Hotels: accounts and access of seasonal staff without opening doors

8 min read · DataRoad

Accesses by seasonal staff In many hotels, they are the largest open door of the operation. During peak times, receptionists, floor staff, restaurant teams and interns enter. They quickly receive passwords, share bills at the reception and, when the season ends, not always someone remembers to remove their access. The answer is simple to state: one account per person, access limited to the function, separate networks and a departure procedure completed on the same day.

The problem: too many people, too little time, too many visits

The hotel industry has three characteristics that make it especially vulnerable:

• High rotation speed. Entries and exits occur throughout the year, with peaks in spring and summer.
• Continuous operation. The reception doesn't close. There are night shifts, weekends, and holidays, often with no IT staff present.
• Sensitive data in various systems. The PMS (the hotel management system where reservations and guest data live), the payment terminals, the booking email, the cameras, and the Wi-Fi.

When one of these systems is accessed with a generic account like “rececao1”, no one is able to answer basic questions. Who changed that reservation? Who issued that refund? Who accessed that guest’s data? And if an old employee knows the password, they still have access — wherever they are.

One account per person, with access tailored to the function

The golden rule is this: each person has their own account in each system, with access only to what their function requires.

Each hotel adjusts the schedule to suit its organization. The principle remains the same: no one has more access than they need.

And the inbox of the reception desk?

The “reservas@” or “rececao@” box can and should continue to exist. What changes is the access method: instead of a password that everyone knows, each person enters with their own account and receives permission over the shared box. When they leave, the permission is withdrawn. The box remains intact and the password does not circulate.

For the passwords that still have to be shared — the portal of a tourist operator, for example — one Enterprise password manager allows you to share without revealing, and revoke at the click of a button. In the management of driving accounts and email, the multi-factor authentication It is mandatory.

Separate networks: guests, staff, payments and cameras

In a well-designed hotel, there are at least these networks:

• Guests: only internet, isolated from everything else.
• Staff: for the team's mobile phones and tablets, with a unique password that changes when there are departures.
• Operation: PMS, reception and administration computers.
• Payments: terminals and POS, with the minimum of necessary communication.
• Cameras: CCTV on a dedicated network, with access to the images controlled.

The firewall is the one who separates the networks and imposes the rules between them. We explain the role of a firewall. managed firewall and the good practices of guest Wi-Fi in the article about Wi-Fi security in the company.

Card payments: PCI DSS in simple terms

PCI DSS is the set of security requirements defined by the PCI Security Standards Council, the body created by the payment card brands. According to the Council itself, it applies to all entities that store, process, or transmit card data — and the scope does not exempt anyone. If the hotel accepts cards, it is covered. If you have to formally verify that compliance, and how, who says so is the bank that provides you with the terminals.

For a hotel, the Council's practical recommendations for merchants translate into four gestures:

1. Strong and individual passwords in everything that touches on payments.
2. Remote access to systems only when necessary and always with multi-factor authentication.
3. Software updates applied without delay.
4. Regular verification of payment terminals to detect tampering.

The separate network for payments helps to reduce the part of the infrastructure that is exposed. It does not eliminate the remaining rules.

A real case: six hotels in Rossio and Restauradores

DataRoad monitors six hotels in the Rossio and Restauradores areas of Lisbon: BePoet Hotel, BeHotel, Rossio Plaza Hotel, Nicola Rossio Hotel, LX Arch Rossio Hotel and Ouro Rossio Hotel. In all of them, the guest database is separated from the operational network: a guest laptop does not see the PMS, the POS, the cameras or the administration computers. The cameras operate on a proprietary logical network, on the same physical infrastructure, with a record of who views the images. Read the case of the six hotels.

No Ouro Rossio Hotel, The project included 30 Wi-Fi access points, 55 cameras and 10 switches distributed over 6 floors, with an enterprise firewall that segments the network and controls traffic based on user profile. After implementation, the hotel switched to an IT Unlimited contract.

Checklist for entry and exit of seasonal staff

When someone enters

• Formal request from management, with the function and end date planned.
• Individual account created in the PMS with the profile of the function.
• Microsoft 365 (or equivalent) account has MFA if you need email.
• Permission in the shared inbox without revealing passwords.
• Access to the staff Wi-Fi network — never to the operational network.
• 15-minute training: phishing, passwords and what to do in the face of a strange request.

When someone leaves (on the same day)

• Deactivate the account in PMS and in the email; end open sessions.
• Remove permissions on shared folders and folders.
• Revoke access in the password manager and change the ones that the person knew.
• Change the staff Wi-Fi password if it is shared.
• Collect cards, keys, alarm codes and equipment.
• Record the date and who carried out the exit.

The critical point is “on the same day”. In a hotel with continuous operation, the shutdown can happen on a Sunday evening. Therefore, the procedure must be written down and the IT partner must be able to execute it outside of office hours. The plan IT Unlimited Premium 365 covers nights, weekends, and holidays — the actual schedule of a hotel.

Frequently Asked Questions

Does the PMS allow individual accounts for each receptionist?

Professional hotel management systems generally allow individual users with access profiles. If your system does not allow it, or if the licenses are limited, this is a point to be reviewed with the provider before the next high season.

Do I have to change the guest Wi-Fi password every month?

It does not solve the essential problem. What protects the operation is the separation of networks: even with the correct password, a guest should not be able to access the PMS, the payments, or the cameras.

Does PCI DSS apply to a small hotel?

According to the PCI Security Standards Council, it applies to all entities that store, process, or transmit card data, and the scope is not limited. The way to verify compliance is defined by the bank that provides the terminals.

How long does it take to put this into practice?

It depends on the existing network. Creating individual accounts and an exit procedure takes a few days. Separating networks may require configuring the firewall and access points, which we plan for outside of peak hours.

Review of your hotel's access in 10 working days

Before the next high season, we review the PMS, email and Wi-Fi accounts, the network separation and the personnel exit procedure — and deliver a list of corrections by priority. For companies with more than 10 workstations · contract support · remote and on-site support. Learn more about us Information technology for the hotel industry.

Sources

• PCI Security Standards Council — Merchant Resources: pcisecuritystandards.org