As the previous detailed review of the recent cyber breach of Marriott's
systems made clear, the protection of the company's payment systems is
essential to its survival. c The temptation for individual locations to adopt new
technologies such as RFID micro payment systems to increase revenue
requires thorough review and clear policy guidance at the corporate level. c
This guidance should be applicable to all locations. c The following security
risks have been identified as being associated with the use these systems.
Risk of PCI compliance issues
c Traditional payment methods have become more secure in recent years with
security features such as NFC chips. c Most vending machines accept this
form of payment. c Implementing a new RFID system needs to be at least as
secure as NFC chips. c
Extra Liability for the company for PII security
Our locations that have put systems such as this into practice have likely not
vetted their providers to the extent necessary to protect Padgett-Beale from
any breaches of customer data. Does the third-party provider ensure SOX
compliance within their own systems? c What procedures and gaurantees are
in place in the event of a system breach? c IS GDPR complied with?
Increased Complexity of Accounting
Padgett-Beale's current financial system covers the existing transactions
anticipated by customers and offered at our locations. c c If each location is
able to add their own thrid-party micro payment system, it will increase the
complexiity of accounting at the corporate level. This may lead to
unintentional security complaince issues as tracking is made more difficult.
Security of RFID cards and readers
When an RFID card is enabled at a location, is a procedure in place to
deactivate it? c Who is responsible for the physical security of RFID readers? c
These questions need to be asked to management at each location that has
implemented this Shadow IT system.
Customer trust across locations
The uniformity of customer experience across Padgett-Beale locations
provides a level of trust to our customers. c They know that when they stay at
different locations, they are assured of safe and secure transactions. c When
individual locations change that uniformity, it may cause customers to ask
why such systems are not in place at other locations. c Were it to be revealed
that such systems were not condoned by corporate, we could have a crisis of
confidence from our customers.
For the above reasons, it is recommended to evaluate the financial benefit of
utilizing micro payment systems at all Padgett-Beale locations. c If it is
determined to be financially beneficial, then a single RFID vendor should be
identified, vetted and chosen via contract. c c An additional step is to
communicate the risks of setting up shadow IT systems and require that any
locations using such systems immediately cease doing so.
