Comprehensive Security Policy Report: Meriton Suites Case Study

This report provides a comprehensive analysis of the security policy for Meriton Suites, a prominent hotel operator in Australia. It begins with an executive summary highlighting the importance of cybersecurity in the hospitality industry and the organization's reliance on information systems. The report then delves into the formulation of a strategic security policy, including acceptable use, privacy regulations, data classification, cloud policy, IAM regulations, remote access, incident response, administration and IT operations, access control, business continuity, and change management. The report identifies potential threats and vulnerabilities such as ransomware, payment attacks, DDoS attacks, phishing attacks, DarkHotel hacking, and customer data theft. Finally, the report proposes mitigation techniques including data encryption, limited access control, data backup, real-time network monitoring, updated computer systems, and the use of experienced cybersecurity professionals. The report emphasizes the importance of protecting customer data and ensuring business continuity in the face of evolving cyber threats.

Running Head: MERITON SUITS
Security Policy
Name of the Student
Name of the University
Author Note

1MERITON SUITS
Executive Summary
The Meriton Suits is one of the famous hotel operator in Australia. Their hotels are well
equipped with all the amenities necessary for any comfortable stay. The customers of the hotel
have shared wonderful views about the hotel. The organization uses information system for all
the operation takes place in the hotel as well as the online websites is use for the bookings of the
rooms. The amount of security threats have increased in the hospitality industry, hence the
mitigating techniques are essential to undertake by the organization. Along with the security
policies are also essential to follow by the employees of the organization. The protection of the
customer’s information is most essential in this business.

2MERITON SUITS
Table of Contents
Introduction......................................................................................................................................3
Security Policies..............................................................................................................................3
Potential threats and vulnerabilities.................................................................................................6
Mitigation techniques......................................................................................................................8
Conclusion.....................................................................................................................................10
Reference.......................................................................................................................................11

3MERITON SUITS
Introduction
The Meriton Suits are the renowned hotel operator across Australia. The customers have
great views about the hotel. The hotels owned by this company are preferred by many hence they
are the pioneer in their business (Meriton Suites 2020). The operations of the organization is
totally on the online platform. Hence, the chances security threats and attacks are high with the
information and data security of the customers as well as the organization.
The report will discuss about the security policies, threats, vulnerabilities to the network
of the Meriton suits and the possible mitigation techniques.
Security Policies
The organization is the largest owner of hotel rooms at several locations of Australia and
they have around 4,953 suits which provides best experience to their guests. The hotels have
been owning recognition from several years and maintained their position with great decorum
(Gibson 2014). As the series of hotels are the greatest attraction to the customers as well as a
great competitors around the same industry, the security and safety of the organization is
important in order to maintain the name in the market.
Hence the security policies that can be present for the Meriton Suites are as follows:
Sl.
No.
Policy Description
1 Acceptable Use
Policy
The resources of the company are defined in this policy like the
server, mailing system, network, applications, etc. These are
protected from misuse, data breaches are prevented by the
implementation of this policy (Sommestad, Karlzén and Hallberg

4MERITON SUITS
2015). The people related to the company are aware of the
resources of the company.
2 Privacy regulation GDPR is the most effective regulation enforced by the government
for protecting the end user’s privacy. The protection to the uses’
information is most crucial to the organization for attempting
success in the business.
3 Data and
information
classification
The inclusion of best classification of data and information is
required by the organization to maintain their assets of the
organization. The insufficient classification will introduce new
attacks and add expenses in management.
4 Cloud policy With the emergence of the technology the policies of cloud
computing are necessary to include in the security policy. The
complete knowledge about the guidelines of cloud and SaaS is
important to maintain the healthy ecosystem of cloud. The
availability of this policy will enable the employees to utilize the
resources of cloud effectively. The chances of the occurring of
complication related to cloud are also minimized.
5 IAM regulations The authorization of the organization’s system are maintained and
managed well by the administrators of information technology. The
admin will provide access to the authorized user only. The creation
of password by the employees will be carried out under this policy.
The risk of identity can be reduced by effectively following of this
regulation.

5MERITON SUITS
6 Remote access
Policy
Nowadays, the use of the mobile devices have increased
exponentially. The networks, server and the website of the hotel is
accessed via mobile phones, laptops from any location. This helps
the attackers to vandalize with the official network easily (Chen et
al. 2014). The policy will ensure the use of the personal devices in
a secured network for accessing the company website. This will
reduce the threats and exposure to attacks to the network of the
company.
7 Incident response
Policy
This policy will construct the approach that the organization will
take in case of any authorized incident on the company’s system,
network or server. The operations that the organization takes place
so that the damage caused by any attacker is minimum, recovery
time is also less and less effect on the cost of damage.
8 Administration
and IT operation
The administration of the organization and the IT department of the
organization must work together to minimize all the threats and
attacks to the company. The better communication between the
departments will help in faster recovery if any incident happens.
The identification and assessment of the risks are better carried out
together with the all the departments working alongside.
9 Access Control
Policy
The availability of access to the employees of the organization is
necessary to manage. This policy also defines the other
accessibility criteria related to controls of network access, user
access standards, password complexity and software controls of

6MERITON SUITS
operating system (Ye et al. 2014). Monitoring of the ways the
system is used and accessed externally. Also the access is
withdrawn from the employees who leaves the company.
10 Business
Continuity Plan
This policy is the most essential part of any organization and
mostly for the hotel industry. When any incident takes place
associated with cyber-attack. The back-up data and information
must be installed again to continue the normal practices of the
business. The plan explains the operations of the business in any
emergency situation, restoring of software, data and application
takes place in this plan.
11 Change
Management
policy
The best way to avoid all the threats and attack to the organization
is the effective implementation of change management in the
organization. The change in the hardware, software, security
operations will keep the operation and devices updated (AlHogail
2015). This program will bring awareness among the employees
about keeping the organization attack free and the impact of the
change will not be adverse to the people working.
Potential threats and vulnerabilities
The threats and vulnerabilities that the hotel Meriton Suits may face in this technological
world are as follows:
 Ransomware- One of the famous attacks that are occurring on every network is the
ransomware attack. Wannacry is the latest version of ransomware and they keep the

7MERITON SUITS
information system hostage in return asking for ransom (Kharraz et al. 2015). The idea
behind the attack is to target the financial aspect of the system and extort money in
exchange of the data or system of that organization. In the hotels the risk of cyber-attacks
are high as everyone is accessing the website of the hotel for some reasons. As per the
record the hotels have been attacked by several foul crimes and the amount of ransom are
very much high.
 Payment attacks- In the hospitality industry, the payment card attack is considered to be
one of the most effected attack in the cybercrime world. The attackers attacks the hotels
indirectly be attacking the third-party related to the hotels. That means the vendors which
regulates the transactions of the hotel are attacked. The weakness in the system of the
hotel is available to the attackers which is used against the hotel to perform the attack. It
brings financial disturbance to the hotel.
 DDoS- The distributed denial of service is one of the common cyber-attacks for the
hotels. It targets the series of hotels and vandalize the systems of the hotels that they use
regularly like the security cameras of the hotel (By 20015). Eventually they try to crash
down the computer system of the hotel. They aim to compromise the overall system of
the hotels and stop the normal operations of the organization.
 Phishing attack- The attack of phishing is related to the exchange of emails from a
genuine source but it is not. The attacker behind this makes the recipient of the email to
share the important information about the system or the organizations. The information
can be related to the passwords of systems, financial details of the organization or other
important sensitive information of the organizations (Peltier 2016). The attackers are
targeting the higher authorities of the business companies and cloning the emails of them,

8MERITON SUITS
then sending compromised emails to others for performing unauthorised transactions
using them.
 DarkHotel Hacking- This attacks is specifically occur in the hotels. The attacker uses
the wi-fi of the hotels and then connect to the customers of the hotels to perform
unauthorised actions. They makes face certificates for downloading software and sent to
the victims (Panai 2018). The attackers target customers of the hotels and places
malicious codes in the hotel’s server. In 2007, the first DarkHotel hacking was observed.
 Stealing of customer data- On of the common vulnerability of the hotels network and
server is that the availability of the information about the customers are huge and the
attackers targets those information to blackmail the customers and perform extortion
against the information available.
 Identity theft- The main aim of the hotels is to protect the information and identity of
their customers. This is one of the important ways of reaching success of the hotels. The
possibility of identity theft from the server of the hotels have increased drastically (He et
al. 2014). However, the possibility of securing data and information simultaneously for
the hoteliers are quite impossible to perform.
Mitigation techniques
The hotel industry is a vast area and the operations taken place in that area are also of
large quantity. The amount of data and information generated in this industry is also huge. The
mitigation of the threats refers to the polies and process undertaken by the organization to
prevent the incidents of data breaches and security threats occurs in the company (Sen and Borle
2015). The above discuss threats and vulnerabilities can be mitigated by several process and
those are discussed below:

9MERITON SUITS
 Encryption of data- The encryption of data means transfers of data into coded form.
The can be only decrypted by a secret key. This process is undertaken to secure the
data from attacks (Chauhan, Sanger and Verma 2015). The encrypted data can be sent
through any network without the possibility of data loss in the meantime.
 Limited access control- The computer system of the hotel must provide access
controls to limited staff of the company. This will reduce the chance of handling the
data of the comp any by lesser people. This will control the malicious threats to the
system and server of the company.
 Backing up of data- The data and information generated every day in the company
must have a regulatory back up process to keep all the data safe in some other system.
This can be done on the cloud too. The availability of space will also be vast along
with secure storage of data.
 Real-time monitoring of network- In order to track all the malicious activities on the
network of the hotel, unauthorised access, data missing and several other threats can
be obtained if real-time monitoring is done on the network and server of the
organization (Yang et al. 2015). A dedicated team can be formed to do the operations.
 Updates computer systems- The updated computer system are always less prone to
security threats and vulnerabilities as it will have all the updated techniques and
security functionalities to mitigate the attacks (Alrawais et al. 2017). The updated
patch in the computer and better and fast functionalities reduces the chances of threats
and attacks.
 Experienced hackers- The organization can hire a team of experienced hackers who
will virtually protect the hotel’s network. As all the online operation related to room

10MERITON SUITS
boking, payment transaction all the operation are done through the hotel’s server and
networks. This contains all the sensitive data and information about the hotel and its
customers. The hacker’s team can guard the hotel virtually.
 Preventive practices of security- The systems of the organization can be protected
by using antiviruses, firewalls, management of extern devices within the corporate
demands (Arneja and Sachdev 2015). The installation of patches on the systems and
operations for blacklisting of software to find the malicious activities on the systems.
 Annual Penetration assessment- The team of the hackers that are arranged can
perform penetrating testing on the organization’s network, system and websites to
obtains the vulnerabilities and mitigate them before the attackers can use that against
the organization.
Conclusion
It can be concluded that the hotel Meriton Suites must undertake and consider the above
discussed threats and vulnerabilities as these are very common to occur hence the mitigation
techniques needed to be opted well. The data of the customers are always at high risk of stealing.
The unavailability of security measures to the hotel’s system increases this vulnerability more.
The policies discussed above are useful for the hospitality industry and with the emergence of
technology the threats are also increasing. The process of mitigation are effective in several
industries and hence its proper implementation will give benefit to the hotel.

11MERITON SUITS
Reference
AlHogail, A., 2015. Design and validation of information security culture framework.
Computers in Human Behavior, 49, pp.567-575.
Alrawais, A., Alhothaily, A., Hu, C. and Cheng, X., 2017. Fog computing for the internet of
things: Security and privacy issues. IEEE Internet Computing, 21(2), pp.34-42.
Arneja, P.S. and Sachdev, S., 2015. Detailed Analysis of Antivirus based Firewall and Concept
of Private Cloud Antivirus based Firewall. International Journal of Computer Applications,
111(4).
By, A., 2015. Information security policy. Governance, 6, p.1.
Chauhan, K.K., Sanger, A.K. and Verma, A., 2015, December. Homomorphic encryption for
data security in cloud computing. In 2015 International conference on information technology
(ICIT) (pp. 206-209). IEEE.
Chen, X., Osakue, D., Wang, N., Parsaei, H. and Song, G., 2014, July. Development of a remote
experiment under a unified remote laboratory framework. In Engineering Leaders World
Congress on Engineering Education 2013 (Vol. 2014, No. 3, p. 7). Hamad bin Khalifa
University Press (HBKU Press).
Gibson, D., 2014. Managing risk in information systems. Jones & Bartlett Publishers.
He, B.Z., Chen, C.M., Su, Y.P. and Sun, H.M., 2014. A defence scheme against identity theft
attack based on multiple social networks. Expert Systems with Applications, 41(5), pp.2345-
2352.
Kharraz, A., Robertson, W., Balzarotti, D., Bilge, L. and Kirda, E., 2015, July. Cutting the
gordian knot: A look under the hood of ransomware attacks. In International Conference on
Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 3-24). Springer, Cham.

12MERITON SUITS
Meriton Suites. (2020). Meriton Suites - Sydney, Brisbane & Gold Coast. [online] Available at:
https://www.meritonsuites.com.au/ [Accessed 30 Jan. 2020].
Panai, E., 2018. A Cyber Security Framework for Independent Hotels. Proceedings 4th EATSA-
FRANCE 2018, Challenges of tourism development, pp.145-152.
Peltier, T.R., 2016. Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. Auerbach Publications.
Sen, R. and Borle, S., 2015. Estimating the contextual risk of data breach: An empirical
approach. Journal of Management Information Systems, 32(2), pp.314-341.
Sommestad, T., Karlzén, H. and Hallberg, J., 2015. The sufficiency of the theory of planned
behavior for explaining information security policy compliance. Information & Computer
Security, 23(2), pp.200-217.
Yang, J., Zhou, J., Lv, Z., Wei, W. and Song, H., 2015. A real-time monitoring system of
industry carbon monoxide based on wireless sensor networks. Sensors, 15(11), pp.29535-29546.
Ye, N., Zhu, Y., Wang, R.C., Malekian, R. and Lin, Q.M., 2014. An efficient authentication and
access control scheme for perception layer of internet of things.