The NCCoE has released the final version of NIST Cybersecurity Special Publication 1800-27, Securing Property Management Systems. For ease of use, this guide is available to download or read in volumes.
Hotels have become targets for malicious actors wishing to exfiltrate sensitive data, deliver malware, or profit from undetected fraud. Property management systems, which are central to hotel operations, present attractive attack surfaces.
The NCCoE built a PMS reference design to demonstrate methods to improve the cybersecurity of a PMS. The PMS reference design included the PMS, a credit card payment platform, and a door key access control system. The principal capabilities of the reference design include protecting sensitive data, enforcing role-based access control, and monitoring for anomalies.
Aspects of zero trust architecture, moving target defense, tokenization of credit card data, and role-based authentication were demonstrated.
The value of the data in the Property Management System makes it a prime target for bad actors.
An unsecured or poorly secured property management systems could expose a hotel—and the larger hospitality organization of which the hotel is a part—to a significant and costly data breach. This video provides more information about this challenge and an overview of how the NCCoE’s efforts can support your hospitality organization.
Organizations participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). The following respondents with relevant capabilities or product components (identified as “Technology Partners/Collaborators” herein) signed a Cooperative Research and Development Agreement to collaborate with NIST in a consortium to build this example solution.
A Community of Interest (COI) is a group of professionals and advisors that share business insights, technical expertise, challenges, and perspectives to guide NCCoE projects. COIs often include experts, innovators, and everyday users of cybersecurity and privacy technologies. Members typically meet monthly by teleconference. Share your expertise and consider becoming a member of this project's COI.