By David Mulhall
No one is talking about it, but everybody knows. It is the secret that is best left unspoken. “Don’t tell anyone, we just got hacked.” No access to our data. Guest experience chaotic in just minutes.
Hotels and resorts are at risk like never before. Just when you thought you had seen it all, an industry reeling from COVID, travel disruptions not seen in a hundred years, and now Cyberterrorists are striking. These bad actors are successfully demanding and receiving huge ransoms. We have heard of one recent case where the ransom paid was $500,000. While this is truly substantial, it is only one part of the threat. The resulting damage from the interruption to business operations and your carefully guarded reputation is worth far more.
While ransomware attacks cannot be fully mitigated, the effects of these attacks can be greatly curtailed. With proper preparation, a return to normal business operations can be minutes and not days or weeks away.
The Threat
Ask yourself and your team these basic questions:
- How do we keep our primary data safe from ransomware, malware, and other threats?
- How do we keep backup copies of our data safe from ransomware, malware, and other threats?
- What is our recovery point objective (RPO)? Our recovery time objective (RTO)?
- What is our plan if we get hit with ransomware? Have we tested this plan fully? When is our next test?
Your customer data has great value. It is possibly the most important asset that you have and oftentimes it is largely unprotected, or the protection is inadequate. Traditional virus and malware protection serve their purpose, but they only offer a piece of the solution. Onsite data storage is at risk for infection and recovery by this method can be further complicated by these sophisticated engineered attacks. The Cyberterrorists know this, and they exploit this weakness for big money. Hotels and resorts, large or small, high profile or not, are easy targets. The potential for business interruption is great and the recovery can be painful and difficult. The more pain inflicted, the higher the ransom potential.
The approach for many is to simply insure against these attacks. They feel that if they are attacked, they will just pay the ransom and recover. This is a common approach, but it does nothing to address the business interruption potential or the impact that this interruption will have on your guest experience and reputation. Recovery with this approach typically takes days and in many cases weeks. The impact can and will be long lasting.
The Solution
You can fight back. You can reduce the risk of unnecessary downtime. The solution is at hand and it is very affordable.
Technology today provides for the ability to create an immutable backup copy of your data offsite in a secure data center. This data backup can be created on your schedule allowing for near complete recovery if the need arises. As you are likely aware, industry standards today suggest the need for such offsite data storage. Unfortunately, few companies are meeting this standard and the risk remains great.
Current technology also allows for a temporary relocation of key system operations to the Cloud. Systems can be quicky and effectively redeployed. This assures little to no interruption to the business and this also delivers an effective roll back strategy from a potential attack. These Cloud based temporary deployments should be periodically tested as part of your disaster recovery plan to ensure that they perform as intended.
As an industry, the proper approach can and will reduce the risk for all. The terrorists and hackers will move on to more vulnerable targets. They are looking for a quick and easy hit.
