Managed hotel networks: seasonal access, VLANs and PCI DSS

In three characteristics that no other sector combines with the same intensity.

• Teams that change all year round Front desk, housekeeping, F&B and interns come and go continuously, with the biggest peaks between spring and summer.
• A house that never closes There are night shifts, weekends and public holidays when nobody from IT is in the building.
• Critical information spread around The PMS (the property management system, with bookings and guest records), card terminals, the reservations mailbox, CCTV and Wi-Fi.

The typical symptom is a generic user, something like "frontdesk1", shared by the whole team. With it, there is no longer any way of knowing who changed a booking, who issued a refund or who opened a guest's record. Worse: anyone who has left and knows that password keeps the door open from anywhere.

The starting point is simple: one named user per person in each system, and only the permissions the job requires. A reference matrix:

The matrix is adjusted to each property's organisation chart. The principle stays the same: least privilege necessary.

With VLAN segmentation. Over the same cabling and the same access points run several logical networks that cannot see one another, like wings of a building with security doors between them. A guest's laptop is confined to its wing and has no path to the PMS, the terminals or the cameras.

The minimum configuration we recommend for a hotel has five segments:

• Guest network Internet access and nothing else.
• Staff network Staff smartphones and tablets, with its own password renewed whenever someone leaves.
• Operational network The PMS and front desk and back-office workstations.
• Payments network Terminals and POS, with communications reduced to what is strictly necessary.
• Video network Isolated CCTV, with image viewing restricted and logged.

The rules between segments are enforced by the firewall. We explain how a DataRoad managed firewall works, and what a visitor network should have, in how to protect business Wi-Fi and the guest network.

PCI DSS sets out the security requirements for card data defined by the PCI Security Standards Council, a body founded by the card networks. The Council itself makes clear that it applies to any entity that stores, processes or transmits that data, regardless of size. Accepting cards is enough to be in scope; how to demonstrate compliance, when required, is determined by the bank that supplies the terminals.

Translated into a hotel's daily routine, the Council's guidance for merchants comes down to four practices:

1. Strong, personal credentials on every system linked to payments.
2. Remote access by exception: only when needed and always with MFA.
3. Software always up to date: patches applied as soon as they are available.
4. Periodic inspection of terminals: to spot physical tampering.

Isolating payments on a dedicated network reduces the exposed surface. The other three practices remain mandatory.

In Lisbon's Baixa, between Rossio and Restauradores, DataRoad - IT Services and Consulting manages the network of six properties: Ouro Rossio Hotel, LX Arch Rossio Hotel, Nicola Rossio Hotel, Rossio Plaza Hotel, BeHotel and BePoet Hotel. Each one's guest network is kept apart from operations, so a guest device cannot reach the PMS, POS, CCTV or back-office workstations. Video runs on a dedicated logical segment, sharing the physical cabling, and anyone viewing recordings is logged. Discover the project across the six Baixa properties.

The Ouro Rossio Hotel case gives a sense of scale: 6 floors, 30 access points, 55 cameras and 10 switches, with an enterprise firewall handling segmentation and traffic control according to each user's profile. Once the installation was complete, the hotel moved onto an IT Unlimited contract.

Joining

• Written authorisation Issued by management, with the role and the expected end date.
• PMS user Named, with the role's profile.
• Email account Microsoft 365 or equivalent, with MFA, only if the role requires it.
• Delegated access to the shared mailbox No password sharing.
• Staff Wi-Fi And never the operational segment.
• A 15-minute awareness session Phishing, passwords and what to do when faced with an unusual request.

Leaving, always on the same day

• Block users PMS and email deactivated, active sessions ended.
• Remove delegations Shared mailboxes and shared folders.
• Close the vault Password manager access withdrawn and any passwords the person knew renewed.
• Renew the staff Wi-Fi password When it is common to everyone.
• Collect equipment Cards, keys, alarm codes and devices.
• Document When it was done and by whom.

The condition that fails most often is "the same day". A departure at a hotel can happen on a Saturday at 11 pm, and the protocol only works if it is written down and the IT partner is available at that moment. This is the reality the Premium 365 plan exists for, with cover at night, at weekends and on public holidays.

Before next season, we review PMS, email and Wi-Fi users, segmentation and the leaver protocol, and deliver the fixes in order of priority. No-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support. See how we approach managed IT and networks for hospitality.

Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.

• PCI Security Standards Council resources for merchants: pcisecuritystandards.org