Cybersecurity – systems for hotels

CYBERSECURITY

Merizon delivers comprehensive cybersecurity solutions based on a thorough audit, current criteria and the latest amendments to legislation.

What should a hotel keep in mind?

• Self-identification obligation
  The amended Act on the National Cybersecurity System (UKSC) has implemented NIS2 (Network and Information Security Directive 2). This means that large businesses must assess on their own whether they meet the NIS2 criteria and register with the competent register.
• Meeting the PCI DSS 4.0 requirement
  Compliance (Payment Card Industry Data Security Standard)
• Securing the cardholder data environment
  CDE Network Segmentation: the cardholder data environment (CDE – e.g. POS terminals, the PMS server) should be fully isolated from the guest network and the general office network.
• Network Isolation
  The guest network should be isolated from the administrative network.
• Vulnerability scanning
  The hotel should run internal network vulnerability scans every 3 months and take care of external scans (performed by a certified ASV – Approved Scanning Vendor).
• Personal data
  The GDPR requires the hotel to apply "appropriate technical measures" to prevent data leaks.
  According to the case law of the Court of Justice of the EU, IP addresses may constitute personal data if the controller has the legal and technical means (e.g. the PMS booking system database) to identify the individual using a given IP address at a given time.
• Security breach alerting/reporting
  A data breach must be reported by the hotel to the Polish Data Protection Authority (UODO) within 72 hours and to CSIRT NASK within 24 hours.
• Logs Retention
  Storing (encrypted) logs for up to 12 months.
  Telecommunications law requires operators to collect and retain data on the use of telecommunications services.
• Firewalls (Change Logs)
  Keeping logs of who changed the firewall rules and when.
• Patch Management
  Regular software updates for routers, switches and operating systems, within 30 days of release.
• Active monitoring & Alerting NOC (Network Operations Center)
  24/7: detecting unusual network behaviour (firewalls, switches) that may indicate a ransomware infection or an attempt to steal a database.
• Reporting
  Monthly reports (blocked attacks, intrusion attempts, connection attempts from suspicious IP addresses).
• Documentation
  Storing documentation in a secured cloud (MFA – Multi-Factor Authentication).
• Access Authentication
  MFA (Multi-Factor Authentication)
  Multi-factor authentication is mandatory for all administrative access to the hotel network (a password alone is not enough). An IT company logging in to the firewall remotely must use MFA.
• Unique Identification
  Shared accounts (e.g. "service", "admin") are prohibited. Every employee must log in with a personal account, so it is clear who made changes.
• Back-ups
  Regular backups (of switch and firewall configurations).
• Password management
  Changing access passwords to active network equipment.
• Maintenance
  Equipment servicing.
• Updating
  Reviewing firewall rules (at least every 6 months for relevance and security).
• Troubleshooting
  Incident response in line with the SLA.
• Minimum necessary
  Restricting access as far as possible, e.g. to firewalls; granting "read only" permissions.
• Time synchronization
  All devices (servers, firewalls) must have synchronised time (NTP), so the exact sequence of events can be established after a breach.
• Hardening
  Network devices must not use default manufacturer passwords (e.g. "admin/admin"). Each device must be configured according to secure baselines.
• Cybersecurity trainings
• Firewalls Redundancy
  Redundant firewalls ensure continuous protection if a device fails.
• IDS (Intrusion Detection System)
  Deployment of an intrusion detection system that monitors the network or system and alerts the administrator to threats.
• IPS (Intrusion Prevention System)
  Deployment of an intrusion prevention system that can automatically block attacks in real time.