Hello Habr! I am a person who consumes IT products through the App Store, Sberbank Online, Delivery Club, and has a connection to the IT industry to some extent. In brief, my professional activity is to provide consulting services to the food service industry on optimizing and developing business processes. Recently, I have been receiving a large number of requests from restaurant owners whose goal is to build an information security system in their enterprises.
Let's start with a couple of funny stories. Story number one. In a casual dining cafe, the managers changed every three months. The very first manager, being a big fan of Soviet history, created the password "07111917" and used it on all resources he interacted with in his job: the automated accounting program IIKO, access to the loyalty program Plazius, and the installation of security and fire safety systems. One day, this manager was caught selling guests' personal data to competitors and was successfully fired. However, the revolutionary password "07111917" continued to live on and was passed from one manager to another. As a result, every waiter in the establishment knew how to connect to the office Wi-Fi. Moreover, guests also learned this password, as waiters, out of kindness, recommended they connect to the "faster" internet called "internet_office."
In the food service industry, staff often exploits weaknesses in information security for their own gain.
Story number two. A handsome young man in a blue jacket meets with the CEO of a large restaurant holding. They engage in the following dialogue:
ā Our company specializes in information products. Today, I propose that you consider the possibility of acquiring the next-generation password manager "Falcon Eye"[1]. It is unique in that it has a high level of reliability for both the cloud version and the on-premises version. The encryption is done using the AES-256 algorithm. In addition to standard features of any password manager, Falcon Eye has advanced backups and security audits. What do you think?
ā Konstantin, thank you for the information. What is the difference between the boxed and cloud versions, and why do I need all this?
Both stories mentioned relate to the same issue - the low awareness among managers about the role and significance of information security in the functioning of enterprises. However, there is an additional nuance. The way representatives of IT companies present their offerings also does little to foster understanding among managers about the necessity of IT products. Over several years in my consulting practice, I have come to a strong belief that the HoReCa segment is a poorly explored market among suppliers of IT tools for implementing and maintaining principles of information security. In this text, I would like to share a fragment of a small study we conducted among managers in the food service industry to determine their awareness regarding the implementation and use of IT products. First and foremost, I want to focus on the use of password managers. I should add that conducting the research was driven by a desire to better understand the mindset of managers to more effectively promote my consulting services.
Briefly on the methodology. A qualitative data collection strategy was chosen. We conducted twelve informal interviews with managers and their deputies in six food service establishments. The interview questionnaire consisted of twenty questions related to the overall philosophy of information security, knowledge of the regulatory framework, handling personal data, technical capabilities of the protection system at specific enterprises, used IT products, including working with password managers. All interviews were transcribed, and the results were summarized.
Everyone has been in a situation where they cannot recall the password for their account.
When starting with conceptual questions, most respondents associate information security in enterprises solely with the storage of personal data of their employees. Managers do not delve into the technical details of the issue. They are concerned about how effectively a particular software will save time, assist in secure data storage, and how user-friendly it will be. Moreover, priorities are ranked in this exact order: (1) ā time ā (2) ā security ā (3) ā usability.
āListen, I need to create schedules, prepare reports for the owners. Things are constantly breaking down in the restaurant. I am catastrophically short on time to deal with program settings and reinstallations. We don't have an IT specialist on staff. If thereās something quick and convenient, it could be worth a try.ā (man, 41 years old)
āInformation security here is limited to labor books being stored in a safe, and passport data is on that top shelf next to the accountant. This is all bad, and I understand that. But setting up security properly takes time, and I donāt have that currently. We had experience purchasing advanced antivirus software; we even bought a license. There were constant notifications, which were uncomfortable and distracting from work.ā (man, 35 years old)
āAbout six months ago, a seminar on Federal Law 152 was organized for us at the business incubator. Back then, and even now, I understand little about personal data. The main thing, and I told the owner this, is that we need to establish order in our personnel records. I have access to the data, the accountant, with my consent, and that's it. Right now, things are certainly chaotic here.ā (woman, 34 years old).
As the interview results showed, five out of six establishments lack standards and procedures for ensuring information security, and there are no responsible individuals. Moreover, there is neither a full-time employee nor an outsourced specialist who manages and controls the security system. As one of the respondents said:
āWe have a guy who adds information to the restaurant's website. In theory, he could handle all this.ā (woman, 35 years old).
Concerns from managers regarding the safety of personal data are quite understandable. More cases are arising with administrative and , and the demands for checking personal data operators are changing. In the restaurant sector, this issue is becoming increasingly relevant as, in addition to internal access to accounts, most establishments have loyalty programs, where the number of residents reaches into the thousands.
In my opinion, representatives from the IT industry currently have a good chance to access a market where there is a clearly defined problem and a need for its solution. Over the next three years, the demand for establishing an information security system in the food service industry will only grow, especially in the regions.
However, despite a superficial understanding of how an information security system should be structured, all respondents use password managers. Moreover, some require their sous chefs, head chefs, and administrators to use them. The first question we asked the respondents was which password managers they use in their establishments:
āI donāt know if I pronounce it correctly, but right now I use Zoho[2]. Itās amazing, but I can check my password even from my phone and from my work computer. The only thing I need to remember is the master password for access. Thatās why I wrote it down in my notebookā (female, 32 years old).
āYou know, I started using a password manager by accident. A friend from university works at a bank and let me try it. Itās called Password[3], and so far itās convenient, saves time. We had a problem where a former employee connected to the accounting system and viewed our revenues. We accidentally found out that the passwords active in the restaurant were created by him. We had to urgently redo everything. Thatās how the need for a manager aroseā (male, 41 years old).
āI studied a little as an IT specialist in our technical school. When I thought about a password manager, I settled on CommonKey[4], as it handles the administration of employee personal profiles well. For our network of pizzerias, itās very convenientā (male, 38 years old).
I would like to point out that I selected the most meaningful comments from the respondents. Most of those surveyed could not recall the exact names of their managers. For some, the password manager is solely associated with storing data in the browser. Overall, when choosing a product, respondents do not question the cryptography underlying the password manager. Their priorities are speed and ease of use.
Although there is a general understanding among those surveyed of why they need a password manager, respondents use them occasionally. As one female respondent said:
āWhen on one side a client is pulling you for a banquet, on the other side a supplier, and on the third side, the staff is asking when salaries will be paid, while you are in the middle of creating an account for a new employee, the only thing left to do is write down the login and password on a piece of paperā (female, 41 years old).
However, there are certain practices involved. There are a number of issues that have led to the application of password managers in the food service industry. What are these issues?
Firstly, access to loyalty programs. It is no secret among insiders that staff often manipulate discounts, rewards are allocated to plastic cards tied to staffās relatives and friends, etc. The most effective way to prevent fraud is to regularly monitor account activities in the backend of the loyalty program. The situation is complicated by the need for at least three people to have access to the program: the manager, the marketer (for SMS and push notifications), and the operator who manages the loyalty program (in case of technical failures or when adding additional options).
āThe only time I try not to forget about the password manager is when working with our guest database. Besides accessing guests' personal data, through this database, you can deposit or withdraw virtual money. Once a month, I change the password and rank access depending on the user's status. Therefore, information needs to be constantly updated. The password manager makes my work easier in this regardā (male, 48 years old).
Secondly, every enterprise has employee magnetic cards for access to automated accounting systems (e.g., IIKO or R-Keeper). There are amusing cases. A waiter gets fired and leaves with the card. Essentially, the departed waiter knows the access password to the system, where the financial indicators of the enterprise are reflected, dishes are deleted and written off, and working hours of staff are recorded.
"There was a case where a terminated employee colluded with a bartender and charged alcohol to business expenses. Somehow, this person still had an unlocked card and was using it" (male, 38 years old)
Thirdly, managers come and go, but the accounts remain. The professional adaptation of a new manager slows down when he sits at the monitor screen trying to reach the previous manager to find out the login and password for email, the Mercury and EGAIS systems, the personal account on the METRO company portal, etc.
"I couldn't properly address issues when there was no access to any active accounts. The previous manager had a poor relationship with the owner and didn't pass anything on to me. I had to restore everything, sift through her drafts, and convince someone to share information. After that, I firmly decided that I would store all passwords in a special program" (female, 29 years old).
Don't make the same mistake , use a password manager
All of the listed situations can be useful for IT developers in formulating sound commercial proposals for representatives of the restaurant sector. Once again, I emphasize that the HoReCa market is ready to consume IT products. This applies not only to password managers but also to antivirus software, video surveillance systems, and business process optimization.
While writing the text, I realized the significant business potential of implementing information security standards for restaurants, cafes, and bars. Therefore, I invite all interested parties to comment on which software you would recommend to HoReCa representatives for building a reliable information security system. To conclude the topic of password managers, please participate in the survey below. I would greatly appreciate detailed comments regarding your choice.
[1] The name is fictional. Any resemblance to other password managers is merely coincidental.
[2] The respondent is referring to the password manager Zoho Vault:
[3] The respondent is referring to the password manager Passwork:
[4] The respondent is referring to the password manager CommonKey:
Only registered users can participate in the survey. , please.
Which password manager do you use in your companies?
CommonKey
Passwork
Vaultier
SimpliSafe
Other
8 users voted. 1 user abstained.
Source: habr.com
