Sergey Nivens - Fotolia

Gulf-based Rotana Hotels centralises IT security

Hotel group implements centralised security management to proactively protect endpoints and achieve accurate security information

This article can also be found in the Premium Editorial Download: null: Reinventing Bahrain’s Kanoo Group through digital technology

Rotana Hotels had to rethink its cyber security strategy after centralising its critical IT systems, and began with a centralised anti-virus system.

The Abu Dhabi-headquartered Rotana Hotel Management Corporation has more than 50 properties across the Gulf Co-operation Council (GCC) countries, with six more planned.

The group is an early adopter of hybrid cloud systems in the Gulf hospitality industry, and delivers hotel business applications as a service from its datacentre.

In 2015, Rotana centralised all its critical applications in its corporate datacentre, including the property management system. This required the IT section to rethink its entire security infrastructure.

“Centralising applications and IT services meant we needed a scalable and secure IT environment,” said Biju Dharmarajan, director of IT security and infrastructure at Rotana Hotels.

He said security is a top priority for the company, which invests about 20% of its total IT budget in security systems.

“We have recently moved to next-generation firewalls, but our security infrastructure revamp started with the implementation of a centralised anti-virus management system,” said Dharmarajan.

Results from a recent IT security survey of Middle East organisations by analyst IDC revealed that the top three threats to enterprise security across different verticals are infected USB drives, data theft by employees, and advanced persistent threats.

Insider risk

IDC said that although these threats could happen in various industry segments, they all had one thing in common – insider risk.

“Advanced persistent threats can go undetected for long periods of time, which adds to the complexity of the challenge,” said Megha Kumar, senior research manager for software at IDC Middle East, Africa and Turkey.

“Increasing the levels of awareness and proactivity around security is critical for organisations across the GCC. Financial motivation continues to drive cyber crime activity in the region, although so-called ‘hacktivist’ incidents are compounding the situation, with websites now also being defaced simply to drive a particular political agenda.”

Rotana Hotels’ network supports about 6,000 IT users and the same number of endpoints, as well as more than 100 servers. “We wanted to implement a single information security infrastructure across all our properties,” said Dharmarajan. “We wanted a solution that could help us centralise and streamline the management of endpoints and give us a consolidated view of our security posture.”

Specialist IT security solutions provider Think Software Services proposed the implementation of McAfee ePolicy Orchestrator (ePO) which gives organisations a unified view of security, with drag-and-drop dashboards that provide security intelligence across endpoints, data, mobile and networks.

Read more about cyber security in the Middle East

McAfee ePO software gives Rotana flexible, automated management capabilities that enable its security team to identify, manage and respond to security issues.

“Besides centralised security management, we were looking for a solution with multi-tenant-based architecture that would help us drive down the cost and complexity of managing security,” said Dharmarajan.

After a phased implementation of McAfee ePO, Rotana’s security teams can now monitor the company’s security posture, improve threat detection and expand incident response capabilities.

“The biggest benefit is that now we can roll out and enforce security policies across all our hotels, and run pre-scheduled scans without having to send our engineers to the locations to do it manually,” said Dharmarajan.

This is done through McAfee agent handlers installed at each property, which automates the workflows between security and IT operations systems and handles the communications between central ePO server and endpoints.

Be prepared

Although Rotana has never faced any serious threats, Dharmarajan said it was essential to be prepared. “Many of the breaches can be avoided through regular device scanning combined with understanding of security policies and procedures,” he said. “What you need is a complete picture of what is actually happening in your environment to mitigate risks.”

IDC’s Kumar added: “Budget constraints are likely to remain a challenge for the foreseeable future in the GCC. But the security conundrum becomes even more challenging when organisations start downsizing their headcounts in a bid to free up much-needed resources.”

In such scenarios, the threat of insider risk increases as disgruntled employees leave the company, potentially taking sensitive corporate information with them, said Kumar. “As such, data loss prevention, data access management and governance are all major security factors that organisations must address to avert any unwanted drama.”

Having secured its endpoints, Rotana’s security team is now gearing up to go to the next level to completely protect its network devices and data. “From day one, we have been serious about data protection and security is addressed at the highest levels of our organisation,” said Dharmarajan.

“Now we are working on implementing a data loss prevention system along with identity and access management, which will give us more visibility into our security environment. Security is a work in progress at Rotana because we don’t rest on our laurels.”  

The aim is to be PCI-compliant in the next couple of years, he added.

Read more on Web application security