Data Protection and Cyber Security Considerations in the Hotel Industry

Episode Transcript

Todd Johnstone: It’s critical to have experts and know who those experts are. To your point, it’s not me. It’s not necessarily the CIO. We want to be working with the CIO on the technology and the infrastructure design, right? But knowing who those experts are, because as we know, the laws and the requirements change frequently, and location is dependent in many cases. And more importantly, the hackers and the attacks become more and more sophisticated and frequent. So I think that’s the most important point.

Robin Trimingham: Welcome to The Innovative Hotelier podcast by HOTELS magazine, with weekly, thought-provoking discussions with the world’s leading hotel and hospitality innovators.

Robin Trimingham: Welcome to The Innovative Hotelier, brought to you by HOTELS magazine. I’m your host, Robin Trimingham. Data protection and cybersecurity are critical concerns in the hotel industry, as hotels handle sensitive guest information and rely on various digital systems for their operations. And yet, these are also often the least discussed security issues because no one wants their hotel to be associated with any sort of a problem. If you’re an international brand, you most likely have an entire team working around the clock to keep on top of potential threats and monitor who has access to what data. But, if you’re an independent hotelier, what do you do? My guest today, Todd Johnstone, is CEO of Allbridge, a leading technology solution provider for the hospitality industry. And he’s here today to offer ideas and advice for data protection and cybersecurity in the hotel industry. Join me now for my conversation with Todd.

Robin Trimingham: FOH is a global food service and hospitality company that manufactures smart, commercial-grade solutions. Headquartered in Miami, the company designs and manufactures all their restaurant and hotel products. They have showrooms and distribution centers located throughout the globe, and their products are always in stock and ready to ship from any of their distribution centers worldwide.

Robin Trimingham: Welcome, Todd. It’s great to get a chance to chat with you today.

Todd Johnstone: Hi Robin, it’s great to be here. Thanks a lot for the opportunity.

Robin Trimingham: I really appreciate you finding time in your busy schedule to chat with me about what I think is actually a critically important topic for the entire hotel and hospitality industry that isn’t being addressed nearly enough. And of course, that’s cybersecurity. Let’s give everybody a little bit of context here. Cybersecurity for hotel and hospitality industry, that’s a pretty specific thing. What got you interested in all of this?

Todd Johnstone: Yeah, I think it started really with an interest in technology. Robin, early in my career at GE. On how I learned I didn’t grow up as a technologist or an engineer, but learned how it could drive things like improved monitoring, safety, efficiency, performance and equipment, the services we sold and for our customers and our teams. But over time, I think we’ve seen —definitely I’ve seen — technology could be used for nefarious purposes, negatively impacting people and businesses. We’ve seen a dramatic increase in cyber-attacks each year, and we frequently see high-profile breaches in the media. So coming into this industry three years ago and realizing from both the standpoint of being a guest, but also now a supplier of critical services and solutions to our customers and the hospitality industry, we see this as extremely critical and serious. It’s great to be discussing this topic today, as when we speak and listen to the CIOs and the operators at these properties and the leaders of the company. Security is by far the top of their priority list.

Robin Trimingham: Well, we certainly hope it is. I think one of the problems here, if you’re not a global brand where you have an entire team, an entire department who monitors these things all the time, I think there’s a lot of misunderstanding about what is cybersecurity, what is a data breach? What’s the difference? What do you think is the most misunderstood aspect of managing guest data?

Todd Johnstone: This will be a recurring theme throughout this discussion and why it’s so important and timely from a foundational standpoint. Because guests own their data, we as partners with our customers and the hotel owners and operators, must be stewards handling their information appropriately. To maintain trust, we need to build solutions and services that safeguard the technology infrastructure and maintain data integrity across the property for our customers, and enable them to be better prepared with tools and processes if required. And this is a level of trust that the residents and guests give to our hospitality customers and, in turn, that our customers require of us. And, what I would say, if you’re not a large brand, don’t have large teams supporting this, there are technology partners out there that help you, can help you design your technology infrastructure, and help you build a multiyear plan that supports the processes and practices that you need to have in place. It helps you prepare for audits and things like that. I think that’s important. But I do want to emphasize that as a company that designs, engineers and supports the networks and all the devices and software and a property that utilize that network. Security and trust is everything. And this is foundational to ensuring that our customers can maintain safe and effective data security practices for their customers and residents and guests.

Robin Trimingham: Now, before we started today, you and I were chatting and you made an excellent point. You were talking about just the number of places and ways that there could possibly be some sort of a data breach. To my mind, there’s differences between data you collect, data you store and data you have to protect. And I’m probably oversimplifying as far, as you’re concerned. Talk to us about this and maybe give us an example of what the different kinds of data actually are that we have to consider in a plan.

Todd Johnstone: Yeah, it’s a great question. And I’m a big believer that if you can’t simplify it, you can’t really understand it. So I don’t think it’s an oversimplification at all. I think I’ll break it down when we talk about us as Allbridge or our technology partner to our hoteliers or hospitality customers, we as Allbridge, we actually store very little data, and we take great care in ensuring we store the minimum required that we’re compliant with all the credit card processes, the DSS, the PCI, GPDR. But then we help our clients understand what’s relevant to them and they store a lot more data. So, by design, we store very little data, might be a guest last name. And our customers, as I said, store a lot more. But working with them to be clear on what data is actually mission-critical and limiting the amount of data that you collect and process, right? Do you really need to store credit cards? Of course, as loyalty members, you need to have. I would appreciate you having my name first name, last, maybe some information from my last day, my phone number. I allow you to have, that as well as my loyalty number. That’s appropriate, right? But it’s up to each property to one decide. Because what we have found is there is an over storage of data. And that’s not only true of this industry, but then ensuring your compliance.

Todd Johnstone: And we can talk about that later with local processes. And some of these are regional and even state-based local practices and laws and requirements. But ensuring you’re consistent with that. But I think one thing connecting these two questions as well, Robin, is misunderstood in this, as well is how critical I think a lot gets focused as it should on processes, practices, laws and requirements and outcomes, right? To your point, we got a breach or we haven’t had a breach. But I think what’s misunderstood is how much work and again, planning needs to go into much earlier and foundational level technology, right? How critical the underlying technology infrastructure is from the robustness of the network to the effective connection and interoperability with all the devices on a property and having appropriate connected technology is not only the backbone for the resident and guest experience, but also for the security, because one of the major issues is where access points or hackers can breach into and minimizing the points of penetration that they can access into. And we’ll talk later about where we see breaches occur. It’s not typically where you would expect, it’s where access points from apps or things that sit on the network are allowed to an opportunity to tap into the network and the data.

Robin Trimingham: Yeah, it’s very interesting subject because there’s a lot of misunderstanding, simply even around what needs to be stored in the first place. And you’re making me think of a question that I would love to ask, because the old SalesForce approach, and I’m meaning just the process as opposed to anybody’s brand, was that you want to know absolutely everything about your customer, and you’re going to glean every single last piece of information you can, and you’re going to store it in a computer so that anybody can access it. Do you begin to rethink what you really need to do, if that’s your mindset coming into this discussion?

Todd Johnstone: Right. What I would say is, first of all, there’s a lot of material out there on things like PCI, DSS, compliance, GDPR requirements, those that have access to a legal resource, appropriate legal resource, who understands data privacy laws, and they change frequently. So that’s important. Technology partners like us can help you with those requirements. But as we discussed a minute ago, what’s important is not less is more but appropriate is more, right? And really ask what data your story and for what purposes. And we really try to take a minimalist approach and where we do store data. It has to be acknowledged and accepted and allowed by our customers. And again, we know our customers need to have access to more data. They are interacting directly with their guests and their consumers. But I think one understanding the laws and practices, whatever you can discern online, if you have access to legal resources or a technology partner can really help you do that. But like a lot of data, and I think just to your point, taking a step back from a Salesforce approach, there is way too much data that gets stored and not used. So I think just having a vitality process for your data and a churn and a cleansing to ensure that you’re keeping only what’s critical is important.

Robin Trimingham: That makes sense. Let’s dive a little deeper into this. Can you give us a sense of how common hospitality data breaches actually are, and is there a most common type of data breach?

Todd Johnstone: Well, specifically, I can’t or won’t, and I’m not aware of every or even significant breaches that happened, but I can speak specifically about individual brand or property breaches. But we’ve all seen the well documented public breaches in our industry and many other industries over the years as well. And, as mentioned, attacks and breaches are only increasing and we know they erode the trust, they damage the reputation, the brand and have a significant financial impact. And we know that data collectors and processors take this very seriously. I think dialogues like this and larger forums just need to be more out in the open to share best practices. That’s one thing we find that helps, and they’re always looking for ways to limit their exposures. And we work with a lot of customers on this. I think one thing I would say, before answering the specific question, and I’m almost touching wood as I say this, is the magnitude impact of the individual breaches we see seems to be declining because I think of some of the processes and procedures and checks that that companies are putting in place because the type of data — your exact question a minute ago — that is being stored is more limited. For example, ten years ago or less, we’d hear about a breach where hackers might have taken an entire database of credit card numbers, right? Again, I’m touching grass as I say this, but this hasn’t seemed to be happening as much recently as the industry has evolved, is much more aware, and customers and companies are more discerning about the data they store.

Todd Johnstone: But what we do know around where we’re seeing the breach most often is that a lot of industries, including hospitality, have technology systems that have been built up in a fragmented, if you will, bifurcated, disconnected way, versus a single robust end-to-end solution, right? So, they may have had 2 or 3 different network types installed or upgrades done in different stages by different providers. The voice system is disconnected from the HVAC and some of the door lock systems and other parts, and this just increases the points of risk and vulnerability as I mentioned earlier. The common denominator most of these breaches that we see is multiple points of vulnerabilities from various edge devices and apps in a fragmented technology design, and coming from places where some vendor is doing something over here and they breach. That’s been the entry point for the hacker to get into the core network, right? So having an appropriate current end-to-end technology solution that connects and ensures all devices are interoperable in a single security system, and then separating the networks. And we can talk about that later. Where the guest network is, is separate from the hotel staff, if you will, and separate from access points or access to conference centers and things like that. But the common denominator we see, Robin, is just fragmented, historical, kind of patched-together technology that’s created multiple access points into the network.

Robin Trimingham: That completely makes sense, because in a legacy system, some stuff was going to have been deployed before really advanced security measures and firewalls were really the thing, if you will.

Todd Johnstone: That’s right. So, as there should be there’s a lot of focus on policies, procedures and my current? am I ready? and aware. But that’s typically a reactionary, right? The focus is on the breach then and the reactionary. But what we try to focus on with customers is why does that happen, right? The root cause. And it’s not just because the hacker came in every time here. It’s because there were multiple points and different stages and ages of technology, and not a coherent plan for it. To your point.

Robin Trimingham: Okay. So if somebody is listening to us and they’re taking us seriously, then they’re starting to wonder, well, where might I be vulnerable? So, if you’re a hotelier out there, how would you recommend that they begin to do a risk assessment to figure out how they might be vulnerable?

Todd Johnstone: First, I would say take stock and start your assessment. With just an internal audit of your systems, their age, the provider, who your partner and support is. And there’s no magic number here. It depends on the size of the property. But if you don’t have a single partner or two with a throat to choke, if you don’t have an updated instance of every critical technology software platform you have, I think your risk of breach is higher than someone who does. So it starts with just internal self-assessment, or working with a partner who understands the technology, or who has at least worked with you on one part of the installation to help you do that assessment. And we do that frequently with partners or customers who don’t, to your earlier point, have that large internal team to help them with that.

Robin Trimingham: Established in 2002, FOH is a woman-owned global food service and hospitality company that manufactures smart, savvy, commercial-grade products including plateware, drinkware, flatware, hotel amenities, and more. Driven by innovation, FOH is dedicated to delivering that wow experience that restaurants and hotels crave, all while maintaining a competitive price. All products are fully customizable, and many are also created using sustainable, eco-friendly materials such as straws and plates made from biodegradable paper and wood and PVA-free drinkware. FOH has two established brands: Front of the House, focused on tabletop and buffet solutions, and Room 360, which offers hotel products. Check out their collections today at fohworldwide.com.

Robin Trimingham: A little bit of a controversial question here. In this day and age, if you’re a boutique operator, would you be safer with an independent legacy system, essentially a standalone because you’re a boutique operator or some sort of a cloud-based cybersecurity solution? And why do you say what you say?

Todd Johnstone: Yeah. Initially, as cloud-based systems became more prevalent, some might say that a legacy on-prem system, and this I’ve heard this was one of the arguments that we want to keep this on-prem and keep the CapEx on us because we own it. It’s secure, not necessarily scalable. That was a while ago, right? And legacy on-prem system is being more secure than cloud-based systems. Our belief and my belief is that’s a false sense of security in most cases. And the questions are connected to the last question, right? I think cloud-based providers, especially those that that scale in a lot of the popular large names that participate in this space, they’re more active in patching flaws and use best practices with their upgrades and keeping their technology current. They have to, again, that’s core to their business. We talk about ourselves and our customer, what’s core and certainly for our customers, having on-prem systems to manage all their technology that their core is resident guest experience, driving room rate, you know, keeping occupancies up and continuing to evolve that guest experience, not managing a large on-prem database, right?

Todd Johnstone: So, I think that’s just natural for cloud providers, especially those that have scaled to do it. And we do find back to the previous question, that older on-prem systems many times are behind on their patching and maintenance, which can leave areas exposed to hackers as well. And connected to the prior question. If you have something on-prem, we, our technology partner, can work with you. Cataloging all your equipment regularly. Validating that the equipment is on proper firmware version. Working with you on a path on a migration to a cloud-based system if that’s where you want to go. But, again, this whole topic, new security flaws are discovered every day, every week, especially with advanced monitoring, right? So proper monitoring and mitigation of your network and your technologies, that’s vital. So that’s hard to do if you have something on-prem unless you can do it at scale. But, again, there’s a lot of customers have been very successful and safe with their on-prem systems. Well, we’ve just seen such an evolution of cloud-based systems. That would be our answer.

Robin Trimingham: Yeah, no, I think you’re making a valid point because, to oversimplify this, it is absolutely, completely possible to still have a rotary dial telephone in your home or your office and make phone calls. But why would you do that? There are cellular technology and smartphones and everything else that functions so much better, and you can do so much more with it.

Todd Johnstone: Yes.

Robin Trimingham: So, in your opinion then, is the most effective way to restrict or monitor access to data?

Todd Johnstone: We share a lot of best practices with our customers, including our own practices that we follow at Albridge. But this, in terms of restricting or managing access to the resident or guest data for our customers, doesn’t generally apply to Aldridge. Again, beyond sharing best practices and learning, as the application providers say, for the property management system, the PMS, the loyalty programs, the application providers set the security on the data access with our customers. Again, we talk to our customers about how they do this and making sure, again, it’s essential if they want our advice and best practices. Back to the earlier point. It’s mission-critical data they need making sure it’s compliant with PCI, DCS standards and certifications. But generally, we’re sharing best practices, Robin. We’re not setting that access or restricting it for them, but we’re happy to engage in the discussion with them.

Robin Trimingham: Yeah, I guess that makes a lot of sense, because particularly if we’re talking about smaller operators, different situations are going to be unique and need unique solutions or protocols. You alluded to something earlier, and I want to come back to it from every hotel on the planet has been rushing around installing Wi-Fi, upgrading Wi-Fi, installing guest room entertainment systems, particularly since the little thing we call the pandemic. Why is it so critical to ensure that entire Wi-Fi network is completely isolated from the rest of your hotel operating system?

Todd Johnstone: It’s a great question. Yeah, not only isolated, but well thought out, planned and current and appropriate for not only the performance you expect the experience but also for the security. Back to your point, right? The security protocols and the network providers we work with are going up and improving every year. So it may seem obvious, but probably not discussed or thought about enough. And Wi-Fi requires more scrutiny than the rest of the network because potential hackers can remain hidden or in a hotel, someone with malicious intent could come and sit in a lobby or in their car outside the building and attempt to seek access secure data without being noticed. And again, we always design our networks with separate access for guests, staff and other users. And again, that’s just to limit entry points into the mission-critical data and ensure the firewall and the access rules and the security or robust and just a basic requirement for anything that goes into the network. But the isolation and the separation of these networks, again, in a proper well-thought-out planning process, either at renovation or construction or over a multi-month or year plan to upgrade the Wi-Fi and the network in a building is key.

Robin Trimingham: I get the sense that, particularly if you’re a smaller operator, it’s the ‘what you don’t know’ that can actually hurt you. I can foresee somebody at a hotel somewhere saying, ‘okay, we’re going to get a cloud-based system’. Then we can set it and forget it, and we’ll be good to go. Amazon, S3 they’ll take care of everything. Why do you think of that point of view?

Todd Johnstone: I think it’s extremely risky and naive. I think there’s a lot of great technologists at the hospitality and the properties, but the one thing we learned in any industry is, again, what’s your core value proposition and competency? And are you partnering with the right people who live and breathe this every day, meaning network, performance, interoperable technology, data security, right? That we take it seriously as you do. I think that’s very important. And in terms of sitting and waiting, the audit process, which for cyber can and should happen annually on as a calendar event, shouldn’t just be a calendar event, right? It should be always and continual. The security auditing, as I said, should not just be on a calendar. New vulnerabilities are exposed every day. So just sitting and waiting is not a strategy. It’s literally minute-by-minute daily monitoring of the network, automated reporting on equipment with vulnerabilities. That’s a complement to regular quarterly internal audits, monthly internal audits and an annual audit. And being ready and proactive in ensuring you’re ready for that process. For example, Robin, we’ve got a software called Skyway, which does a dance monitoring on all devices we put into our properties, and that’s continually reporting every hour, every day on firmware vulnerabilities and allows the teams to quickly take proactive action right before a vulnerability actually becomes a threat or a breach. And that’s where having a partnership help. Or if you have a team that’s big enough. But this is a continual event, not just ‘trust that my cloud-based system will be secure and I can check, list and pass my audit each year’.

Robin Trimingham: I think that is very good advice for everybody. I think what I would add to all of this, if you serve meals, you wouldn’t operate a kitchen without somebody you called the chef. So if you are interacting with data and you have all these different operations and departments, why would you be operating all this complicated stuff without somebody who truly understood it and was qualified and able to monitor it for you and audit it for you and all that other stuff? I realized, from a revenue perspective, that’s a cost because we’re talking about salary and training and things like that. But I also think there’s an argument to be made that ultimately, in the long run, you’re going to save money because you have somebody who really knows what you need, what you don’t when you need it, and all that kind of stuff.

Todd Johnstone: Couldn’t agree more. It starts with customer experience and having an experience that is outstanding today but scalable for the future, right? We all know bandwidth requirements are going up. And to your point on costs, right? I won’t go on a tangent here. We all know that one outage, what it does financially and reputation-wise. Robin Trimingham: Oh it’s devastating

Todd Johnstone: That cost costs dwarfs versus any annual technology budget or investment that would get made. It just, it dwarfs it.

Robin Trimingham: You talked about needing to make sure that you’re compliant with the data and privacy regulations legislation in whatever jurisdiction you’re operating. That is not everybody’s cup of tea.

Todd Johnstone: No.

Robin Trimingham: And it’s also not always the IT gurus cup of tea either. If we’re being honest about this, somebody who speaks data does not always speak lawbooks and legislation. What are your suggestions for how to make sure that you are on top of everything you need to be on top of?

Todd Johnstone: Now it’s a yeah, um, not my cup of tea either. So that’s exactly the point, right? on staff here, we have a legal counsel who is much more adept and up-to-date and current on data privacy laws and practices. She works closely with our CIO, who we work on our audit practices, and we have a managed service practice with experts who work with our customers to help get them ready. But I’m not the expert, but we make sure we have the foundation and we have the experts on the team, and there’s a lot of material and content on things like PCI, DSS, compliance. As I said, GDPR, just making sure that you’re aware of it, you’re learning from it. It’s out there making sure that’s in place. We can help with that. Other technology partners, consulting your legal counsel if you have one. But it’s critical to have experts and know who those experts are. To your point, it’s not me. It’s not necessarily the CIO. We want to be working with the CIO on the technology and the infrastructure design, right? But, knowing who those experts are, because as we know, the laws and the requirements change frequently and location is dependent in many cases. And more importantly, the hackers and the attacks become more and more sophisticated and frequent. So I think that’s the most important point. But we also know it’s incumbent on our customers to ensure the data privacy and security for all guests. So, knowing who that person is internally or people are knowing there’s a lot of material out there to learn from. And again, we’ve got a team here at Allbridge who works internally and with our customers to share those best practices, but it’s important.

Robin Trimingham: Yeah, it is. All of this is making me think of a question I would love to ask. And I’m going to try and say this as clearly as I’m able to not being the IT person in the room. I get to talk to a lot of people who are involved in the development of AI and the apps and the ‘what’s next’. As the apps get smarter and they learn to talk to each other and interact with each other behind the scenes in a way that humans don’t generally really understand. So one of the most fascinating people I talked to recently was talking about a world in which your platform will be very fluid, and you’ll be able to just plug in new apps any time something good comes along that you want to integrate or take advantage of, and how wonderful it will be, because you’ll have some kind of chatbot that will be able to talk to a completely different system, and it will be ordering food for you and goodness knows what else. That sounds like a completely different game when it comes to cyber security. Tell me where you think all of this is heading in words that are more accurate than what I just said?

Todd Johnstone: Yeah, no. Again, your words are accurate and scary at the same time, and it’s something we think about a lot. And frankly, if I had a perfect answer today, it wouldn’t be a truthful one. It’s something we talk very closely with our networking and our cybersecurity partners that we use to do our installations and put our technology in place. I think the key is the robustness and the ‘can the networks and the security stay ahead of that level of sophistication and knowing what is an attack versus a helpful or useful or an AI interaction that’s required?’ So, penetration testing, assess risk assessments, points of entry into the network and into the data. And putting an app in a ubiquitous way on top of a network has to be separated from access to that hopefully limited mission critical data you have. And I’m sure experts in technology far better at it than I am, would talk about an evolution over the last ten, 20 years of how security has evolved. And I think we’re just, to your point, we’re on an accelerating path now with AI, and it confronts us with a whole host of, I think, mostly opportunities, but some challenges too that we need to stay ahead of. Yeah.

Robin Trimingham: No, I absolutely agree with you. Uh, I find AI a fascinating field. I am in no regard an expert on any of this stuff, but you would think it’s going to have to come to a place where if all the apps are like cars parked in a garage, then the app can’t come out of the garage without the entire system knowing that it has and where it’s going to, or something like that.

Todd Johnstone: Great analogy. Yeah, I’m thinking of the app floating over the net where it can’t go to the garage, and there’s an indicator that it’s ‘okay’.

Robin Trimingham: Yeah, your spaceship is better than my car. Yeah, I completely agree with you. Okay, so we got a couple of minutes left here. I’m going to ask you my favorite question. I ask most my guests this question. What’s your key message for everyone who comes across this broadcast?

Todd Johnstone: I would say, please don’t just think about the outcomes or obvious end state or breach or no breach if it will. The outcomes are important, but it’s the lead in the structure, the process to get there. And it’s not just, as I said, doing a once-a-year audit. I think what’s key is evaluate your cybersecurity readiness and protection with the lens of your underlying network. Is it appropriate? Is it current? Does it connect in a compatible way to all the hardware and software that needs and uses technology that accesses data, and that’s the foundation and ensuring it’s robust current and limits vulnerability points. This is, to your point, limiting those vulnerability points, understanding where they are and knowing when something comes in. And that’s what’s designed in. Do an assessment. Do you have fragmented, multi-age, multifaceted technology that maybe doesn’t connect well? and multiple partners who you can’t work with and point to say, ‘Help me with this entire solution’. And that could be for one property, or that could be for a brand who manages thousands of properties.

Todd Johnstone: I think that becomes even more important. We I’ve talked a lot about an individual property here, but there’s data that gets stored and saved at a property level. There’s data that gets stored and saved at a corporate level. And why shouldn’t the technology be connected and able to ensure that’s as safe as possible? But we bifurcated the technology. So having that foundation is critical, I think the other thing, just whether you have the internal staff or have a partner who is a trusted expert in designing, implementing, supporting and owning that end-to-end technology in your properties and hopefully for the entire property estate if you will. So the message would be this is critical to protecting our customers, the hospitality companies and their residents and guests while ensuring a seamless, world-class experience with everything that technology enables. I see this as a necessary evil, if you will, as a part of just a great technology experience, and what our customers have done for their residents and guests is amazing and we just have to continue to keep them safe.

Robin Trimingham: I agree, taking care of guests. That’s the name of the game. Todd, I want to thank you so much for your time today. It’s been a pleasure to meet you. You’ve been watching The Innovative Hotelier join us again soon for more up-to-the-minute insights and information specifically for the hotel and hospitality industry.

Robin Trimingham: You’ve been listening to The Innovative Hotelier podcast by HOTELS magazine. Join us again soon for more conversations with hospitality industry thought leaders.