How to industry sign banking kentucky ppt secure
welcome to the hotel investors marketplace produced by hotel brokers International I'm Brandt niehaus president of HB I and president of huff niehaus & Associates Inc a hospitality real estate brokerage and consulting firm located in Louisville Kentucky the hotel investor marketplace is designed to provide today's hotel owners and investors with the most current industry information and an opportunity to preview recently listed hotels while everyone is getting signed in and comfortable we will highlight a few of HB I members listings on the screen and I'll share a few other items with you Hotel brokers international was founded in nineteen fifty-nine and is the leading network of real estate brokers specializing exclusively in hotel real estate investment providing every phase of the brokerage process from property evaluation to closing hpi hotel brokerage specialists are successfully negotiating has successfully negotiated more than 10,000 hotel real estate transactions and annually account for the greatest market share of all select service and economy hotel sales in the United States you can visit 8gb I on the website at whb I hotels com if any time during this webcast you have any questions just click on the ask question button found on the gray bar located at the top of the web cast player type in your question and submit it we will answer as many of them as we have time and don't hesitate to ask more than one question we want to let you know that we want you to let us know how we're doing so also you'll see a rape button to click up in the corner in the gray bar please do so towards the end of the presentation and give us some feedback on on this presentation later today this webcast will be posted the demand viewing at HB I hotels com and you can come back in and listen to it again and maybe follow up on some some point you missed at your leisure today our discussion topic is roles of the owner controller and CFO and a data security today we have with us to participants presenters from Clark nuber a CPA firm in bellevue washington their consulting firm as well helping all types of industries with their cpa needs and and with today's topic of data security Julie Eisenhower is one of our speakers and she's a shareholder at Clark maneuver where she provides audit assurance and consulting services to privately owned companies she also leads the hospitality industry practice area which serves hotels restaurants entertainment companies private public clubs conference facilities and more Peter Henley serves as their senior director of IT for Clark maneuver and is responsible for aligning IT with the firm's strategic business plan and making Clark maneuver the most technologically advanced accounting firm in the northwest he has been recognized with many industry awards for unified inbox client portals SharePoint workflow and speech recognition they will be presenting today slide presentation on how to reduce some of your risk and the issues involved in data security in particular with the hotel industry I want to welcome Julian Peter thank you for being with us today would you like to introduce yourself than any other way add anything to what what I just said Brett I think you covered it thank you okay well then let me turn it over you Julie and I'll let you get started and and you and Peter can pass the time back and forth as you go through the presentation okay thank you Brandt good morning or afternoon depending on where you're joining us today data breaches strike all industries but for the hospitality industry the streaks are extremely high and the financial impact to a company can be significant so why are hotels of such interest to information thieves there's three main areas the main one being there's a lot of transactions being done through credit cards and debit cards and fraudsters love payment card data it's just very valuable and we'll see that in some of our future slides here how much value that information can bring them hotels are frequently tied to other computer systems so they might be tied to their hotel brand through their reservations or their accounting system they might also be tied to outside vendors that they're using on a regular basis hotels also see high turnovers and employees and as a result there could be poor employee training in proper security practices that can make a hotel vulnerable to a data breaches security industry experts actually state that data breaches are unavoidable it's not a question of if a company will become a victim but when so the objective of our presentation today is deprived IG with some practical steps to help reduce your risk by taking some proactive action steps so our program discussion today will follow these concepts here that we bliss on the screen we're going to walk through the key key statistics why is this important to us what's the magnitude that we're looking at we've done some informal surveys of owners and CFOs in this area on data security and we'll look at the results of that see how you might compare there why our controllers and CFOs getting involved in data security and what are their new roles there we'll look at key components in data security and information technology risk management what are some best practices for managing information technology and then how do we mitigate risks when we're using mobile devices or cloud computing key statistics and cybersecurity so we all think it's not going to happen to us I'm a small company my risk is low breaches at large companies make the headlines you've seen wyndham you seem target there's a lot of them out there that that make the headlines but small companies are at risk too in certain industry sectors actually the cyber criminals are frequently breach smaller businesses so for example smaller hospitality businesses by far ranked number one with retail being number two and forty percent of breaches attack on point-of-sale systems so that's why those two are ranked high hospitality and retail seventy eight percent of all companies in the US suffered some sort of data loss or theft in the last two years and forty-four percent of small business state that they have been a victim of cyber crime of some kind at least once more than half of us small businesses have experienced at least one data breach and seventy-five percent of respondents in a recent survey say that they've had or expect to have a data breach that results in negative publicity so we see here on the slide why these payment card fraud is so valuable to these cyber thefts or criminals is that there's top dollar that they can get $45 per records if they get access to solon platinum cards and we've got three dollars for Social Security numbers and such so there's there's high dollars there and the magnitude of the data that's in our systems can bring top dollar to them the 2014 pas naman Institute report states that it costs a company 201 dollars per personal records stolen and this is up from one hundred and eighty-eight dollars in 2013 so some of those costs could be direct costs such as forensic experts that need to be hired to really identify where our total loss might be you might be outsourcing hotline support or providing free credit monitoring there's also the valuable indirect costs of Investigations communications to customers and then your loss of trust from the customer and loss of customers themselves can be very damaging so like I said earlier we did a informal server survey of controllers and CFOs who work with companies in the hospitality and retail industries and the following are there are our results that we received and how would you answer these questions yourself how often do you encounter technology related questions or concerns in your role at the company so as we see here in our results eighty-two percent say they frequently receive questions or concerns over their IT technology eighteen percent said minimally and there's not one person that said they never get a question around that we also ask them what is your top concern regarding your role in data security and these were their tops concern securing the environments so being conscious about keeping your customer data or your employee data even your investor data safe you might even have trade secrets and other information that needs to be kept secure whether they have the right people in place so how do I monitor if I'm outsourcing my IT firm management and I have difficulty finding resources and the needed expertise to manage my data security our researchers resources internally are overloaded so how do i prioritize and manage those resources effectively they question what their role is so you know technology is constantly changing how do I stay up to date what are my current threats how do I stay informed what questions should I be asking an IT professional when I not an IT expert myself losing important data is a you know a data now it's valuable we're all trying to provide that profession scar that personal touch that personal experience and so we're maintaining and retaining a lot of data and our customers and so losing that would be damaging for our business and then just risk management how do we secure our reputation our trust from our our customers our clients and defer fraud how confident are you in understanding the risk associated with information technology twenty-nine percent say that they are very confident while 71 percent said they were somewhat confident so this supports their earlier concerns about you know not knowing how to stay up on changing technology and what questions should I be asking what do you see is your top technology initiatives ranked from 1 to 3 1 being the top initiative this identifies what we've what's been done spoken to earlier securing the IT environment is very important to them that's one of their top and is managing IT risk and compliance there's becoming more more regulations around IT and complying with those regulations and then managing and retaining the data how do I secure it however maintain it the American Institute of Certified Public Accountants did a survey themselves to top us accounting professionals on what are their top five technology priorities this next year and this is the results of this mirror exactly what our results of our informal survey stated is that the securing the environment is a top concern of their is in the top priority in fact it's been their number one listed priority for the eight times the last ten surveys so it is a top concern for many overseeing the finances of an organization the information the CFO controls and works with on a daily basis is the most sensitive and important guy said earlier you're going to have investor information that you're retaining you'll have employee information social security numbers health records customer data credit card numbers so very sensitive and important information that there the watch over on a daily basis and so the CFO must understand where this information is at all times how is it secured who might want to steal it and how are they going to gain access to our system the CFO has a strategy there is a strategic direction for a company in the financial area and they need to have the big picture of an entity and their entity risk so working with an IT professional is imperative here the owner controller or CFO need to ask the right questions of IT around the data security and focus on risks that have a high likelihood and a substantial impact on the business the risk and rewards you might have heard recently in the news the wyndham hotel group actually back in 2008-2009 had a significant data breach and hit the publications and was in the headlines and they've you know it's been four or five years now they're back in the press again because of their negligence and their stewardship over collecting and storing customer data so a recent court ruling involving Windham highlighted their operators obligation to secure personal data stating that the Federal Trade Commission has authority to regulate cybersecurity the ruling stated that they had had conduct that was unfair business practice and that its privacy policy was deceptive so they had on their website that they were securing all other customer data and everything was secure and tight well they weren't acting in their stewardship role and actually securing that like they say they were doing so they've now got another bad press even five years after the event has happened so there's a lot of regulatory penalties involved here there's your brand reputation damage that's at risk as well as any financial strategic losses each state has their own regulations around communicating breaches and each have their own penalties as a result Julie were were those breaches within the Wyndham corporate like reservation system or was it through a series of different hotels well that's a really good question it actually came internally so one of their hotels an employee within a hotel logged on to the internet and that then computer was connected to their their brand and so it went directly to the brand itself the their national headquarters which then infects all of their hotel owners that are associated with that brand because network of their computers being but it did start at a property it started internally yes that's where training becomes very important go back here on our slide so following the significant data breaches that have occurred over the last few years is managing IT security the new normal for owners and controllers and CFOs the recent surveys suggest that it is so like I said earlier the owners and controllers must take a more comprehensive approach to the financial health of the company by addressing the IT and more of an enterprise risk assessment basis and on a regular ongoing basis a technology is constantly changing this is something that can't be done once it ignored it needs to be done on a regular basis so it's asking yourself what could go wrong where's our data how can they enter our system that's my auditor hat I'm constantly working with my clients thinking about what could go wrong what could damage your reputation what could hurt your brand what could affect your financial reporting IT security must be a top priority in defending your company's future and financial sustainability and it must also be correctly prioritized and aligned with the business needs so that's where Peter comes in is walking through you know what's what's realistic here we can't do it all we can't secure everything but what's someone in our position what can we do to really take a stewardship roll over this risk Thank You Julie hi everyone this is Peter Henley today's discussion are for executives such as yourself has truly said there's two things that I think can really help you work through these materials today one is that you need to have the correct amount of knowledge surrounding security and cyber staff the correct amount of knowledge is different for everyone but you can't have no knowledge and I don't recommend that you have a lot of knowledge that would be redundant with your technical people so the right amount of knowledge is what you need the second thing is the information that you need to talk to your technical people and you do and so that might be a checklist that might be a presentation like you're looking at today but discussion points no one is expecting you all to just come up with questions and ideas around security out of your part of your experience or out of your mind so so we've got some of those materials for you today and and then one more thing before we start in on the discussion is that it is people sometimes executives like ourselves we we think that we have to be the ones to figure out what the technical people are saying but it really is the other way around and I've had discussions with technical people and they start throwing acronyms out there or talking to technical and I'll stop them right away and say look explain that to me in plain English and now and most the time they can get through that but it's their responsibility to to talk to us and on ours to talk to them okay so first of all security is all about perception and the story I have behind that is if you have an old five-year-ol
fiber wall or something and you're one of your texts brother-in-law's configured at a couple years ago it actually might be a very good setup with the right configuration and serving you well but if you do have a problem that is not what you want to present to your constituents or to a judge who's saying what did you do to secure your environment because it just it's not perceived well so perception is a big deal second thing balance the balance of costs user access and complexity we can't if you mix assistant to secure no one can use it if you if you can have a system that's way to secure for your environment and you've wasted money on it and then also the complexity which is how its configured if it's too complex to configure and the maintain like you is going forward and you don't have the right balance so that balance that's sometimes difficult to to get usually people start with cost and then I tighten it up so their users have enough security and but not too much that's something you'll have to work on with your technical people of low on period of time three aspects of security psychological and social physical obviously is having a locked door on your server rooms making sure that you keep your laptops close by logical people usually don't understand but you could just think of it as credentials username and password and so you get into your system and then most people can't get into their firms payroll that's logical security and then social now is a very very big deal and we'll talk about that a little later when we talk about training but mainly the idea there is that your employees are trained so that when someone calls and says if I'm the helpdesk and they'd like to get their username and password they don't get it that's the main thing there a couple other things to understand here is data when we talk about data if there's really two ways to think of it one is data that you're transmitting over the Internet and the other is data that's just sitting on a hard drive whether the hard drive is on a laptop or on a server or maybe in a cloud application there are very different kinds of security that go with those and to keep it simple I'll say that that data in transit is in a web browser and you look there to do for instance when you go to your bank you make sure that you're on the bank's website and you make sure there's a little log in the browser bar and that's and so when you transmit data it's encrypted and it's secure data at rest the best example there is that I'm something you'll hear me say more than once today is that you need to encrypt your laptop's laptop encryption is just essential nowadays and then put your security assessments in the past and and for the last 20 years we've always dwell mainly on the perimeter we don't want the bad guys to get through our firewall but now what we're seeing is very few intrusions take place as an attacks on the outside more of them happen from the inside usually by mistakes that users are making the two most common ones would be clicking on the wrong URL an email the wrong link and then that downloads files and and the computer is infected and and spreads to the network the second one is people picking up USB keys I know this sounds really specific but it happens a lot is people will find the USB key plug it into their computer and a way to go the virus is in there so some best practices in general for managing IT and apply security to all of these but I put the slide in there just to give you an idea of the overall environment so if you if you're treating IT as a cost and trying to keep it as low as possible and just you're running old gear your people are not trained then there's a pretty good chance that your security is not up to date either so treating IT as an advantage to yourself something to leverage your business something to help you complete your business plan accelerate it accelerate your growth that's that's the best idea to have round IT security will come along quickly with that you can see training on this slide yeah that i mentioned really important to have hopefully annual some sort of annual security training for your people that could take place in us in a formal setting with teacher-led security or could be small snippets of security on youtube I've seen that quite a bit and it works well and then the last item there is interesting for executives and that is don't shy away from different things be a power user tech technicians that were all power users executives we need to we need to be curious about systems and click on things of course not that URL in the email but the right thing so don't shy away from it sit in there and make some trouble mobile devices clearly a large concern nowadays and prepare to the for on these of these bullet points the four there's four of them that make a mobile device management policy and those inventory is just knowing knowing what mobile devices you have connected to your network but the next four then encryption phones need to be encrypted and most modern phones coming cryptid password enforcement you people have to have a password on their phone and then to make that secure and inactivity timeout and I think I phones for instance maximum is 15 minutes and that's fine just something so that if they lose their phone and somebody finds it a half an hour later it's not going to be open and then finally the ability to wipe a device and by that we just if the IT department can see the device then most for instance if it's cooked up to Microsoft Exchange using outlook email then your IT department is going to be able to kill that device and that's important to have so those you can get really expensive nvm systems but frankly we don't run a really expensive one but we have these four items firmly in place but that's the key Peter many of our listeners are probably the smaller operators at least we do have a good following of the investors had owned five or less hotels so they generally don't have an IT department you've made some good suggestions here but do you have maybe some broad brush thoughts that they should keep in mind as procedures that you would suggest them to implement or how they would go about because you know like a lot of this is new information to a typical small or operator who hasn't had to deal with IT or or these kind of issues what would you recommend to him for him to do to sort of protect himself great great question and two things come to mind one is we've all got IT systems and whether we have an in-house IT department or whether we have a consultant that's outside that we've outsourced our technology to every company has to have some sort of of IT influencer so if what I just mentioned earlier about for instance wiping a phone if somebody loses a phone and you have to call your IT consultant and tell him to wipe it that's that works fine the other thing in that damn thing and it's pretty typical an IT I would know how to do you know the track down their phone and and do that or do you have to talk to certain IT people that's a good question and no answer would be no that is something that's any technician who's involved with your system would be able to do that now it's really it really easy if you had that discussion first or or soon before something bad happens before someone loses a phone for instance and and this is this is a good idea to do with with all your security the trick really is to have discussions first so that when something happens you know what to do and so you talk to your IT person and you say hey I saw our webinar and they say I need to be able to wipe a phone if one of my people loses it do you can you see all of our phones on your screen and if they can't then it's not expensive to make it so they can and they need to be able to if those phones have corporate information on them then they need to be secure and so the technician most likely is going to say oh yeah we can like your phone's real easy i've got a console here and it's no problem I assume there's other things besides just phone that the IT person could maybe even go back and view this webinar with the owner and and come up with ideas that might suggest practical applications for that smaller operator yep that's exactly exactly right I would highly recommend that and then and that gets back to the first point I said about having the right balance in place because your IT provider can make you an extremely can make you like Fort Knox but you don't need that right so if there's the balance and so when you when you tell your person we need to be really secure i saw a webinar today they're going to sit down you and say well what about this what about that and then that's where you need to hold that technical person to be able to describe things well and not depend on you to know all the technical aspects over but you have that discussion you get the security in place that you need at the right costs and then as even and even that is building what what you'll have in place so that if a breach does happen you know what to do you know what capabilities you have and you had that discussion with your IT person ahead of time it was a great point sprint so here we have yet mobile is a big thing cloud is of course everybody knows about cloud computing now and without going through all these bullet points the main thing with cloud and very similar to mobile devices as having an inventory of what you have really and here's a here's something I would recommend that you memorize and think about for a minute or two and that is that as as people in charge of or the where the buck stops with security there's two things about our data one is that we need to know what data we have and where it is and the second thing is we need to know who has access to that data and so those those are both inventory items so we've got computer inventories we've got software inventories we've got mobile device inventories and we've gotten inventories of our data and then in addition we've got now software that learns in the cloud and we need to separate that from on-premise software and inventory those two items separately the reason being is that we are not responsible for the security of those someone else is someone outside your organization is and so that's a lot different then software that resides on your server and that your employees use so this whole slide deals with all the cloud all the ideas of how to go about assessing the risk on your cloud applications developing policies so that people know the proper use of them then I won't go through every bullet point here the second from the last one purchase data breach insurance is a bit of a new idea for many companies it's just in the last year or maybe to the insurance brokers have are figuring out how to do that the policies are not expensive and i will say that the tub is one of the biggest advantages of these policies is that you have someone else there a phone call away to help you through a breach so it's not just an insurance policy that you know you have a data breach and horrible things happen and then some insurance company pays for it the data breach insurance that you should have them that the insurance companies want to provide you with services because it mitigates their costs so you have a problem you realize it's a problem you make one phone call and then your data breach insurance company takes over and so they're they're in charge of finding how expensive the breach was of notifying or of responding to the media it's always a big deal so everyone needs to look in the data breach insurance if you haven't already it's not overly expensive for instance here Clark nuber we carry million-dollar policy for about seventy five hundred dollars a year so it's not and it's not insignificant but hopefully affordable with cloud computing a lot of smaller operators will use you know free services or minimal kind of monthly charges for for keeping files out in the cloud and so that's a third party company that's providing that that that cloud service what kind of concerns I mean are those companies covering these security issues or do the smaller operator need to consider insurance and some of the other aspects that you brought up you understand what I'm saying you know I do well guys tend to depend on these third parties to be doing everything is that right does that say fast the short answer is yes that's what we're paying them for basically we're taking software out of our environment out of our own control at least some of our control goes away and we're paying someone else to do it which is an excellent model we need to do what we do best and pay somebody for what they do best doing go to the next slide on here i'll come back to this one next year and here i put this on there the way it is but you can basically ignore everything on the right-hand side and look at at the very first column that is a list of certifications that cover the gamut microsoft has done a great job now if you don't have health information then you don't need to HIPAA certification and if you don't do work the federal government then there's others you don't do if you don't do any education then some of these are not for you but to that the reason I wanted to show this person is the two that were interested in is the bottom two further actually the bottom one soft too and that happens to be an American Institute of Certified Public Accountants certification so that falls right in doing in my wheelhouse and so I show those three just to say that there's a lot but also to say that that is all of them and so the providers that you use need to have some of these certifications not all of them but at least the bottom one okay go back one slide so here is a checklist for you to work through with your technical people and this is when you do this is and it says contract on there and certainly all these items are in a contract but more to the point it's the discussion about could be a discussion about what software you use what cloud software you use and and the different different risks that you have with that and the different risks that you're paying someone else to have with a cloud application so this is me pick one out here number three meaningful SLA SSL a stands for service level agreement and that would be the simplest part of that would be that the cloud provider says we guarantee that our software will be available to you ninety-nine point nine percent of the time and they'll have other items in their service level agreement that either you or your technician their IT consultant can can go through data ownership is is a fear that everyone has and and who can get to that data once again what day do we have and who has access to it for the hotel industry I don't were too concerned about the NSA getting into our data and and microts Microsoft and Google's job to name a couple to make sure they can't but once again i'm talking about balance here so for the small operator i would recommend that you just use a reputable data center and a reputable cloud provider so if you're using gmail you're pretty secure gmail you have a good service level agreement gmail doesn't go down very often and now the same thing of course with microsoft office 365 so i would say as part of the balance that you not get too carried away without this slide but that you use it as a as a discussion tool with your technical person so here we are at the details around how to address your cloud provider of software or your tab provider of data and now what to talk about so I made the slide all inclusive but i'll just hit the highlights and say that we're interested in shock too and we're interested in type 2 now you might and so what we're talking about here is that maybe you have a line of business software management piece and so you call them up and you say I'd like to see your certification through security certifications specifically a sock to report or ssae 16 is another another I think we saw that on the last page but it's not to report is pretty standard and all the data providers should have that and so you call them up over your IT person call them up and says I'd like to see your sock to report if the Sun to report that they look at is type 2 that's g
od that's what you want if its type 1 that's hopefully it'll be tight to in future years but type on the still ok and so you tell them you need a sock to report and then you get the sock to report and the first thing that says is that remember is that the application is compliant with sock to and with the standard but the data is hosted somewhere else and so this report doesn't include the data is what we call carved out and so that doesn't help us a lot and so then my question to them is okay who's got the data and they may they say something like Amazon Web Services has is one of the big guys Microsoft Azure and you say okay I'd like to get their software to for it well they're not going to give it to you unless they're recommended by your provider and I'm trying to paint a picture that's complicated here too make my point is that when i say three-tiered hear you call up your software provider they say what will give you what we have but we don't have your data and so you call up the data center and they say well you're not a customer of ours so you go back to the cloud provider and they have to introduce you to them and then the data provider sends you this horrible NBA that you have to sign and finally you get the sock report of where your data is so it's I know it sounds horrible but this is what we need to do to make sure that we're using the right key and so once again it makes it a lot easier if using large applications that millions of people are using it's the problem is when you get a small application and there might be only 50 other customers using it and nobody's ever heard of their data center those are the ones work that you have to get specific with when you say application go ahead read sorry when you say application are you essentially meaning a third party vendor where are you talking about some kind of service that just very few people use so therefore it's not not guaranteed to be six not guaranteed yeah yep yep and so I'm cloud applications they are popping up every minute if you're using office 365 email that's a cloud application and that's one you're not going to have to be too concerned about but a smaller one you will have to be concerned about and inquiry should be done the one thing I wanted to highlight on this screen to that as an auditor is we look at on a regular basis is the user controls that bullet points second from the bottom the controls at the service shins are only as strong as the users controls internally are so if if their reports will actually highlight here's the controls that were strong here but we're expecting your controls in these areas to be strong as well and a lot of those are geared towards access rights so you know we're looking at this and we're doing a play benefit plan audits for example is that you know you have entry into your plan administrators books and records and Social Security numbers but and our controls are really strong over that but if you have really weak internal controls that anyone can have access into this data then we are not liable but that's really we're depending on you to also have your own user controls in place so that's something that we're looking at is auditors is these are only as good as the users using them are strong as well well said so in summary of this here I know it's complicated the idea is that if your data is somewhere else and someone else has control over it you need to at least do some due diligence work and so that so that if something bad happens and the question comes well what did you do to vet this software you took data and let it out of your control what did you do to make sure that it was safe and you need to have something to say and the easiest thing to say is well we got their sock to report and that that will suffice in ninety percent of the cases so a lot of detail here but that's the major idea it's really not acceptable to use a cloud provider have a breach in someone says what what did you do to protect our data you don't want to have to answer with nothing there's a question here I don't know if this is the right place for it but if a hotel outsources their credit card transactions and payroll and that vendor has a breach who's responsible for the is it the hotel or a great question that's a great question and answer is both the hotel is the is the steward of that information there they're accountable to their customers to their guests now if what we've gone through here on that last slide is a way to pass that along to the people who actually have the data and so in the service level agreement that SLA we talked about you'll see language like that and a lot of times the language will say we don't take any responsibility for your data and you're completely responsible for it and we accept no liability for it and so that's when you need a sought to report because you're basically holding them accountable to something even if it's not as much as you might like and so what you're suggesting is that in that scenario the hotel operator management company would ask for a sock to report from that vendor and if a vendor can't provide a sock to report then that sort of raises a red flag that you should be using somebody else is that when especially exactly you're summarizing it very well and if they have no sock to report I would say it's more than a red flag I would say you need to find someone else right let me check see if there's any other questions that was like the last one anything Julie you'd like to summarize and conclusion well I think it's a field role not that year is that your customers are trusting you with their personal information and as a business owner and a CFO your responsibility is to provide stewardship over that data it's become valuable more and more and and the the risk is higher and so just taking that seriously and be mindful of that and having that in your daily conversations and your trainings and your policies and procedures that and constantly thinking what could go wrong who do we need to you know like we talked about the smaller hotel owner if this is not an expertise that you have you've got a partner with an advisor who has that expertise and it's your job is to either of your business I would add that if you want if today's information has been meaningful to you there's two things that you could do that the first two things you should do first one is talk to your IT people and go through some of this information and tell them you're interested in security and they will help you the second thing and it's easy to do is to get a written IT policy and doesn't shouldn't be too long and get that out in front of your employees so that they have signed something that says they will act responsibly with your data that's an inexpensive easy way to get your feet wet with security now as things go on your IT policy should be signs every year by your people you can use it as a training platform you can update it you can make it more specific in years to come but just a general one page policy and as a matter of fact I'll put one up on SlideShare about calm / clerk goober just a small template our policy has evolved over the years to be rather large but I'll put the small template up there and you can at least use that as a start to work with your people there's really you know we can put systems in place to prevent security but it's a lot easier a lot less expensive to just rely on your people to do the right thing and that starts with a good policy that's a good idea now you know this webinar will go on to our website and has a pretty long shelf life will that access be there for that template for a good while how does that sorry but it down load up on that sure no I'm just like stay calm that'll stay up there indefinitely but one of my sin you want also and you can put it alongside this presentation on your site that we're sure to cover okay all right just double check one more time on questions looks like we're good I want to thank Julie Eisenhower and Peter Henley and and Clark nuber for providing us this information it's a I think very useful for the operators out there we deal with the hotel owners but many of them are operators they all have management companies that or management companies that use is third party or have their own that need to be aware of this so it's good exposure good information for them to be on top of so thank you very much for joining us today thank you you're welcome this will be downloaded in a PDF are you you can download a PDF of the list of today's featured hotel listings plus a selection of additional hotel investment assets listed by HBI brokers under the attachments button on the top of the web cast player don't forget to rate the presentation today please go up in on the buttons ratings give us your feedback I want to remind everybody that this you know will be on the hpi website so it can be accessed and reviewed or you can share with some of your partners and associates to become familiar with it I don't think it's our intent to make you experts but at least to open up your eyes to certain areas of concern and as Peter said take it to your IT person and and review it with them so please do that it will be up on the website within 24 hours also one remind everybody that this in previous web web casts are available on demand at HP I hotels com and you can go on there as well to pre-register and join us for the December 16th webinar which will be with Geoff Keighley the vice president of digital media and editorial director for str and str global and hotel news now and he will be sharing a hotel performance data trends as they're tracked by smith travel research and discussed the hospitality industry outlook for the coming year of 2016 so please mark that on your calendar again at two o'clock on December 16 we'd also like to remind you of a few events on the fall calendar that HB I will be supporting we will be at the hotel investors conference in Europe being held in London early next week to 28 and 29 HB I will be exhibiting at the Intercontinental Hotel Group tradeshow being held in San Francisco September 30th through October second and we will also be exhibiting at the vantage international conference held in Las Vegas december nine through 10th so if you're at any one of those events please come by and say hello to us we're glad to talk with you we again thank Clark nuber and Julie and Peter for joining us today everyone have a great day thank you you you
