Supervision of hotel IT and telecommunication systems security

Most cheaply and most effectively at design stage, before anything is built. Security requirements then go into the specification and the acceptance conditions, so the burden of demonstrating compliance sits with the contractor and supervision is merely the proof of verification. At that stage they cost nothing beyond a clause in a document. The same error caught after commissioning costs a rebuild of a working property. We do, however, also work with properties just before and just after opening.

Yes. In March 2024 researchers disclosed a flaw in one of the most widely used hotel lock systems that allowed a card opening any door in the property to be prepared from an ordinary guest card. It affected more than 3 million locks in 131 countries, and at disclosure around 36 percent had been remediated. We verify the logical layer of the lock system: accounts and passwords, software currency, the supplier's service channel and the integration with the PMS.

Each of them is responsible for their own system and usually does it correctly. The problem arises at the seams: nobody is responsible for how those systems look together once connected to one network. Our role begins exactly there. We do not step into the remit of contractors or construction inspectors and we release nobody from their obligations — we check the layer that no single acceptance protocol covers.

Because a guest on the hotel network can see considerably more than they should if the guest network is not genuinely separated from the property's systems and guests are not isolated from one another. In a documented case at a casino, attackers entered the network through a smart aquarium thermometer in the lobby and reached the database of the property's most valuable customers through it. We do not judge devices by how important they are, only by what they have access to.

No, though the shape of the work is different then. For a property close to opening we propose a pre-acceptance audit: an inventory of what has actually been installed and configured, verification testing (vulnerability scanning, checking what is visible from the internet, a practical attempt to cross from the guest network into hotel systems, a wireless survey under target conditions), and a list of findings ordered by real consequence, split into what must be closed before opening and what can be improved later.

Increasingly, yes. Questions about security controls come up when placing policies, in agreements with hotel brand operators, and in tenders for corporate client accounts. In an inspection or after an incident, what counts is not only which controls were applied but whether due diligence can be demonstrated. A register of non-conformities with the history of their resolution, and a final report with an acceptance recommendation, are documents prepared once that answer all of those questions.