If it Can Happen to Equifax…it Can Happen to YOU! Protect Your Restaurant From a Data Breach

September 12, 2017

By Jason VanGotten, Colorado Restaurant Insurance —

Restaurants can learn critical lessons from Equifax’s massive data breach. When basic security precautions are not being taken with internet usage, losses are the real threat. There are two possible news headlines when a data breach occurs. One says, “Restaurant fails to follow basic security principles. Customer’s information compromised.” The other, “Despite best practices, hackers get in!”

 

It seems that people are getting breach-deaf. They hear the same warnings over and over and see the same headlines of cyber breaches. They seem to think, “It won’t happen to me! We are too small to be on the radar of a cyber-criminal.” This is why precautions are not being taken seriously. But, these are unlocked doors that allow opportunity for thieves. Cyber-criminals scan buildings and neighborhoods for Wi-Fi connections like “Linksys” and then run through a list of known “out-of-the-box” passwords to see if a network was left unlocked. The reality is that 9 out of 10 data breaches involve small businesses. 65 percent of all breaches are point-of-sale terminals or are web application attacks. 78% of small businesses do not have a cyberattack response plan.

 

Why would cyber criminals go after a small business? In most cases, the owners of small businesses have not been educated about cyber risk and many of them do not have the resources to stay ahead of the perpetrators. How can businesses protect themselves from these cyber-criminals?

 

  1. Educate and empower yourself and your employees to identify the potential issues.
  2. Know where all your sensitive structured data resides and never store cardholder data.
  3. Never transmit data that is not encrypted or over public Wi-Fi networks.
  4. Always outsource payment processing to combine point-to-point encryption and tokenization technologies.
  5. Use layered security such as multi-factor authentication which uses a combination of a password and another factor to verify identity.
  6. Install and regularly update spyware, anti-virus and malware software to help prevent and detect these from affecting your computing systems.
  7. Set social network profiles to private and check security settings. Also, be mindful of what information you post online.
  8. Protect the perimeter to prevent hackers from accessing sensitive data and your company’s computer network.

 

Cyber liability losses can strike with little to no warning, and that a vulnerability can leave you with a costly mess from data recovery to rebuilding your restaurant’s reputation. You lock your doors and turn on the alarm system at night for safety; why not take the same approach for cyber security?

 

If you have questions about cyber security, compliance, or what you can do to protect your business, contact Jason VanGotten at jvangotten@corestaurant.org

 

Sources:

Upwork Blog

Heartland Payments Systems

Trusted Choice – Colorado Insurance News

Understanding How to Become PCI Compliant

September 1, 2017

By Jason VanGotten, Colorado Restaurant Insurance —

 

Have you heard of the PCI DSS (Payment Card Industry Data Security Standard)? If not, they provide the standards for all merchants that store, process, or transmit cardholder data. If you are processing credit cards in your restaurants, you are responsible to comply with this standard. Click here for the details.

 

Nearly every restaurant owner has heard of it, but it remains a source of confusion as to what is required of small businesses. However, the good news is that PCI DSS compliance does not have to be confusing. Before we dive into what it takes to become PCI DSS compliant, let’s talk about the challenges restaurants face.

 

The big piece to the PCI DSS compliance pie is limiting employee access to data. Keep in mind the number of servers on a given shift who run credit card transactions, this means multiple machines and multiple staff members with access to physical credit cards. To help ensure you are in compliance, it is imperative that you use unique employee IDs and properly encrypted systems. An outdated point-of-sale (POS) system or credit card terminal typically will not encrypt the data that is processed through them. If your POS software or credit card terminals are outdated, you can contact your merchant processor to see what they offer as an upgrade to provide data encryption and if your systems require an upgrade.

 

The National Restaurant Association states that, typically, restaurants that run the highest risk of a data breach use unsecured Internet-accessible networks, like DSL, cable modem, or wireless technology. They may also be using non-compliant POS software that stores credit card data improperly.

 

There are six categories of PCI DSS compliance (refer to the link above for detailed information) requirements, which are:

 

  1. Maintaining a secure network
  2. Protecting cardholder data
  3. Protecting your systems against malware/spyware
  4. Putting strong access control measures in place
  5. Monitoring and testing your networks
  6. Creating an Information Security Policy

 

You may be thinking after looking at these six categories, “How can they expect small businesses to manage these six categories to stay compliant?” The keys to PCI DSS compliance include proper network security, careful handling of customer cardholder data and the use of only the PA-DSS-validated (Payment Application Data Security Standard) POS and payment processing systems. You can find a list of PA-DSS- validated POS providers HERE.

 

You are also required to complete a “self-assessment questionnaire” (SAQ) on an annual basis. The basic SAQ generally takes about 15 minutes to complete and provides the restauranteur with an opportunity to review their business policies and practices related to credit card transactions and data storage.

 

The bottom line is that PCI DSS compliance is required and this process helps your restaurant from data breaches and the fines and penalties that come with them. Card data theft is costly. Therefore, familiarizing yourself with the policies, and properly training your staff will end up saving you time and money while also protecting your customers and restaurant from a data breach.

 

For more information pertaining to PCI DSS compliance, please contact Jason VanGotten at jvangotten@corestaurant.org

 

Sources:
Clinard Insurance – Restaurant Blog 2016