Archive for category Legislation

Visa Europe releases best practice guidelines to help hotels protect customer data

Visa Europe, Europe’s leading payment system, today launched the first whitepaper aimed at helping the hospitality industry safeguard customer data. ‘Hospitality Breaches on the Rise’ offers insight on how cyber-criminals target hotels, and guidance on how data can be protected to help businesses comply with the Payment Card Industry Data Security Standard (PCI DSS).

Research by Trustwave, a Visa Qualified Forensics Investigator (QFI), found that 38% of all card compromise incident investigations in 2009 occurred in the hospitality industry – highlighting the need for hotels to protect their payment systems.

Hotels can have more complex payment systems than other retail businesses, making it harder for them to achieve PCI DSS compliance. Compared with some retailers who may have only one point-of-sale, customer card data is stored and retrieved at multiple pay terminals within hotels, such as the reservation desk, restaurant, bar, or for room service, internet access and online bookings.

Visa Europe and Trustwave, in consultation with leading hotels, has developed a series of recommendations to help hoteliers and franchises lower the risk of security breaches:

· Change vendor-supplied defaults for passwords or other security information for Hotel Management Systems (HMS) and Point of Sale (POS) payment systems. The HMS is the central and core component in which cardholder data is stored, processed and transmitted to perform authorisation and settlement across other payment terminals in the network
· NULL sessions (unauthenticated connections to a Windows computer) should be disabled. This is the number one method for hackers to gain information on passwords, groups, services and users
· Install and maintain a firewall to protect data. HMS and POS payment systems should not be directly accessible via the Internet; inbound traffic should be blocked and outbound services should be filtered
· Assign a unique ID to each person with computer access and implement a dual-factor authentication method for remote system access via the Internet. This will mitigate unauthorised access into HMS and POS payment systems
· Track and monitor all access to network resources and cardholder data to track and monitor anomalies and suspicious attack activity

Stanley Skoglund, Senior Vice President Payment System Risk at Visa Europe said, “Cardholder data held by hotels is a potentially lucrative hub of information for fraudsters who view the hospitality sector as an easy target. By understanding the nature of security threats and the preventive measures that can be taken, hotels can reduce the risk of compromise. Hotels make up a large proportion of data compromises and Visa Europe is keen to work alongside the industry on initiatives like this white paper, to help increase awareness, to help strengthen defences, and reinforce consumer trust.”

Visa is introducing a range of guidelines for retailers including advice on emerging technologies such as data encryption and tokenisation, which help secure card data when it is either being moved or stored and make it simpler to achieve PCI DSS compliance.

For more information for Visa’s PCI DSS compliance guidelines and Visa’s Hospitality Breaches on the Rise whitepaper click here and look under Vulnerability Guidance

No Comments

To Sky or not to Sky, that WAS the question.

By Tony Holman of Crown Awnings

In my younger days I was a main player in the building of our country’s nuclear deterrent (Trident) and I was reasonably well known throughout the hallowed halls of the MOD. I would like to think this fame was due to my intellect, debating skills and wit but in reality and being a keen fan of the Sex Pistols it was probably more likely to be my 18 inch green Mohican hair style intermingled in a sea of grey suits. One day whilst on walkabout the conservative Minister of Defence at the time put his hand on my shoulder and said, You know what son. “If you are not a communist at 20 you have got no heart, and if your still a communist at 30 you’ve got no brain” and you know what? He was right on both counts.

The moral of this little story is that if you did not have an EU scoured foreign satellite system for the 2009-2010 season then you had no heart and if you still have none for the 2010-2011 season then you have no brain, and here’s why.

Life is full of opportunity and regret and when the high courts in London referred the FAPL Vs Foreign Satellite dealer’s and users to Europe then this opened up a window of real opportunity for those of us with a heart.

That window of opportunity was to run an EU system such as German or Italian alongside British Sky as both these systems show the all important 3.00pm kick off. They compliment BSyB and if run in conjunction would give wall to wall sport and you would enjoy an enforced amnesty for a limited period of time. This window existed because it would in my opinion be impossible to prosecute anyone using a European System until after the court case which was at the time expected to take place sometime between October 2009 and October 2010.

The commonly held belief then (and it still stands today) is that the European Court will conclude that due to poorly written EU law a “loophole” had been created that allowed the use of EU sourced foreign cards in UK pubs, but that loophole is now firmly closed and the practice must stop with immediate effect.
This may of course be complete rubbish and the Europeans found the practice to be illegal from the off in which case all bets are off and the perpetrators of the heinous crime are going to hell in a hand cart and that bridge needs to be crossed if this happens.

This degree of uncertainty is the reason why the use of foreign systems in the UK is not as prevalent as it could be and it’s certainly not a route that should be taken by the risk adverse or those of a nervous disposition. It was at best complimentary to Sky and at worst an illegal activity.

My personal involvement in foreign satellite commenced in public on the 24th June 2008 which is the date that The honourable Mr Justice Kitchen referred the issue to Europe. From that point on it became a commercial decision and not a legal one as to whether to go down the EU foreign route or not. I wrote to every multiple operator and pubco and indeed everyone I knew and told them so. I also told them that it was a window of opportunity and time dependent and they needed to act fast and gain first mover advantage if they were to benefit from the opportunity.

I also told anyone who would listen as far back as June 2008 NOT to sign up for an extended subscription package or buy any EU systems AFTER October 2009. This was as far as I was concerned the cut off date for the window of opportunity as a decision could be announced any time shortly thereafter, and that decision would always prevent the continued use of foreign systems commercially.

October 2009 was the agreement I had with others in the industry and it was commonly regarded as the safe bet. The reason for this is that none of us have a crystal ball and as stated it is the common belief that you will not be able to use foreign satellite after the hearing as at best it will be deemed to be illegal from that point on. At worst it could always have been illegal and prosecutions could start retrospectively so get the hell out while you can and if sport is good for you then sign up to Sky.

The risk to those users who continue to screen foreign satellite is that it’s due in court any time now and if you have signed up for a year or even two or worse still have paid up front then the card dealer in all probability will be sunning himself on some far away beach with his ill gotten gains. If you are on subscription then my advice would be to stop the mandate now and tell them to come and talk it out. Sign up to Sky and let the MPS go after the low hanging fruit who still openly flaunt the law, you got away with it so get out whilst the goings good and your integrity intact.

I exited the business as promised in October 2009 as I wanted to play fair but many others did not as the greed and easy money took control of their senses. It’s true the case has not yet been heard but that is more luck than judgement and anyone currently using or worse still depending on EU scoured systems has a very short shelf life and need to rapidly reconsider their position.

For those using foreign satellite systems scoured from outside the EU, that’s another story altogether. Without wishing to offend you deserve to be horsewhipped but as that’s no longer allowed then the prospect of sharing a prison cell with the gay chapter of the hells angels is defiantly on the cards for you my boy. Your children will put in the care of a catholic priest and your partner will be hanging around street corners providing “favours” for gentlemen and here’s why.

The entire legal defence meandering its way through the ECJ is based on the freedom of movement of goods within the EU. A past associate of mine argued that Albania is pretty close to the EU so it must be OK for him to sell them. I explained that he was pretty close to having breasts but it did not make him a woman! It just made him fat, stupid, deceitful and greedy.

Anyone selling commercially or using commercially NON –EU systems is without question breaking the law and sooner or later you will get caught. If this is you then throw it out now and call your supplier and demand your money back. This is not a case of me turning from poacher to gamekeeper it’s a case of simple common sense. Albania and for those of you who are geographically challenged is NOT in the EU neither is North Africa and they never have been. You are not protected from prosecution and any sharp suited fast talking salesman telling you different is simply having your pants down and preparing you for your inevitable visit to the aforementioned gay bikers love shack. if you are daft enough to take it then there are plenty of shady dealers out there willing to give it and I have it on good authority that it apparently makes your eyes water.

There is also another category of user out there even more stupid than then those geographically challenged felons awaiting a good rogering from their new biker friends and that is those who have purchased streaming devices or cloned cards and these people are committing a very serious criminal offence.

Cloning and streaming is theft yet I have heard of national pubcos promoting the latter which is stupid beyond belief. As the old adage goes “if something sounds too good to be true it probably is” and again it’s a case of greed from both the supplier and user who both pay less and make more. Both are thieves and both have no defence. WHEN caught you have no place to hide. You cannot act dumb and stupid because that is already a given and you will go to jail for a very long time.

During my time promoting the use of EU scoured satellite I always explained that SKY offer an incredible service and it’s not a matter of what it costs as that’s irrelevant and the simple question is does it offer my business value for money? . If for example Sky contributes double its cost to your margin or if your business is predominantly sports orientated then why on earth are you putting two fingers up at the golden goose? KEEP SKY and during the window of opportunity which is now well and truly closed you should have complimented it with an EU system.

I have lost count of the number of people who used to phone me and say my system (costing £2,500 PA) has gone down and they have lost £10,000 today. Well I am sorry that you are such an ignoramus that you want to jeopardise what is obviously a very good business for the sake of a few quid. Why on earth did you take out sky and what planet did you say you are from again?

As a final note and even if you are for example the cleanest of the clean Sky Italia supplier or user. There is no such thing as a legal commercial sky Italia card in the UK (or indeed any other non UK country of origin). Every single one of them out there is registered to a domestic address in Italy using a false name and a dubiously acquired national insurance number. That card is then shipped to the UK for onward sale to be used commercially, possibly by you?

The reason you sometimes experience viewing difficulty is that on average there are 7 links in the chain between the clandestine manor in which this domestic card was obtained and it reaching your pub. Whilst some or these links may be “Honest John” trying to make a living others could be fairly sinister organised crime. Money passes from you the user all along this chain and if some organisation does not pass it down to the next level then you and get turned off. That’s the top and bottom of it. “You pay your money and you take your chance” and hopefully you stay out of jail.

No Comments