What Restaurants Need to Know About Cybersecurity

March 8, 2021

Barbara Castiglia Podcast

Beverage

customer data

cybersecurity

+more

Barbara Castiglia

Food is serious business. Now, on The Main Course, host Barbara Castiglia will invite insiders on the front lines of food to share their expertise, strategies, and forecasts for navigating the ever-changing restaurant industry.

Providing angles on all types of topics for restaurants is the goal of The Main Course. Host Barbara Castiglia spoke with litigator and cybersecurity expert Jacey Kaps about what restaurants need to know about data security. Kaps is a partner with Rumberger Kirk and has been practicing law for 25 years. He became intrigued by the world of cybersecurity and now focuses on providing legal guidance around it.

They first discussed the landscape for restaurants. “There has been an uptick in cyber-attacks during the pandemic. Even with ongoing efforts to attack it, bad actors can still avoid the systems put in place. There are so many ways, in spite of the counter efforts, for cyber-attacks to occur,” Kaps said.

Overall, Kaps said restaurants are still a smaller piece of the pie in terms of most threats. However, with more remote work and various digital channels, there are no more access points for a hacker to penetrate. “There’s more risk in the process now, and the challenges are manifold in how to prevent it,” he added.

One area where restaurants are at a disadvantage is the investment aspect of fighting cybersecurity. Most in the industry are financially strapped and focusing on cutting costs. Kaps noted that restaurants can still follow best practices and be proactive.

His best advice is for restaurants to have a written data security plan and take “reasonable measures to protect data.” He also spoke about a checklist of cybersecurity must-haves for the formal plan. Some essential items include defining how they collect and store data, how often updates are run on software and firewalls, ensuring vendors are also using best practices, and training employees on data security protocols.