In this series, we are addressing the top security and compliance challenges faced by hospitality brands and properties.
Of the three key technology issues that have a direct strategic impact on the hospitality industry, the number one issue is compliance with the Payment Card Industry Data Security Standards (PCI DSS).
This week, we're focusing on challenge #3 - information security awareness, and, in particular, the level of security awareness among hotels, restaurants, retailers and similar businesses.
Education Can Help Prevent a Data Breach
Employees are often the weakest link in the data security chain. Of the hundreds of security incident investigations performed by Trustwave in 2011, 87% of companies that experienced a data breach did not have security policies in place. And, in those investigations, only 32% of employees said they had received education on their organization's security policies.
Furthermore, in the recent Information Week's 2012 SMB Strategic Security Survey, spreading user awareness ranked as the top 5 of biggest security challenges faced by security professionals, with enforcing security policies ranked number 2.
This issue is made worse in the hospitality and retail industries, with their relatively high staff turnover rates. Providing consistent education on security best practices and encouraging knowledge transfer is often difficult to achieve as a result.
It's Not All Bad News
Security awareness is a challenge for many businesses…but it doesn't have to be.
First, make security awareness education a priority in your overall information security policy, processes and procedures. Security awareness education can be an effective means of enforcing information security policies and the handling of sensitive data.
Second, consider ways to efficiently train employees, and build the foundation for an awareness program on:
- The ability to track education participation and measure knowledge retention
- Executive endorsement, stressing the importance of the program to the company as a whole, to encourage adoption and participation
- Continuous training with explicit communications and materials that are readily visible and available to employees new and old
Finally, if necessary, engage a third party with expertise in providing security awareness education programs to help establish and maintain those foundational elements. A third party can also help automate much of the process.
