Cybersecurity terms for hoteliers: phishing, ransomware, two-step sign-in and more
Understand how phishing, ransomware, and two-step sign-in work in a hotel context. Learn the specific habits that stop attacks, from the front desk to accounting.
Contents
Key takeaways
- A security term is only useful when you can point to the screen, the person or the document where it appears in your hotel.
- Phishing works by making the sign-in page look right; the habit that defeats it is opening the site from your own bookmark, never from the link in the message.
- Two-step sign-in means a stolen password alone no longer opens the account.
- A backup that has never been restored is a hope, not a plan; the restore test is the part that counts.
- In the first hour of an incident, disconnect, call the person you named in advance, and write down what you saw before you tidy anything.
Cybersecurity terms describe how an attack reaches a hotel and what it does once inside. Phishing steals a password with a convincing message; malware is unwanted software; ransomware locks files and demands payment; two-step sign-in asks for a second proof so a stolen password alone is not enough. Each term comes with a habit.
A receptionist receives a message that looks like the booking extranet asking her to sign in again. She does, on a page that is not the extranet, and her password is gone. Nothing in her training had a name for what had just happened to her. This article gives the names, in plain sentences, with an example from the desk, reservations or accounting for each, and the one habit that removes most of the risk. After reading, you can attach every term to a screen in your building and check whether the habit exists.
What do these cybersecurity words actually mean?
Each term gets one plain sentence, one example from the desk, reservations or accounting, and one habit. A word that cannot be explained that way is not yet understood, and a warning built on it will not change anyone's behavior.
Security advice usually fails at the vocabulary, not at the willingness. Staff are told to be careful without ever seeing what the attack looks like on the screen they use every shift. Read every entry below in three parts, and keep four groups apart rather than one long list: the trick (how someone gets in), the harmful software (what runs after), the upkeep (what keeps it out), and the response (what you do when it happens).
The words change every year; the mechanisms repeat. Learn the mechanism and a new label will still make sense. If a term cannot be attached to a screen, a person or a document in your building, ask your IT provider to show you where it lives before you write a policy about it. This glossary is a companion to the wider hotel technology glossary: PMS, API, channel manager and more, which covers the systems these attacks target.
Key pointHow to read every term
Definition: one sentence, no jargon. Example: the screen, the caller or the document where a hotel meets it. Habit: the single action that removes most of the risk. If any of the three is missing, the term is not yet usable in training.
What is phishing, and how does a fake login page work?
Phishing is a message that asks you to sign in, pay or open a file, sent by someone pretending to be a supplier, a guest, a bank or a colleague. A fake login page is where the password is actually taken.
Spear phishing is the version written for one hotel, using a real reservation number, the general manager's name or the name of your extranet, so that the message fits what the reader already expects. The mechanism of the fake login page is simple: the link opens a page that copies the booking extranet or the bank, the password typed there goes to the attacker, and the real service never sees the attempt. The tell is that you arrived from a link rather than from your own bookmark.
Why does a fake login page look convincing?
Because it copies the real page and arrives in a moment of pressure. The colors, the logo and the wording match the service your staff use every shift. What it cannot copy is the address in the browser bar and how you got there, and those are the two things worth teaching: never sign in from a link, and open the site from your own bookmark.
What is social engineering in a hotel?
Social engineering targets a person's willingness to help rather than any software: a caller claiming to be from the IT provider, a guest who has lost a confirmation, a supplier who needs the payout account changed today. The result is account takeover: with a working password the account looks normal, and the first visible sign is often a forwarding rule on the mailbox or a changed bank detail on a supplier record.
The habit: never sign in from a link, and confirm any change of money or account details through a second channel you already had, such as the number on the contract. Train on the message that actually arrives at your hotel, not on a generic example, and make reporting a suspicious message as normal as reporting a broken key card. For the specific patterns, see fake booking messages and extranet takeovers.
| Term | One-line meaning | Where a hotel meets it | The habit |
|---|---|---|---|
| Phishing | A message that pushes you to sign in, pay or open a file | An email about the booking extranet | Sign in from your bookmark, not the link |
| Spear phishing | The same, written with details about your hotel | A message quoting a real reservation number | Verify by a channel you already had |
| Fake login page | A copy of a sign-in screen that captures the password | A link that opens a lookalike extranet | Check the address bar; use bookmarks |
| Social engineering | A person persuaded to help, by phone or in person | A caller claiming to be the IT provider | Call back on the known number |
| Account takeover | Someone else now uses a real account | A forwarding rule on the mailbox | Review rules and bank details regularly |
What is malware, and what does ransomware do?
Malware is any software that does something on your computer you did not ask for. Ransomware is the kind that makes your files unreadable and demands payment for the key.
Malware arrives at a hotel through an attachment opened at the front desk, a downloaded invoice, a browser plug-in, a USB stick from a supplier, or a remote-access tool left open with a weak password. The ransomware mechanism is encryption with a key the attacker holds: the hotel's own data is still on the disk but unreadable. Many variants also copy data out first and threaten to publish it, which turns a technical problem into a reputational and legal one.
The front desk is exposed because of shared terminals, one browser used for the extranet, the bank, personal mail and the guest app, and working files that exist only on that desktop. On paying: payment does not guarantee a working key, and it marks the hotel as one that pays. Treat the decision as ownership's, taken with legal and insurance advice, and do not present payment as a recovery plan. The defense that actually holds is a backup the attacker's account cannot reach, plus a restore that has been tested, which the upkeep section covers.
The habit: no unknown attachments, check the file type before opening, and report rather than delete, because a deleted message destroys the evidence that others were targeted too.
NoteTrick, harm, defense
Phishing gets someone in. Malware is what runs once they are in. Ransomware is one kind of malware. Backups answer ransomware; they do nothing about a stolen password. Match the defense to the stage, or the hotel buys the wrong thing.
What is two-factor authentication, and is it worth the extra seconds?
Two-factor authentication, or two-step sign-in, asks for something you know plus something you have, so a stolen password on its own no longer opens the account.
There are three kinds of proof: something you know (a password), something you have (a code from a phone app or a small hardware key), and something you are (a fingerprint). Two-step sign-in means two different kinds, not two passwords. A code sent by text message is weaker than a code from an app but far better than nothing; that trade-off is real and worth stating to staff rather than hiding.
What is least privilege in a hotel?
Least privilege means each person gets only the access the job needs: a reservations agent does not need the accounting export, and a seasonal worker's account should end with the season. Remote access is a door: any tool that lets an outside person into the front-desk computer needs a named owner, a list of who may open it, and a rule for when it is closed again.
Is a password manager safe?
A password manager holds one strong passphrase and a different long password for every site, and it will not fill a password into a lookalike address, which quietly defeats many fake login pages. The habit: two-step sign-in on every account that can move money, change rates, export guest data or send mail as the hotel. For how roles should be set up in the first place, see PMS user roles and permissions: a setup checklist.
Watch outThe shared reception login
One shared "reception" login used by the whole shift means two-step sign-in cannot attribute an action to a person, the audit trail becomes worthless, a departing employee keeps access, and a password change locks out everyone at once. One account per person is the precondition for every other account control in this glossary.
Which upkeep tasks stop more attacks than antivirus?
Patching, backups, restore tests and encryption, done on a schedule with a named owner, remove more risk than any single security product you can buy.
A patch is a fix for a known flaw. The risk window runs from the day the fix is published to the day it is applied, and that window is what attackers work in. Automatic updates on the hotel system need a maintenance window agreed with the vendor, or the front desk will switch them off at the worst moment.
A backup must be a copy the attacker's account cannot reach. In plain words: several copies, on more than one kind of storage, with one kept off-site or offline. A restore test is the only proof: pick a schedule the hotel can actually keep, repeat it after any major change, and record how long the restore took and what was missing afterwards. Encryption makes data unreadable without the key; it matters most for laptops that leave the building and for backups moving between locations.
The habit: put the four tasks on a calendar with a person's name next to each, and review the calendar in the same meeting where you review occupancy.
| Task | What it is | What breaks without it | The check |
|---|---|---|---|
| Patch | A fix for a known flaw | Attackers work in the gap | Ask the vendor for the date the last update was applied |
| Backup | A copy the attacker cannot reach | Ransomware becomes final | Confirm one copy is off-site or offline |
| Restore test | Actually recovering from the backup | The backup is an assumption | Open a file from last month's backup and confirm it is readable |
| Encryption | Data unreadable without the key | A lost laptop is a data breach | Check that laptops and backup media are encrypted |
What should you do in the first hour of a security incident?
Disconnect, call the person you named in advance, and write down what you saw before you tidy anything.
An incident is any event that may have exposed data, money or access, whether or not harm is confirmed yet. Deciding it is probably nothing is the most common way a small incident becomes a large one. Name one person and one backup before anything happens: usually the general manager, the IT provider, and the vendor of the affected system, with phone numbers kept offline as well as in the mailbox.
Preserve evidence: do not delete the message, do not reinstall the computer and do not reset the account before someone has looked. Keep a record of what happened, when it was noticed, who was told, what was done and by whom; an insurer, an adviser and your own review will all ask for the same list. Whether and when to notify an authority, a guest or a partner is a legal question, and the deadlines and thresholds change; confirm the position with your lawyer or data protection adviser rather than from a training slide. Afterwards, write a short review that produces two changes, not twenty, and check that both were actually made a month later.
ChecklistFirst-hour checklist
- Stop the bleeding: disconnect the affected device from the network without wiping it.
- Call the named person and the backup.
- Write the timeline: what you saw, when, on which screen.
- Photograph the screen and keep the message.
- Change passwords only after the evidence is captured, and from a different device.
- Tell staff what to say to guests, in one sentence, and who is allowed to speak to the press.
For the wider owner-level view, see the hotel cybersecurity checklist.
What to do next
Take five terms from this glossary, phishing, two-step sign-in, least privilege, restore test and incident, and ask whether your hotel can show the habit for each one, not describe it. Where the answer is no, that is the next thing to fix, and it is usually a decision and a calendar entry rather than a purchase. The terms fit together in one order: the trick gets someone in, the harmful software runs, the upkeep decides how far it spreads, and the response decides what it costs.
Frequently asked questions
Is two-step sign-in worth the delay at check-in?
Yes, for any account that can move money, change rates, export guest data or send mail as the hotel. The delay is seconds, once per person per device, not once per guest. Choose a code from a phone app over a text message where possible. Note that a shared reception login defeats the whole point, because the second proof cannot be tied to a person.
Should a hotel pay a ransom?
That is an ownership decision taken with legal and insurance advice, not an IT decision. Payment does not guarantee a working key and marks the hotel as one that pays. The alternative you control is a backup the attacker's account cannot reach, plus a restore that has been tested before the event.
Do we have to report a data breach, and to whom?
There are legal duties around personal data, and they carry deadlines and thresholds that change. Confirm the position for your own case with a lawyer or a data protection adviser before you notify or decide not to. Keep the written record of what happened regardless, because it is needed either way.
What is the difference between a password manager and the passwords saved in a browser?
Both store passwords. A dedicated manager works across applications as well as websites, generates a different long password for each service, and is opened by one strong passphrase protected by two-step sign-in. Passwords saved in a browser are better than reusing one password everywhere, but they are tied to that browser profile and that device.
How often should we test a restore from backup?
Pick a schedule the hotel can keep, repeat it after any major change to the system, and write down how long the restore took and what was missing. The point is not the interval but that the test happens and its result is recorded, because an untested backup is an assumption.