. We're very vulnerable when we don't slip, for example, the folio completely through the door, as well as by traditional— While there's no single U.S. law that restricts as strict as the European laws, there are many states which have instituted requirements that hotels must file That's not to say that the U.S. federal government doesn't take this seriously. Wyndham Hotels, for example, found that out the hard way when the Federal Trade Commission filed a lawsuit after a breach that occurred in 2012, putting millions of guests' information at risk. As for Europe, their already strict rules are getting even more protective— a makeover. We should anticipate that those rules will apply not only to hotels in Europe, but to any hotel around the world who hosts a European-based guest. So how do you keep up? What's a hotel to do to prevent an occurrence and prepare in case one does happen? Today, we've assembled a team of experts to give you some insight on the current situation and to give you guidance in preparing a plan and evaluating your current one. Jibran Ilyas is the Incident Response Lead at Haylock's Labs. Christine Marciano is the President of Cyber Data Risk Managers, who is an insurance firm. And Marian Hughes-Rosé is my colleague at Hospitality Evolution Resources and is our Vice President of Business Development. So starting with Jibran, Jibran Ilyas is the Incident Response Lead at Haylock Security Labs. As a forensic investigator, Jibran leads the incident response team there which investigates data breaches and helps with crisis management. His team helps organizations create an incident response plan and malware defense strategy to protect against leakage of intellectual property and PII. Jibran will be talking about the challenges and vulnerabilities we face as hoteliers and present some proactive solutions that everyone should implement in their operations. Jibran? Thank you, Linda.

All right, so I'll be presenting on the hospitality challenges and solutions. So I'll be talking about why it's hard to protect PII in hospitality arena, and I'll offer some solutions right after. So this is a quick intro on me. I've been in the industry for about 10 years, spoken at several security conferences, and trained ticket service and incident response. So here's the agenda. I'm going to talk about the typical vulnerabilities in the hospitality industry, and then we're going to talk about effective solutions there. All right, so what are the challenges? As hospitality merchants, you accept many payment methods. There's mail order and telephone order transactions. There is card present transaction, which is occurred on your point of sale system and your property management system. Basically, even if people have reserved the hotel online, when you go to a hotel, you're asked for a credit card for incidentals. So that information, even though it gets encrypted after it's swiped, there is a window of opportunity for the bad guys to take the data. And the way they can take the data in transit is by 3 ways. One, they can actually install a keylogger on the machine. That is swiping the credit cards, and as Evelyn mentioned, network sniffing. What they can do is sit between the machine that swipes the credit card and the database server where the numbers are supposed to be encrypted. So right when the credit card numbers are being transmitted from the front desk system to the server, the attackers can sit in between the network and sniff the credit card data. Then the last thing is they can actually dump the computer memory on the system that swipes the data and also get the magnetic stripe data of the credit cards. That is what they use to make counterfeit credit cards and take advantage of the PII store. Then there is e-commerce transactions. You actually submit when you're booking online on, let's say, any hotel's website. You give out your credit card number. You also give your expiration date, and also the 3-digit security code on the back of your credit card. So when you give that out, that is again at risk because the web applications, if they're open to you, they're open for the bad guys as well. So it's open for you for a different purpose, right? It's open for you because you want to be able to book your travel online, your hotels online. But the bad guys, when they see the access, they actually— They can do anything. have many, many attempts to break the application so that they're able to take your credit card information. And then the other challenge is that there are multiple payment entry points. In a typical hotel, you'll see the front desk, right? But then there are restaurants, spas, there could be a gift store. So there are a lot of different places where your personally identifiable information is stored. It's a challenge. To protect all that information, especially if the vendors— if there are multiple third parties involved. So what's the disadvantage of having multiple third parties involved? The disadvantage is that there are a lot of remote entry points. So for example, if you have 3 vendors, they don't usually sit at your hotel to actually fix the problem as they happen. They have some sort of remote access into the hotel so that they can actually fix the problem remotely. So again, if that kind of access is available for the legitimate people, it's also open for the hackers out there. So what are the typical problems? There's common passwords between flagship properties, and the reason for that is we like to keep things simple. We like to carry a standard, right? But that is also bad because then only One password compromise can actually cause problems at all the flagship properties. There's also lack of oversight for PII, especially on paper trail. There are a lot of policies that are made for the PII that is stored on disk, on computers, but the policies are not quite there yet when it comes to the paper trail. When you take somebody's credit card on paper, What do they have to do? Do they have to just put it in the dumpster or do they have to shred it before they put it in the dumpster? The third point I mentioned earlier, remote access solutions allow for multiple third parties. That is a big, big problem because once the attackers can come into your network, then they can actually sit in the network for a good 3 to 6 months to collect the PII before they go sell it to other smaller criminals. The last but not the least, lack of defined proactive controls. I think the hospitality industry, we've seen with the number of hacks in the last 2 or 3 years, it's more of a reactive industry. We look at the hacks and then we look to solve the problems. I think it's time to spend money on proactive prevention and response capabilities because what's happening out there, if you look at the statistics, One of the statistics is more than half of the times it's the third parties that are alerting hospitality industry about the breaches. It's not the hotels themselves that are recognizing these breaches. It's the third parties, either credit card brands or law enforcement that is saying that, hey, you're breached, you need to do an investigation. And this is an important point. There's no real definition of who's trusted and who's not. So think about flagship properties. Obviously, they trust each other, right? And then there are property management firms who can have multiple flagship properties, right? So for an attacker, it's a big advantage because of these trusted networks. If they get into one flagship, not only that they can move around to the other flagship properties, but they can also find ways to move to other property management firms and then move to— other flagships that are— that is not the same flagship as they actually initially broke into. That's a big problem. Like, is the hotel itself the only trusted network, or all the flagships are trusted, or all the property management firms for the same owner? So that is something that needs to be defined. And my recommendation is it's only the property itself that's supposed to be trusted. All others, no matter it's another Marriott down the road or another flagship hotel owned by the same owner, they should not fall under the trusted network category. So this is the recommendation. The firewalls need to be audited to make sure that the trusted and untrusted networks are defined. The other thing is log monitoring and correlation and threat intelligence component, which is very necessary to understand the new attacker footprint. You know, when I have investigated hotels, this is one thing that I've seen missing. There's no log monitoring and correlation. So basically the devices are logging, but nobody's out there checking for malicious traffic on the network. So that is something that needs to be done. Make third parties accountable. So I guess in any given breach, we were always told, hey, you know what, we allow this access even though it was unsecure because our third party told us to do so. So I guess if your third parties need some kind of special access, then make them liable for PII breaches. And then let's see if they want to allow insecure access to your network. And remote access should be on demand. It should not be allowed 24/7. It should only be allowed when you need it. So that nobody else other than the legit people can come into the network. And then in proactive defense, penetration testing is important to figure out how much— how weak you are inside. And then also the incident response plan. It's not wise to make all the decisions when you're under attack, under the panic zone. It is recommended that you think about what you're going to do once you get breached before, so you're not making decisions while you're in— So those are my quick solutions here. I will turn it over.

Thank you so much, Jibran. We're now going to hand it over to Christine Marciano, and Christine is president of Cyber Data Risk Managers. As an insurance broker, Christine specializes in cyber and data security risks and helps businesses and organizations create a data breach incident response plan. response plan through the utilization of a cybersecurity and data breach insurance policy. We often think about how to prevent a breach, and we may have a plan for the reaction afterwards in case something happens, but Christine has some revealing insights into things we don't often think about when creating our plan, and she's going to explain how insurance can help if you ever find yourself in a reactionary situation.

So, Christine?

Thank you, Jibran.

Thank you, Evelyn. You might be familiar with this quote by Benjamin Franklin, in this world, nothing is certain but death and taxes. I think today, it's really no longer a matter of if, it's a question of when. When is that cyberattack and/or data breach going to happen to your organization? Today, developing a data breach incident response strategy is key. Hotels must be prepared to react on several fronts when confronted with a data loss incident or breach. So the first step I'm going to talk about, and my only step, is creating an incident response plan. An incident response plan would incorporate creating an incident response team. Today, being prepared for a data breach and/or data loss incident is good for your organization, your brand, and most importantly, your guests. So the first step would be to create an incident response team, determine who's going to take charge, who are your 24/7 first responders. Today, plans need to have the ability of being activated 24/7. It's always a good idea to develop ahead of time who you want to work with as far as vendors and have law enforcement relationships in place. You want to create and document a plan. Plans should address things like what are the regulatory obligations and should law enforcement be notified, and also how will the breach be communicated. Creating notification tree. Today, with over close to 46 different state privacy laws, it's always a good idea to be proactive before a breach happens and determine exactly who you need to notify once your data breach happens. Having communication templates and scripts already prepared ahead of time just reduces the stress that could happen once your data breach occurs. Developing on-call resources and remedies. Here, once your breach happens, will you be offering credit monitoring? It's not required, but these are things to think about before the data breach incident happens. And of course, employee training. Providing baseline privacy training to your employees is a great step, as we're going to be learning in a few minutes from Marian. Regulatory and legal review. It's a good idea to do a legal review of all your service providers' policies and business practices at least annually, and also most importantly prior to the selection of those vendors that you'll be working with. And it's a good idea today to explore cyber and data breach insurance, just because responding to a data breach is often an unbudgeted expense. So cyber insurance can really help mitigate those costs. So how can a cyber and data breach incident insurance policy help after a security incident? Well, number one, it offers a turnkey incident response team to be able to help manage the aftermath after your data breach or security incident happens. It minimizes the impact of the reputational damage that could happen to your organization, and it also helps to mitigate penalties and response expenses. It provides access to a data privacy attorney who can help really take the stress off of you and help you navigate the 46 different state privacy laws today that you're subjected to once your data breach happens. And of course, it helps to minimize the uncertainty of managing a comprehensive and effective response. Today, when a breach happens, if you don't have a plan in place, such as an incident response plan, it really could be really stressful navigating the 46 different state laws, notifying all your guests, and all the particulars that go involved— are involved once a breach happens. So that's really where a data breach insurance policy can really be key in helping to be able to offer that turnkey response to your organization to be able to help respond to the event. And some commonly offered data breach insurance coverages. Once your breach happens, your guests need to be notified. This is something that would be covered under the insurance, the guest notification letters. Credit identity theft monitoring is a key piece. It's not required, but it's become an industry standard. This is something that's covered under an insurance— cyber insurance policy. It also offers help with security liability coverage if you should be subjected to a lawsuit down the road because of the breach. It could help with regulatory penalties and fines and legal defense, and it also offers, as we just heard from Jibran a few minutes ago, it could also help determine how did that breach happen, so you would have access to coverages such as the computer security expert and forensic investigation. And cost of a data breach coach, also known as the privacy attorney, and it also offers some help with pre-incident planning services and resources, so what I mentioned earlier about having those communication templates and things set We can help with that. We offer a turnkey portal under some of the insurance policies that we sell that would have access to this. It's important to note that all cyber insurance policies today are very different. They're not standard policies yet, so when you're exploring policies, it's always important to find out exactly what you're looking to have covered, and you, of course, want to know what's going to be excluded so you're not finding yourself at the time of the claim without coverage that you thought you had. Great. And really quickly, the way that insurance premiums are factored, some things that we look at are your annual revenue, what do you have in place today as far as your network defense parameters, your business policies and best practices, and the number of hotel guests you have in your registry, and loss history. Have you ever had a data breach or a cyberattack happen in the past? These are just things we look at when we're determining how much we're looking to charge in premium. Okay, well, I appreciate the time here. This is my contact information, so please feel free to reach out to me directly if you're looking for an insurance proposal. Thank you.

Thank you very much, Christine. And our final panelist today is Marian Hughes-Roget, and Marian is the Vice President of Business Development at Hospitality Evolution Resources. As a longtime hotelier, Marian brings her experience and insight to issues concerning the hospitality industry today. She actually spearheaded the training initiative, which led to our development with the Venza Group of PII training modules, and they look at the issue from the perspective of the individual roles of the hotel staff in protecting themselves, their colleagues, and the hotel guests. So today, Marian's going to share with us the importance of training at every level of your team to participate in the hotel's PII security plan.

Thank you. Good morning. So what we're going to be speaking about in this particular segment is how important employees are in preventing or minimizing data leakage. Up until now, we've been talking about data breach or cyberattacks. We're actually going to take a moment now and look a little bit more closely at some definitions because they're very key. The reason we're doing that, as Evelyn mentioned in the beginning, is that October is National Cybersecurity Awareness Month. This is the 10th year that there is a focus in October on being aware of the security issues in the age of digital data. It seems really fitting for us today to talk about education as part of awareness, because education and training are key components of data protection, whether we're talking about hotel guests' data, or our own, or our employees' data. The Federal Trade Commission has a very particular statement on this and is looking closely at industries who are involved in retaining personally identifiable information. We're all familiar with HIPAA and the Medical Act, or the information about financial institutional lending entities and the rules that they are required, like Sarbanes-Oxley. The Federal Trade Commission has come out and said that all companies should adopt a privacy-by-design approach by building privacy protections into their everyday business processes. As we know, the law of the new land in the digital environment is extremely complex, but the Federal Trade Commission has made it clear. Privacy is designed to be a built-in feature in data collection, data classification, analysis, or any kind of information systems, and not an afterthought. This short segment on the third part of today's webinar will cover data loss concepts and review how training is one of the key ways to keep. Data loss. There's a difference between data loss and data theft. Data loss is the result of an accidental misplacement of the data rather than its deliberate theft. And data theft is the deliberate theft of information rather than accidental loss. Data loss frequently occurs through the loss of a device such as a laptop, a mobile phone, a USB key stick. When these things are lost, guest data is at risk, and so is employee data, of falling into the wrong hands unless an effective data security technique is used. Data theft can take place both inside and outside an organization. Inside the organization, it might be by a disgruntled or careless employee. Outside the organization, it's by criminals who intentionally target you or target your employees' laptops. Or create traps for your untrained employees. They may even manage to spearphish and send fraudulent emails to executives appearing to appear to be from the Human Resources Department. A key point here is that the majority of data loss or data theft, which we will now refer to as data leakage, is not necessarily through the IT system, the computer itself. But through human carelessness, and the vulnerability is the first line of the front line, and that is staff. So now that we're clear about what data leakage is, let's just give it a definition. It's the unauthorized movement of information outside your organization. In other words, it can be deliberate, as we mentioned data theft, or it can be accidental, which is data loss. I am a big fan of Dilbert in the office. And I know there are a lot of people who are as well. And as you can see from this little cartoon, he's explaining to this top guy that the firewall is down and bad stuff's getting through. He's even mentioning that he's seen viruses and spywares, tuberculosis, zombies, a deposed dictator, even an iPhone 5. And then he gets an update that a mole from another dimension has tunneled through. And of course, the boss says, okay, well, keep me informed. The key here is that boss has no clue of the importance of it, and perhaps it is due to a lack of training. No matter how it happens, data leakage is a top concern from guests to employees to managers to owners to REITs. Breaches are dominating the headlines. Even the government organizations that are supposed to protect us have failed to protect our confidential information. In fact, just last week, the software giant Adobe announced it had been a victim of a cyberattack. And thieves managed to get away with customer IDs, passwords, and hacked over 2.9 million accounts. Data leakage usually happens because users routinely use and share data without giving sufficient thought to confidentiality or regulatory requirements. But it's not their fault. Often, they don't even know they're doing something wrong. Or, as a consumer, i.e., the guests at your hotel, they assume that the entity they're giving your information to Is protecting it. Naturally, there's a variety of techniques that can be used to prevent data leakage, and most of you are probably well aware of the options. It might be antivirus software, encryption, point-to-point encryption, tokenization, firewalls, access controls. You've done everything you can from a technological component to make it secure. And of course, nobody's saying that IT isn't the secret key, but it also will convey a false sense of safety, and that's what the criminals are counting on. IT often conjures images of high-tech and very expensive systems, and upgrades, and obsolescence, and training, but experts agree across the board. The first real area for security to look into is actually the simplest and the most cost-effective, and that is employee training. Dilbert's here again. Employees are really your key because they're the first people touching the data. As mentioned, mistakes are made by people and systems. Those are the key causes of data leakage. Together, human errors and system problems account for 64% of data leakage in a global study by Ponemon, who's a leading data loss research firm. They found that 62% of employees think it's acceptable to transfer corporate data outside the company, and the majority of them never even delete the data, leaving it vulnerable to data risks. This illustrates the large extent to which insiders contribute to data breaches and how costly that loss can be. But, you know, we always hear the same thing. Insiders are the greatest threat, and I appear to be one of those who's continuing to propagate that story. Many people assume that insiders are malicious. We have found at Hospitality Evolution Resources that insiders can be broken down into 3 categories. The first and most common category The second largest category are careless and untrained employees, which are, in fact, the one thing hoteliers can do something about and not have to spend a lot of money doing it. Employees can be duped or fall prey to social engineering attacks. I mean, come on, even the smartest people can be outsmarted. And the third group are the malicious employees. The reason it's important to understand that there are 3 types of insiders is because protecting your network and training to protect critical and sensitive data will be done very differently for each type of personality. And given untrained or careless employees are the top of the list at your hotel, it's probably the easiest group to address and the most important. In fact, Poneman has found that accidental disclosures occur far more frequently than deliberate incidents. So incidents that happen by careless employees or untrained employees are the most important part or the largest majority of insider incidents. Data privacy and data protection education should be a top priority on the training curriculum, and it is at the majority of leading hotel groups today. So the question begs, well, why train? How do we train? When do we train? What do we train them? We're here to answer that question at this point in the session today. A significant aspect of data privacy is emerging in customers' expectations about how their data is used or abused. Considering the investment that hoteliers undertake to deliver a quality guest experience, why would we take the risk of losing customer trust, loyalty, and brand preference due to a simple careless mistake made by an untrained employee? Behind the scenes, data privacy sounds foreboding. And so when it comes to understanding and implementing the laws and regulations, it looks like a maze. But what data privacy really boils down to in the face of a business is the trust relationship between the guests and staff, and those staff are your first contact with the guests. Key points in training include allowing your staff to learn in a stress-free environment with a curriculum that's focused on the role of the person being trained. While it's useful to start with a 30,000-foot-up perspective of what everyone should or shouldn't do at the property. The real and valuable training are lessons that provide information that they can apply daily to the activities and responsibilities they specifically have. Staff training should be fresh and light, easy shorter versions that can be repeated several times if they feel there's an area that they're not comfortable with or haven't mastered. Light in the sense there's only so much time a learner can take off from the workplace and only so much one can absorb in a given window of learning. Yet at the same time, it must be serious, realistic, and provide them with useful information about the dangers and risks. One of the most useful tips that we have found in training, in any training curriculum, is to incorporate the approach that allows the learner to see themselves as getting something out of it as well, not just the hotel guest. In other words, a really good training session on data protection at a hotel Would start with information about how the hotel is protecting their employees' information from criminals, and how the employee can learn to protect himself or herself and his family when at home, online, or traveling. Once they see the value and the risks involved with being careless or not understanding the risks, then they're more willing to understand the role of trying to protect the guest Security awareness is a key part of training. It's part of the 12 steps of PCI compliance. It's part of what helps you incorporate and earn lower policy premiums if you buy data risk insurance. So training is also going to play a valuable role in some of your requirements. Remember, all it takes is an employee who's going to forward sensitive information in an email Without even realizing that sensitive information shouldn't have been in the email in the first place, or the unfortunate theft of a company-issued laptop, USB flash drive, or smartphone. So to patch up these and other internal leaks that would put data at risk, instituting a formal policy and procedure system at the hotel is just the first step. It's one of many steps. The real first step in designing an effective awareness training program is Internally, for your key executives to determine what kind of information has to be protected. All key messages should be aligned and oriented on the types of information that are important to safeguard and why. Of course, there's been an emphasis on credit card data in the past few years, thanks to the payment card industry, and this is critical in the hospitality industry. But the reality is, there's way more information about a guest than a credit card number, and when those other pieces of information are put together, they can obtain the credit card number. None of that information is ever encrypted. Furthermore, employee information is often overlooked. Hackers will target that as well because it contains Social Security numbers and bank account data for payroll and expense reimbursements. Your marketing information, i.e., your loyalty member club, contains a vast treasure trove of contact details, phone numbers, home addresses, children's names, ages, Places of employment, and frankly, if accounting or financial records at the hotel are ever breached, the consequences will actually disrupt or hinder your critical business activities and lead to potential fraud. No matter how you look at it, it's the bottom line. The bottom line is this: poorly untrained employees heavily impact the bottom line in a negative way. But let's be honest, putting up a 45-page security policy manual on the company intranet or making them sit through a 3-day session, while it's necessary, it's not going to qualify as a really efficient training program. Remember how we learned a second language or memorized the lyrics to our favorite song or in fact developed any new habit? We did repetition. With security awareness, repetition of the key messages that you want to communicate must come through in different ways in order to drive and influence staff behavior. Frankly, think of security awareness training as an internal marketing campaign. Why not tap into your internal team to get the best techniques for your work and culture? Remember, we hoteliers are already training our hotel staff on how to interact with our guests, how to do everything we can to make them happy. What we're really saying today is that it's long overdue to train them on how to interact with our guests' digital DNA. Thank you.

Thank you very much, Marion. I appreciate the time for all of our panelists.

Okay, well, if no one has questions, that is it. So thanks so much, everyone.