ISY3006: Information Security for Hyatt Regency Sydney - Report

This report provides a comprehensive information security analysis for the Hyatt Regency Sydney, focusing on the development of a strategic security policy. It examines the hotel's stakeholders, the necessity of an information security policy, and the policy's scope. The report outlines potential threats and vulnerabilities, including phishing attacks, web-based attacks, dark hotel threats, DDoS attacks, and ransomware. The study also covers various aspects of policy implementation, such as asset segregation, restricted information access, multi-layered security, and access controls. This report aims to help the Hyatt Regency Sydney mitigate risks and maintain a competitive edge in the market by securing both physical and digital assets. The report is based on the ISY3006 unit and includes details on incident management and risk assessment.

Running head: INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
Name of the Student
Name of the Organization
Author Note

1
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
Executive summary
The study has its main aim towards the development of security plan for the chosen
organization Hyatt Regency which is basically a five star hotel of Sydney. The security plan
will be helping a lot in mitigating all the various kinds of risks which may be arising in the
hotel. There are a number of various kinds of risks as well as vulnerabilities which have been
observed to be well associated with the Hotel Hyatt Regency. The security plan development
is really very much crucial for the hotel for maintaining the competitive advantage within the
market. The nature as well as all the various stakeholders of the hotel have been well depicted
within the study.

2
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
Table of Contents
Introduction................................................................................................................................3
Stakeholders...............................................................................................................................3
Need for the information security policy...................................................................................3
Scope of the policy coverage.....................................................................................................4
Policy..........................................................................................................................................6
Potential Threats and Vulnerabilities.........................................................................................6
References..................................................................................................................................8

3
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
Introduction
The main aim of the study is to develop a strategic policy of security for Hyatt
Regency. Various guests often look for hotels which will be providing a feeling of home.
Such a kind of demand is greatly fulfilled by one of the five star hotels in Sydney named
Hyatt Regency. Guests can be well expecting that they are going to be experiencing great
comfort, privacy as well as security. Hyatt Regency has been well focussed upon all the
various kinds of expectations of the guests. It is to be remembered that a huge focus must be
placed upon securing the hotel. A number of guests expect that they will be obtaining a high
level of security which will be extended towards various assets which will be digital
whenever they will be linked with the digital structure of the hotel (Olcay, Gölpek and İnce
2014). Hyatt Regency requires a lot to properly reassure all the guests that security is really
an essential priority as both the physical security and also the data provided by all the
customers must be totally secured against any kinds of threats which will be potential
involving various cyber threats. Hyatt Regency must be understanding all the various risks of
information security which they may be facing and must be properly identifying them for
developing controls to avoid or rather mitigate such risks.
Stakeholders
All the main stakeholders which have been associated with Hyatt Regency will be
involving the owners of all the assets which are physical. It will also be involving the
company of the management and even the Franchise Company (Modi, Wiles and Mishra
2015). Hyatt Regency is basically possessing three different parts for itself which involves
the company of management, owner and the franchise. The management company will be
involving all the people who actually runs the Hyatt Regency. They are capable of hiring,
properly training as well as advertising. On the other hand, the owner of the physical estate of
Hyatt Regency is the one who is capable responsible for just investing (Wendy Zhu and
Morosan 2014). Lastly, the Franchise is the one who is capable of contracting with the
company of management in the particular consent with that of the owner.
Need for the information security policy
Technology has been noticed to be incrementing hugely within Hyatt Regency where
the image of it and various matters of gaining competitive advantage has become significant

4
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
and the main objective has become offering a great experience to all the visitors. The systems
of information can become a changer of game for achieving this particular objective. The
incremented dependence on the technology has greatly incremented various information
security risks and all of the various stakeholders of Hyatt Regency must be protecting all of
their system of information (Kim, Lee and Ham 2013). As a part of all of their duties, all the
stakeholders of Hyatt Regency must be properly capable of handling the data of the
customers and the specific hygiene for maintaining security of information must be becoming
an important part of all of their respective duties.
There must be the establishment of proper leadership for various programs of securing
information within Hyatt Regency and there must be a proper setup of various standards of
security (Salavati and Hashim 2015). Hence, there is a great need for the development of a
comprehensive structure of the security of information and there must a set of various
policies as well as procedures for effectively managing as well as implementing the
information security in the Hyatt Regency. The policy will be comprising of several
procedures as well as areas of particular domains. The hotel should be involving a proper
policy for particularly outlining the commitment of the Hyatt Regency towards the adoption
of various practices of maintaining security and privacy for the main purpose being the
implementation of a proper system of management for particularly delivering a number of
objectives (Oh, Jeong and Baloglu 2013). It is must remembered that the head of Hyatt
Regency must be signing up with the policy.
The protection of all the various personal information provided by the customers is
the main need and the policy must be involving various rights for various customers like
Right to Information and Requirement for consent (Morosan and DeFranco 2016). Hyatt
Regency must be collecting various data that will be needed for the entire business and the
main strategy must be particularly ensuring lowering of risk by the reduction of data which
will be collected which will be further making sure that there will be a reduction of several
risks and the usage will be ensured dependent upon the obtained consent and data disposal as
soon as required.
Scope of the policy coverage
 Liability of asset will be covering the specific coverage of the expense of the
replacement of the various assets which are digital and will even be involving the
threat of cyber extortion.

5
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
 Liability of the security of network will be covering all the various damages of the
third party which will be actually resulting from a huge failure for providing
protection against the entire deletion or the destruction of the data belonging to the
third party. This may be resulting from all the various DoS attacks against any
systems within the hotel (Date 2016).
 Liability of the privacy will be covering all the various damages caused by the third
party which mostly results from the leak of the information which are greatly
confidential (Bilgihan et al. 2013). This will be involving the entire coverage for the
specific liability which will be vicarious where any guest will be greatly losing a lot
of information which they have actually entrusted towards the Hyatt Regency.
 The liability of the specific content of electronic media will be greatly comprising of
the personal injuries which may be greatly arising from both the development as well
as the dissemination of the content which will be electronic (Alazzam et al. 2015).
 All the various penalties as well as the defence which is regulatory will be covering
all the expenses which will be arising from the any kind of violation of the laws of
privacy which is actually caused by any of breach of security.
 The extortion of the network will be actually providing a huge reimbursements for all
the payments which have been observed to be made under huge stress in the particular
response towards any kinds of threat of extortion.
 The expenses of the event of breach will be involving all the various expenses which
will be associated with the compliance of the regulation of privacy (Karadag et al.
2013).
 The protection of the asset of data will be covering all the expenses of recovery which
may be incurred for restoring as well as recollecting the data and some other assets
which are totally intangible.
 The liability of the multimedia will be covering the website defacement as well as the
infringement of the intellectual rights of the property (Amirreza, Mohammad and
Gilani 2013).
 The liability of extortion will be covering all the various losses which will be occurred
because of the extortion threat as well as the fees which have been directly related
towards dealing with the particular extortion.
Hence, there is a great need for proper governance as well as the development of the
policy for particularly establishing all the appropriate procedures in proper place for the

6
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
implementation of an effective program of security (Al-Smadi et al. 2018). The policy section
will be properly highlighting some of the main ways or procedures that are required to be in
proper place within Hyatt Regency.
Policy
 There must be a proper segregation of various assets of information in a number of
several segments which will be entirely based upon the sensitivity of them.
 The information access must be entirely restricted to very much limited channels of
communication. Only all the information must be made available whenever they will
be actually required. All other various kinds of information must be entirely hidden
which will be particularly reinforcing the specific theory of the Security of Obscurity.
 All the various assets of information must be well protected at a number of levels as
well as points by utilising a number of technologies as well as techniques. The
system’s security must be entirely assessed only against very least asset within the
system which will be greatly secured.
 Various controls of security which will be chosen must be enough as well as properly
based upon the respective profile of risk of Hyatt Regency.
 There must be a proper controlling of the access of the assets of information and must
be greatly restricted which will be hugely based upon the particular concepts of
minimum privilege. There must also be a specific kind of special attention upon all
the accounts which will be privileged.
 The safeguarding of personal information is really the main need and there must be
the proper involvement of various rights to several individuals involving the Right to
Information, Requirement for consent and so on. It is essential to properly design all
the systems in a particular line with various needs of the regulation of privacy.
 There must be perfect protection against any kind of one single point of failure
utilising various elements which are redundant and various concepts of huge
availability.
Potential Threats and Vulnerabilities
Attacks of phishing: Phishing attacks is basically a kind of pre-step towards a fully blown
attack which is highly malicious towards Hyatt Regency. The main objective is to obtain
various credentials of the user via a number of techniques of social engineering (WANJIRU
2014).

7
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
Attacks based upon web: Until and unless there is an adequate security, all the various
systems of Wi-Fi which are traditional are actors which are greatly malicious may be utilising
of all of them for directly breaching into all the various corporate systems of Hyatt Regency.
Dark hotel: There is a fully new vibrant which is basically the spear phishing that is entirely
targeted and the spreading attack of the malware which is known as the Dark Hotel. This may
be selectively attacking various visitors of the Hyatt Regency via the in house network of Wi-
Fi.
DDoS attacks: The distributed DDos has greatly grown up as per popularity is considered for
directly carrying out various activities of the injection of malware. With such kinds of
attacks, there is a high chance of various hackers to be utilizing a lot of botnets of the
networks which will be greatly compromised to all the various systems which are critical
with that of huge traffic and this may be directly crashing the entire platform (Law, Buhalis
and Cobanoglu 2014). Various attackers can even be asking for a huge sum of money from
various kinds of authorities for the prevention of certain kinds of disruption of various
systems which will be hugely critical.
Ransomware: These kinds of attacks have hugely grown up in the current years and there
are some fully real attacks which are crippling wherein various attackers will be able to
directly obtain access to the specific system of the Hyatt Regency and will even be providing
the encryption of data. Hyatt Regency then may be directly asked for a large sum of money
for obtaining that particular key which will be actually capable of decrypting the entire data.
Leakage of data: These are basically certain kinds of attacks where any actor who will be
malicious will be getting an access to all the various kinds of systems within the hotel and
that will be totally staying there and will be greatly trying to properly identify various critical
data even outside of the hotel. This data will be involving the data of the hotel and also all the
personal as well as the financial information of the guests.
The policy will be helping a lot in mitigating as well as lowering certain kinds of
various risks or threats which will be greatly associated with the Hyatt Regency. The policy
which is comprising of the protection of all the personal information will be helping a lot in
prevention from such threats. All the various policies related to segmentation, accessibility,
defense, enough protection, lowering of privileges, privacy and the availability will be
helping a lot in protecting against any kind of all the various threats and vulnerabilities which
have been mentioned.

8
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
References
Alazzam, F.A., Allahawiah, S.R., Alsarayreh, M.N. and al Nawaiseh, K.H.A., 2015. Safety
Requirements and Modern Technical Requirements in Human Information Systems in
Amman Hotels. International Journal of Academic Research in Business and Social
Sciences, 5(1), p.16.
Al-Smadi, M., Qawasmeh, O., Al-Ayyoub, M., Jararweh, Y. and Gupta, B., 2018. Deep
Recurrent neural network vs. support vector machine for aspect-based sentiment analysis of
Arabic hotels’ reviews. Journal of computational science, 27, pp.386-393.
Amirreza, F., Mohammad, S.Z. and Gilani, M.H.N., 2013. Customer satisfaction in
hospitality industry: Middle East tourists at 3star hotels in Malaysia. Research Journal of
Applied Sciences, Engineering and Technology, 5(17), pp.4329-4335.
Bilgihan, A., Karadag, E., Cobanoglu, C. and Okumus, F., 2013. Research note: biometric
technology applications and trends in hotels.
Date, L.R., 2016. Information Security Policy.
Karadag, E., Cobanoglu, C. and Okumus, F., 2013. Research Note: Biometric Technology
Applications and Trends in Hotels.
Kim, H.B., Lee, D.S. and Ham, S., 2013. Impact of hotel information security on system
reliability. International Journal of Hospitality Management, 35, pp.369-379.
Law, R., Buhalis, D. and Cobanoglu, C., 2014. Progress on information and communication
technologies in hospitality and tourism. International Journal of Contemporary Hospitality
Management, 26(5), pp.727-750.
Modi, S.B., Wiles, M.A. and Mishra, S., 2015. Shareholder value implications of service
failures in triads: The case of customer information security breaches. Journal of Operations
Management, 35, pp.21-39.
Morosan, C. and DeFranco, A., 2016. Modeling guests’ intentions to use mobile apps in
hotels: The roles of personalization, privacy, and involvement. International Journal of
Contemporary Hospitality Management, 28(9), pp.1968-1991.
Oh, H., Jeong, M. and Baloglu, S., 2013. Tourists' adoption of self-service technologies at
resort hotels. Journal of Business Research, 66(6), pp.692-699.

9
INFORMATION SECURITY FOR HYATT REGENCY SYDNEY
Olcay, A., Gölpek, F. and İnce, E., 2014. A study on the assessment of social security
practices by the personnel at the hotels in Gaziantep. International Journal of Humanities
and Social Science, 4(3), pp.157-164.
Salavati, S. and Hashim, N.H., 2015. Website adoption and performance by Iranian
hotels. Tourism Management, 46, pp.367-374.
WANJIRU, K.R., 2014. INTEGRATING CORPORATE SECURITY IN STRATEGIC
MANAGEMENT OF FIVE-STAR HOTELS IN NAIROBI KENYA.
Wendy Zhu, W. and Morosan, C., 2014. An empirical examination of guests' adoption of
interactive mobile technologies in hotels: Revisiting cognitive absorption, playfulness, and
security. Journal of Hospitality and Tourism Technology, 5(1), pp.78-94.