In the past 10 years two reservation systems, SavvyBooking and now
SuperInn, have been compromised and
closed their doors, forcing their clients to quickly go elsewhere.
Q: What can you do to protect your business?
A: Make sure that your software provider is not performing their own security audits.Both SavvyBooking and SuperInn performed their own internal security and PCI audits. While these companies would use tools and scanners to detect weaknesses, they didn't use an outside security company to verify their security and procedures.
Data breaches can happen to any business. There is no guaranteed way to prevent being "hacked", but having your PCI compliance assessed by an outside security company has shown to dramatically reduce the chances and effect of hacking events.
There are still several major players in the bed and breakfast industry, like ThinkReservations, that are avoiding PCI compliance through external audit.
Q: How can you tell if your software provider is truly PCI compliant through external assessment?A: Ask your reservation software to send you a copy of their PCI Compliance. Or Google it: "ResNexus PCI"
Here is a link to the ResNexus 2020 Certificate of PCI Compliance. The certificate should be for the company but certified by an auditor. If your software provider cannot produce a PCI certificate, they are simply not compliant. If it is a self assessment PCI certificate, you now know that you are with a company that doesn't use an external security company to help verify their security practices and software.
Q: What if my software provider tells me they don't need to be PCI Compliant through audit?A: Even if reservation softwares are not storing credit cards, they store guest information. Getting hacked means your guests are still at risk. Self audits simply are not as effective as external audits.Q: Why do some software providers like ThinkReservations shy away from external PCI audits?A: It's expensive and time consuming.
It costs hundreds of thousands of dollars a year and takes months of dedicated time to pass these audits. At ResNexus, we have consistent visits from outside security professionals at our headquarters to review our PCI security. They sit down with us in person and verify thousands of security procedures and protocols. The audit company uses tools and professional hackers to try to compromise ResNexus. Each year new security standards are added. We make constant security updates including those that are not required but advised.
Q: What other security precautions should I look for?
A: Ask your property management software if they offer two-factor authentication. ResNexus does provide that advanced security feature.
