In the travel industry, everything is connected – APIs, GDS, portals, payment gateways, booking engines, mobile apps, even WhatsApp. That is what makes us fast, responsive, and scalable.
It is also what makes us vulnerable.
At CIT, we are building more than a travel ecosystem. We are building a trusted environment for our clients, our partners, and our team. That is why cybersecurity is not “just IT’s job” anymore, it is baked into every interaction and system we touch.
If you are a supplier, partner, or internal stakeholder connected to any part of our infrastructure, these are the cybersecurity practices we need to align on together.
🔐 1. Passwords: Still Your First (and Weakest) Line of Defence
In the travel tech industry, passwords are the first line of defence against cyber threats. They protect sensitive customer data, booking systems, and internal communications from falling into the wrong hands. A well-chosen password acts like a secure lock on a vault, ensuring that only authorised users can access valuable information.
Cybercriminals often use brute force attacks, phishing schemes, or leaked password databases to gain access to accounts. In the travel sector, this could mean stolen customer identities, unauthorised bookings, financial losses, or even a complete system breach. Once a password is compromised, the attacker can move laterally through connected systems, amplifying the damage.
Here are a few ways to keep your passwords well-protected:
- Use complex, unique passwords for every platform.
- Never reuse passwords especially not across booking, CRM, or payment systems.
- Consider using a password manager like 1Password, Bitwarden, or Dashlane.
- Avoid storing passwords in browser autofill or Excel files.
💡 Pro Tip: Use passphrases (e.g., “JumpCloudMoon93!”) and change them regularly.
📲 2. Multi-Factor Authentication (MFA) – Required, Not Optional
Multi-Factor Authentication (MFA) adds an extra checkpoint beyond your password, like showing both your passport and boarding pass before you can board. Even if someone cracks your password, they still cannot get in without the second verification step, such as a code sent to your phone or an authentication app.
In the travel tech space, where sensitive data flows daily, MFA drastically reduces the risk of unauthorised access. It is a low-cost, high-impact measure that blocks the majority of automated and phishing-based attacks, making it one of the most effective safeguards you can implement. If the system allows MFA, enable it. Always.
Here are some tips when using MFA:
- Prefer authenticator apps (like Google Authenticator or Authy) over SMS-based OTPs.
- Avoid receiving OTPs on shared mobile numbers.
- Use biometric security for vault access on phones or tablets.
MFA alone could stop over 90% of brute force login attempts.
🛑 3. Spotting Phishing & Spoofing (Still the #1 Attack Vector)
Phishing is one of the most common ways cybercriminals trick people into giving away passwords, financial details, or system access. Instead of breaking into systems through complex hacking, attackers simply trick people into handing over the keys to their data. They often impersonate trusted brands, colleagues, or customers, crafting messages that look authentic and create pressure to act quickly.
Watch out for urgent requests, unexpected attachments, or links that lead to unfamiliar websites. Be suspicious of messages with poor grammar, odd email addresses, or slightly misspelled company names. Always verify requests for sensitive information through a known, trusted channel before taking action.
Phishing today is not just about fake emails. It comes via:
- Fake WhatsApp messages pretending to be colleagues or suppliers
- SMS spoofing (where the sender’s name looks real)
- Links that mimic airline or CRM portals
🚨 Always verify the sender domain, and never download attachments unless you’re expecting them.
🌐 4. Public Wi-Fi? Always use a VPN
Public Wi-Fi can be a major security risk as they are often unsecured, making it easy for hackers to intercept data transmitted over them, including passwords, booking details, and payment information. Cybercriminals can also set up fake Wi-Fi hotspots that mimic legitimate networks, tricking users into connecting and handing over sensitive information. Even seemingly harmless activities, like checking emails, can expose critical data. Without proper precautions, such as using a VPN, public Wi-Fi can turn a simple online task into a serious security vulnerability.
A VPN is a secure digital tunnel that encrypts your internet connection and hides your real IP address, making your online activity harder to trace. Using a VPN offers several key advantages, especially in travel tech. It encrypts internet traffic, keeping sensitive customer and company data safe from hackers and eavesdroppers. By masking your IP address, it protects your location and identity, making online activity more private. VPNs also allow secure access to company systems from anywhere, which is essential for staff who travel or work remotely.
If you are at a hotel, cafe, or airport:
- Assume the network is being monitored.
- Use a VPN (paid and secure, avoid free ones) to tunnel your connection.
- Avoid accessing admin panels or payment systems without protection.
Travel tech often runs on APIs and sessions, once hijacked they don’t need your password.
🔒 5. Practice Least Privilege
The principle of least privilege means giving staff and partners only the access they need to perform their specific tasks – no more, no less. In travel tech, this limits the potential damage if an account is compromised, since hackers cannot easily move through systems or access sensitive data they should not have. It is a simple but highly effective way to reduce the risk of internal and external security breaches.
Implementing this practice involves regularly reviewing permissions, segmenting systems, and ensuring that elevated access is granted temporarily and revoked promptly when no longer needed. It also makes auditing and monitoring easier, as administrators can quickly see who has access to what. Overall, it strengthens security, supports compliance with regulations, and encourages accountability among staff and partners.
Only access what you need. Here are some ways you can practice least privilege:
- Do not share your login credentials (even with “trusted” coworkers).
- Request access through proper channels.
- Disable access when an employee leaves or a vendor ends a project.
This limits damage even if one account is compromised.
💻 6. Keep All Devices Updated
Regularly updating all devices is essential for effective cybersecurity in travel tech. Software updates and patches target known vulnerabilities that could be exploited by cybercriminals to access systems, steal customer data, or disrupt operations. Updates also enhance device performance, stability, and compatibility with security tools such as antivirus programs and firewalls.
In environments where staff use multiple devices including desktops, laptops, tablets, and smartphones maintaining up-to-date software ensures that both company systems and sensitive customer information are adequately protected. Failure to apply updates can leave networks exposed, increasing the risk of security breaches.
That includes:
- Laptops (OS, browsers, endpoint protection)
- Phones (especially those used for MFA)
- Chrome extensions, Outlook plugins, etc.
Outdated devices are entry points. Do not delay updates.
🔎 7. Endpoint Security and Mobile Device Management (MDM)
Endpoint Security and Mobile Device Management (MDM) are critical tools for protecting devices and data in the travel tech industry. Endpoint Security ensures that all devices including desktops, laptops, and mobile devices are monitored and protected against malware, ransomware, and unauthorized access. It provides centralized control to detect threats, enforce security policies, and respond to incidents quickly.
MDM focuses specifically on mobile devices, allowing administrators to manage, secure, and monitor smartphones and tablets used by staff. This includes enforcing password policies, remotely wiping lost or stolen devices, and controlling access to corporate applications. Together, these solutions reduce the risk of breaches, ensure regulatory compliance, and maintain secure access to sensitive customer and company information.
For high-risk accounts or access:
- Use antivirus and antimalware tools
- Install Mobile Device Management (MDM) if you handle sensitive booking or customer data
At CIT, we enforce this for our leadership and key operations teams.
📥 8. Use Official Booking Channels Only
Booking through official channels is a crucial practice in travel tech to protect both staff and customers. Official platforms are monitored, regulated, and secured, reducing the risk of fraud, data theft, or errors in reservations. Third-party or unofficial sites may lack proper security measures, exposing sensitive customer information, payment details, and booking records to cybercriminals.
Using only authorised channels ensures that all transactions are legitimate, verifiable, and supported by the company, helping maintain trust, prevent financial loss, and safeguard customer data throughout the travel process.
Avoid third-party extensions or plugins that alter booking flows. They may:
- Log credentials
- Interfere with GDS output
- Leak sensitive fare data
Always confirm the source of tools before installing them into your workflow.
🚨 9. Know What to Do If Something Goes Wrong
Noticing when something feels “off” can be a critical first line of defence against cyber threats. Unusual emails, unexpected system behaviour, or requests that seem suspicious often signal phishing attempts, fraud, or system errors. Encouraging staff and partners to trust their instincts helps catch potential issues before they escalate.
Equally important is knowing the correct steps to take when something goes wrong, such as reporting the incident to IT, verifying requests through official channels, or isolating affected devices. Prompt action can prevent data breaches, financial losses, and operational disruptions, reinforcing a culture of vigilance and proactive security awareness across the organization.
Here are the steps you must take if anything were to happen: · Report immediately to: webmaster@cit.travel
- Take a screenshot of the suspicious message
- Disconnect from Wi-Fi (if you suspect a breach)
- Do not delete evidence unless instructed
Speed matters. Early intervention can stop a full-blown attack.
🧭 10. Stay Proactive, Not Reactive
In travel tech, staying proactive rather than reactive is essential for effective cybersecurity. This approach means anticipating potential threats and implementing protective measures before issues arise, rather than waiting to respond after a breach occurs. Staff and partners should regularly update software, use strong passwords, enable multi-factor authentication, and follow secure booking practices to reduce vulnerabilities.
Proactive monitoring, training, and risk assessment help identify weaknesses early, preventing attacks, data loss, and operational disruptions. By focusing on prevention, we are able to safeguard sensitive customer information, maintain trust, and ensure smooth, uninterrupted operations.
We are ISO 27001-certified which is more than a badge. It means:
- We audit systems regularly
- We track incidents
- We train our staff
- We expect the same mindset from our partners
Security is a shared responsibility, and we appreciate every partner and team member who takes it seriously.
At CIT, we do not wait for problems. We build processes, raise standards, and partner with like-minded organizations who understand that trust is built through vigilance.
If you are integrated into our ecosystem through GDS, APIs, payment systems, or co-managed platforms – let us stay sharp together.
📩 Need a security checklist for your own team? Reach out.
🔐 Want to validate access levels or rotate credentials? We’re happy to assist.
🤝 Let’s make secure travel tech the default, not the exception.
—
Author: Cybersecurity & IT Governance Team at Corporate Information Travel Sdn Bhd 🌐 www.cit.travel
References:
- https://certiprof.com/blogs/news/cybersecurity-protect-your-data-systems?srsltid=AfmBOorWp8ypVf3riaiKuDPVnPajNffBwaos4utMSsC9-p7ul_z5pzBN
- https://9to5mac.com/2013/10/10/how-to-use-a-password-manager-to-have-strong-unique-passwords-for-each-website/
- https://www.globalsign.com/en/blog/what-is-multi-factor-authentication
- https://www.freepik.com/free-photos-vectors/phishing-prevention
- https://www.kaspersky.com/resource-center/definitions/what-is-a-vpn
- https://www.secureitworld.com/blog/how-the-principle-of-least-privilege-benefits-your-data-protection/
- https://www.n-able.com/blog/secure-firmware-updates-protect-and-optimize-your-devices
- https://www.xcitium.com/knowledge-base/endpoint-security/
- https://pg-p.ctme.caltech.edu/blog/cybersecurity/endpoint-security-and-protections
- https://stfalcon.com/en/blog/post/online-booking-system
- https://www.n-able.com/blog/cybersecurity-is-not-a-reactive-service-delivery-model-why-msps-must-embrace-proactive-strategies
