Information Security: Holiday Inn Australia

The main aim of this report is to know about importance and implementation of information security in one of the most popular hotel brands of IHG, Holiday Inn. The primary focus of this information security is being given to the balanced security of CIA or confidentiality, integrity and availability of data during maintenance of a focus over effective implementation of policy, without even hampering the productivity of a specific organization.

Running head: INFORMATION SECURITY
Information Security: Holiday Inn Australia
Name of the Student
Name of the University
Author’s Note:

1
INFORMATION SECURITY
Executive Summary
The main aim of this report is to know about importance and implementation of information
security in one of the most popular hotel brands of IHG, Holiday Inn. The primary focus of
this information security is being given to the balanced security of CIA or confidentiality,
integrity and availability of data during maintenance of a focus over effective implementation
of policy, without even hampering the productivity of a specific organization. It is mainly
achieved by a multi-step procedure of risk management, which eventually identifies the
several vulnerabilities, assets, and possible controls, sources of threats and potential impacts
with assessment of risk management plan. The unauthorized users are prevented from making
any type of modification to program and data as well as unauthorized or improper
modifications for maintenance of external and internal programs or data consistency. This
report has provided a detailed strategic security policy for Holiday Inn with relevant details.
Moreover, major threats and vulnerabilities to the organizational network and systems are
also identified in this report and proper mitigation strategies are provided for them.

2
INFORMATION SECURITY
Table of Contents
1. Introduction............................................................................................................................3
2. Discussion..............................................................................................................................3
2.1 Researching, Formulation, Development and Documentation of a Strategic Security
Policy for Holiday Inn on the basis of its Nature and Stakeholders......................................3
2.2 Proper Identification and Assessment of Potential Threats and Vulnerabilities of
Organizational Network and Discussion for Mitigation of these Threats and Vulnerabilities
On the basis of Security Policy Developed............................................................................5
3. Conclusion..............................................................................................................................7
References..................................................................................................................................9

3
INFORMATION SECURITY
1. Introduction
Information security or InfoSec can be referred to as the core practice to prevent any
type of unauthorized utilization, inspection, disruption, access, recording, destruction and
disclosure of information (Von Solms and Van Niekerk 2013). This information or data
might undertake any form like physical or electronic. Basic guidance as well as policies are
being considered for encryption software, passwords, firewalls, user administrator training
standards. The following report outlines a brief discussion on information security for
Holiday Inn. A proper strategic security policy on the basis of nature and stakeholders for this
organization would be provided here. Moreover, a proper identification as well as assessment
of the potential threats or vulnerabilities of organizational network will also be done in this
report with significant mitigation techniques for Holiday Inn.
2. Discussion
2.1 Researching, Formulation, Development and Documentation of a
Strategic Security Policy for Holiday Inn on the basis of its Nature and
Stakeholders
IHG or Intercontinental Hotel Group is one of the most popular and significant multi
national hospitality organizations that has its head quarters in Denham, Buckinghamshire,
England. This particular organization has more than 830000 guest rooms as well as 5600
hotels in the entire world across more than one hundred countries. Intercontinental Hotel
Group involves some of the most popular brands like Holiday Inn, Hotel Indigo, Kimpton
Hotels and Resorts, Staybridge Suites, Even Hotels, Voco Hotels and many more.
Intercontinental Hotel Group comprises of several stakeholders and they majorly focus on
customers’ security and privacy. They try to keep their data confidential and maintain
integrity so that confidentiality of their customers’ data are not lost or compromised under
any circumstance. Intercontinental Hotel Group has opened their business in Australia few
years back and since then, there had been various profit share margins in the business.
Holiday Inn is one of the most popular and significant hotel brands under IHG. In spite of
having such distinctive and significant security and privacy, often it is being observed that
data could be hacked or breached by hackers or competitors due to high competition and
wrong intentions (Crossler et al. 2013). For this purpose, it is extremely important and

4
INFORMATION SECURITY
significant to maintain a proper and effective strategic security policy so that Holiday Inn is
able to maintain confidentiality or security of their information in an effective manner.
A strategic security policy of Holiday Inn is given below:
i) A proper planning is to be done, in which context is set and the business goals or
objectives are being understand (Peltier 2013). A proper identification of legal, statutory,
contractual and regulatory applicability. The major assets of Holiday Inn like database,
infrastructure devices, applications, sensitive or confidential data and facilities are to be
identified for learning about threats.
ii) A proper assessment and analysis id required for IT governance frameworks,
processes, practices of risk management and reviewing of documentations like manuals and
procedures (Siponen, Mahmood and Pahnila 2014).
iii) The current processes towards controls are to be reported and desired state is to be
determined for identification of remediation activities.
iv) Management of Holiday Inn comprises of some of the major responsibilities. The
CISO or Chief Information Security Officer must ideally be termed as the strategic
administrator and also responsible for effective creation, administration as well as
communication of the strategic security plan (Peltier 2016). He will assign other staffs for
managing subsequent tactics and for facilitation of strategic planning actions.
v) CISO would also assign a distinctive manager from every unit of business for
looking at the respective objectives and that particular manager would report progress
monthly on the basis of requirements.
vi) Each and every strategic goal of Holiday Inn would require adherence to few
objectives like implementation as well as acquisition of the common enterprise security tools
for maximization of cost reductions and ensuring integrity to the maximum possible capacity
that provide better visibility to security structure of information systems and networks of
Holiday Inn (Xu et al. 2014).
vii) The standardization decisions would also require to be well documented and thus
resulting standard would be incorporated within the enterprise architecture model (Safa, Von
Solms and Furnell 2016).

5
INFORMATION SECURITY
2.2 Proper Identification and Assessment of Potential Threats and
Vulnerabilities of Organizational Network and Discussion for Mitigation of
these Threats and Vulnerabilities On the basis of Security Policy Developed
There could be some of the major and the most significant threats and vulnerabilities,
which can be quite common to the organizational network and information security of
Holiday Inn (Yang, Shieh and Tzeng 2013). These noteworthy and subsequent threats and
vulnerabilities for Holiday Inn are as follows:
i) Virus Attacks: The first and the most common type of threat or vulnerability to the
organisational network and information in Holiday Inn is virus attack. It is a types of malware
that comprises of the core capability of replicating themselves by simply hooking them to the
specific program over the host computer such as videos or mails and then travelling all over
the Internet (Singh 2013). As Holiday Inn is a hotel, bookings could be scammed and
organizational network can be affected majorly.
ii) Trojan Horse: This is the second and yet another important and significant type of
threat or vulnerability to the organisational network and information in Holiday Inn (D'Arcy,
Herath and Shoss 2014). The major purpose of this type of malware is to eventually conceal
themselves within the software, which seem legal and as soon as the software is being
executed, they complete their tasks to either steal the confidential information or any other
purpose for which they are being designed. The various malicious programs get a backdoor
gateway to enter into the system and effectively steal the valuable data without knowledge of
Holiday Inn managers (Soomro, Shah and Ahmed 2016).
iii) Bots: The third significant and vital kind of threat or vulnerability to the
organisational network and information in Holiday Inn is bots. This is often termed as an
advanced level of worm and these are automated procedures, which are being designed for
effective interaction over the Internet connection without even requiring any type of human
need or help (Jouini, Rabai and Aissa 2014). The server or network of Holiday Inn can be
easily and promptly affected by bots and the respective managers and technicians would not
be able to track them under any circumstance.
iv) Ransom ware: Another popular and noteworthy kind of threat or vulnerability to
the organisational network and information in Holiday Inn is ransom ware. This is termed as
one of the most significant vulnerability that makes losses to both confidentiality as well as
integrity of information and financial state of the respective organization (Andress 2014).

6
INFORMATION SECURITY
This particular ransom ware would either encrypt the sensitive files or could even lock the
entire system by breaching network security. It eventually makes the entire computer system
completely inaccessible in a partial or complete manner. As soon as computer system is being
hacked, a screen is being displayed by the hackers that a lump sum amount of money is to be
paid for decrypting the files (Flores, Antonsen and Ekstedt 2014). The amount often turns out
to be huge and Holiday Inn might be in major financial losses if they face this type of
network security attacks in their business.
v) Rootkits: The fifth vital threat or vulnerability to the organisational network and
information in Holiday Inn is rootkit. These types of malware are being designed for gaining
or obtaining the root access to the user system. Administrative privileges are often used
within the user system (Baskerville, Spagnoletti and Kim 2014). As soon as root access is
being obtained, the respective hacker could do anything such as stealing of private data or
files of customer information in the Holiday Inn.
vi) Identity Theft: This is the next important threat that can turn out to be extremely
common for the organizational network of Holiday Inn is identity theft (Kolkowska and
Dhillon 2013). It refers to act someone else for the core purpose of obtaining the personal
information of an individual or even accessing the vital information, which they comprise of
such as accessing systems and social media pages of the hotel by simply logging into their
account after utilization of login credentials.
vii) Theft of Intellectual Properties: The seventh important and significant threat,
which is extremely vulnerable for Holiday Inn is theft of intellectual properties. It
substantially violation of rights of intellectual property such as patents and copyrights (Singh
2013). The organizational network can be breached for gaining such IP rights.
viii) Technology with Weak Security: If the technology of Holiday Inn would
comprise of weaker security, there is a high chance that systems and network would be
breached eventually and it would lead to theft of data or information from the network or
devices.
Although, the above mentioned information and network security risks could be
extremely vulnerable for Holiday Inn, there are some of the most important and significant
techniques or strategies that are effective for them (Safa, Von Solms and Furnell 2016). The
most effective strategies for mitigating these threats are as follows:

7
INFORMATION SECURITY
i) Implementation of Antivirus Software: This is the most effective mitigation
strategy for removing network and computer system threats such as virus attacks, Trojan
horses, rootkits and bots. It is a type of computer program that is being utilized for
preventing, detecting and even removing of malware (Peltier 2016). Major protection is
provided from browser hijacker and even ransom ware. Holiday Inn would be highly
benefitted from this implementation and periodical up gradations.
ii) Monitoring of File Integrity: The second effective and efficient mitigation strategy
for removing network and computer system threats in Holiday Inn is monitoring of file
integrity. As they are into dealing with customers’ data, it is extremely important for them to
monitor their files’ integrity (Siponen, Mahmood and Pahnila 2014). They should implement
real time and agent based software for file integrity monitoring.
iii) Accessing Governance Policies: Governance policies ensure that there is no
security issue for the respective organization of Holiday Inn and it even helps in reviewing of
audit logs for measurement of awareness program results.
iv) Change Control Processes: The change control procedures should be well
followed for each and every time the management of Holiday Inn is changing or updating
their network configurations (Yang, Shieh and Tzeng 2013).
v) Implementation of Two Factor Authentication: Major access should be gained for
the users after ensuring two factor authentication is being implemented successfully.
Moreover, location and time of accessing the additional authentication factors should also be
considered for maintaining network security and eradicating threats like identity theft and
intellectual property theft (D'Arcy, Herath and Shoss 2014).
vi) Ensuring API Security: Another effective mitigation strategy for removing the
network security issues in Holiday Inn is ensuring API security. For complying with the
stringent enterprise mandates, it is required to perform the API security in a better manner
(Flores, Antonsen and Ekstedt 2014).
3. Conclusion
Therefore, from the above discussion, it can be concluded that there are three
distinctive goals and objectives of information security which includes confidentiality,
integrity and availability. These measures of information security are required for creation of
policies and processes and should even consider each and every goal for protection of a

8
INFORMATION SECURITY
computer system. Due to such distinctive advantages in information security, every
organization tries to implement this policy in their business. The Australian hotel industry has
also implemented this policy like IHG or Intercontinental Hotel Group. One of the major
hotel brands of this hotel group is Holiday Inn. The main reason for this type of
implementation is that it is extremely effective in better identification of all types of threats
and vulnerabilities and how to deal with these vulnerabilities in an effective manner. The
above mentioned report has clearly demonstrated the detailed analysis of information security
and information security policy for one of the most popular and significant hotels in
Australia, namely Holiday Inn. Various details regarding identification of threats and
mitigation techniques of these threats in respect to a developed strategic information security
policy for Holiday Inn are provided in this report with relevant details.

9
INFORMATION SECURITY
References
Andress, J., 2014. The basics of information security: understanding the fundamentals of
InfoSec in theory and practice. Syngress.
Baskerville, R., Spagnoletti, P. and Kim, J., 2014. Incident-centered information security:
Managing a strategic balance between prevention and response. Information &
management, 51(1), pp.138-151.
Crossler, R.E., Johnston, A.C., Lowry, P.B., Hu, Q., Warkentin, M. and Baskerville, R.,
2013. Future directions for behavioral information security research. computers &
security, 32, pp.90-101.
D'Arcy, J., Herath, T. and Shoss, M.K., 2014. Understanding employee responses to stressful
information security requirements: A coping perspective. Journal of Management
Information Systems, 31(2), pp.285-318.
Flores, W.R., Antonsen, E. and Ekstedt, M., 2014. Information security knowledge sharing in
organizations: Investigating the effect of behavioral information security governance and
national culture. Computers & Security, 43, pp.90-110.
Jouini, M., Rabai, L.B.A. and Aissa, A.B., 2014. Classification of security threats in
information systems. Procedia Computer Science, 32, pp.489-496.
Kolkowska, E. and Dhillon, G., 2013. Organizational power and information security rule
compliance. Computers & Security, 33, pp.3-11.
Peltier, T.R., 2013. Information security fundamentals. CRC press.
Peltier, T.R., 2016. Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. Auerbach Publications.
Safa, N.S., Von Solms, R. and Furnell, S., 2016. Information security policy compliance
model in organizations. Computers & Security, 56, pp.70-82.
Singh, G., 2013. A study of encryption algorithms (RSA, DES, 3DES and AES) for
information security. International Journal of Computer Applications, 67(19).
Siponen, M., Mahmood, M.A. and Pahnila, S., 2014. Employees’ adherence to information
security policies: An exploratory field study. Information & management, 51(2), pp.217-224.

10
INFORMATION SECURITY
Soomro, Z.A., Shah, M.H. and Ahmed, J., 2016. Information security management needs
more holistic approach: A literature review. International Journal of Information
Management, 36(2), pp.215-225.
Von Solms, R. and Van Niekerk, J., 2013. From information security to cyber
security. computers & security, 38, pp.97-102.
Xu, L., Jiang, C., Wang, J., Yuan, J. and Ren, Y., 2014. Information security in big data:
privacy and data mining. Ieee Access, 2, pp.1149-1176.
Yang, Y.P.O., Shieh, H.M. and Tzeng, G.H., 2013. A VIKOR technique based on
DEMATEL and ANP for information security risk control assessment. Information
Sciences, 232, pp.482-500.