Yesterday I read two interesting articles regarding the latest announcement from Twitter who have announced that

You may read this announcement with excitement, antipathy or perhaps confusion. For myself, it prompted me to write this latest blog article. Why? Well, if you are in the travel business as a travel provider, intermediary, or travel technology company, you can’t afford to ignore what is going on in the world of social media, and in particular in the way in which technology is enabling strong connections between social media and e-commerce.

Are there really companies ignoring what is happening, you may be asking? Well, yes there are plenty – no names! And there are also plenty who are failing to keep abreast of the fast space of developments. So let me pose this first question [I’ll come back to the Twitter announcement later.]

We have recently added the following customer requested enhancements into our system:

• Additional support for managing specific restrictions on special/tactical offers e.g. first two adults get a free night, but third adult and children don’t.
  
• The display of specific special/tactical offer validity details on web sites e.g. “book by 31st March to qualify for this discount” 
• An option to control whether special/tactical discount combinations are each applied to the original price or to the reducing amount.
• The capability to manage pools of allocation across contracts and markets.
  
• Support for cancellation and amendment policies at the room type level.
• Added further customer specific MIS reports
• Enhancements to customer documents e.g. booking confirmations.
  
• The ability to specify a specific booking class to be used for obtaining transport taxes from the GDS.
• Adding the sales consultant’s name into the booked PNR in the GDS.
  
• Support for adding passenger pricing notes to a booking.
• A scratchpad and calculator function for ad-hoc operations

Our latest case studies on AA Getaways and Holiday Tours are now available to view on our case studies page.

View case studies

I have been prompted to write this blog item after reading an article on Travelmole about “Dozens of travel firms on the brink of collapse”. The article paints a stark contrast between travel firms who are seeing sales dramatically decline and those who are seeing significant sales increases. The proposition is that the former have “outdated business models” and have failed to adapt to “the way we use technology, delivery methods and trading hours”, whilst the latter are adapting and show “increased profitability and sales”.

The UK trade is reporting a strong start to 2013, so how can tour operators (the market we provide our technology to) ensure they are in good, not bad shape? During a conversation at the Travel Technology Show yesterday, I was reminded of a message I have been giving regularly for many years. All that appears to have changed more recently is the impact and swiftness with which getting this wrong take effect!

So, here are my three key points for your consideration:

1. It’s about your value add, not the technology

You might be surprised that the CEO of a travel technology company is saying this but it is a fact. There is a saying about putting lipstick on a pig and I would suggest that acquiring the best technology money can buy will not help you if the fundamentals of your business are wrong.

What is your differentiated “value add”? This can take many forms. It may be the products you sell (which cannot easily be sourced), the expertise you have in the destinations or product types (that can’t be easily replicated), a highly respected brand developed over many years, or indeed the ability to sell to a membership group that others cannot easily reach.You need to be clear on what differentiates you and where you add value and then that needs to be clearly communicated to your customers.
 

 2. It’s about having the right business processes tailored to your specific business needs

If your business is selling lots of lower margin holidays, then you need to ensure that your costs for selling each one are as low as you can get them. You cannot afford to have expensive human beings having to ‘touch’ each booking in order to take it, manage it and fulfill it. You need to be able to take bookings online and confirm these with NO human intervention and to automate as much of your supplier reporting and customer fulfillment as possible.

However, if you are offering higher value (and margin) products where part of your value add is your product expertise and client advice, then you will want to have businesss processes that maximise your staff’s ability to deliver these (at the appropriate point in the sales cycle) to your potential customer. Full end to end automation is not only less critical but also possibly detrimental.

Don’t fall into the trap of simply continuing to do things the way you have always done them though! As the article says, you need to be ready to adapt as the world around us (consumer habits, technology etc.) rapidly changes.

One of the ‘wins’ in replacing a legacy system with a new system such as ours comes from the opportunity that the project provides to examine existing business processes and look how they need to be performed in the future. The worst thing you can do is simply look to model your existing business in a new system! We always enjoy sitting with our customers during both the sales and the implementation phase and helping work with them on how they can do things better going forwards using our system.
 

 3. Now choose the right technology

Ok, here’s the technology point. Once you are clear on your value add and differentiation and have an understanding of how you need to work operationally, you then need to find the right technology to SUPPORT this. Technology is rarely the driver here – unless you are a major OTA! It is an enabler. Get it wrong and it will hinder or worse. Get it right and it will support your business model, help you to leverage your ‘value adds’ and help provide a vehicle for sustained business growth.

Having a clear understanding of your real requirements will significantly help you in the tricky process of selecting the right technology and technology partner. If you have a clear focus on WHAT you need and WHY you need it that helps you make trade-offs about things that are necessary verses nice to have.

And, speaking as a technology supplier, discussions with travel companies that know what they want and why and have clarity on this are much better than discussions over vague system requirements! We have many, many years of experience working with tour operators and travel wholesalers around the world but our job isn’t to tell you how to run your business – it is to enable you to do it by providing a flexible, scalable, reliable, proven system that can be configured to meet you current and future business needs. Oh, and to continue to support you on a daily basis as you use our system to run your business.

So, there you have it – simples (as a furry animal would say). But as the evidence goes from the large number of companies who are struggling, it is easier to say than to do – or perhaps it is that inherent human instinct to always keep on doing what we have always done in the hope that things will get better!
 

In closing I am reminded of the saying:

THERE ARE FOUR KINDS OF PEOPLE:

• THOSE WHO MAKE THINGS HAPPEN
• THOSE WHO WATCH THINGS HAPPEN
• THOSE TO WHOM THINGS HAPPEN
• THOSE WHO DON’T EVEN KNOW THINGS ARE HAPPENING

Which kind are you?

For further information on how RWA and our Sell-It Suite family is helping travel companies around the world please visit www.rwa-net.co.uk

Mark Bradbury

February 2013

RWA is a member of the Travel Technology Initiative (TTI). TTI has a mission to help develop open standards for the exchange of electronic data between tour operators, airlines, ferries, hotels and rail operators. The TTI has formed a number of XML Project Teams which are developing open standards for Package Holiday Bookings, Availability and Content. It is represented on the Board and Interoperability Committees of the Open Travel Alliance (OTA).

RWA continue to work with  TTI on a number of topics including TTIcodes, OpenTravel, Spring conference 2013, Summer Forum and the Travel Technology Show. Rob Wortham (Joint CEO & Chief Information Officer) at RWA recently helped write up the latest project committee discussions – see http://www.tti.org/newsletters.html and click here to read the latest TTI newsletter.

Consultants and Other Industry Independents

RWA are happy to work with Independent Consultancies or others engaged in systems selection on behalf of their clients. Examples of such organisations are:-

Travel Technology Connections: http://www.traveltechnologyconnections.com

Equinus: http://www.equinus.com

Genesys – The Travel Technology Consultancy: http://www.genesys.net

Travology: http://www.travology.ltd.uk

I was interested to read this week that Amadeus are blogging about their increasing use of ‘open systems’ technology; specifically a switch to Linux as their operating system of choice. Good to see that a GDS is finally moving into the 21^st  Century and updating their core systems from ancient proprietary TP (transaction processing) platforms.

For years all the GDS’s have been ‘wrapping’ their old systems with newer technologies to provide XML and Web Services interfaces. However, as anyone who has tried to actually use these systems will testify, these XML interfaces are often a very thin layer of structure over an underlying unstructured host terminal session i.e. screen scraping. Horrible. As soon as you get into details, like ticketing, you find the recommended solution is to send host commands directly to the terminal as a single string element in a generic ‘host command’ XML element. All the GDS’s have some variety of this approach, and whilst technically they can then claim they have a modern XML interface, its really not the case.

Conversely, many smaller travel technology companies have been employing modern open systems technologies to build solutions for years.  The advantages are obvious; no licence fees, systems that are easily maintainable and a huge user community to draw ideas, fixes and best practice from.

One other advantage of open systems technology is that there is no-one to keep changing things for the sake of it (i.e. unless they are broken). Systems are therefore much more stable across versions, avoiding re-engineering of applications just for the latest platforms. Proprietary vendors seem to feel the need to constantly rip up and change things for no good technical reason. I guess they need to keep changing stuff to sell new licences. I’m sure everyone has had this experience as an end user of  XP, Vista and then Windows 7, and also the various incarnations of MS-Office. How often will we all have to re-learn how to use Microsoft’s word processor?

Amadeus have produced a handy little set of slides about the benefits open systems, and I have included it here

RWA use a predominantly open systems approach; Centos and RedHat Linux operating systems, the PostgreSQL database, Apache and Java for web sites and middle tier technologies. However, we do also have some Microsoft based client technologies for our call centre environment (Visual Basic .NET),  with thin client deployment using Microsoft terminal services. We went down the Microsoft route because it provides the most rich, interactive, productive and trouble free way to build complex, interactive, multi-modal applications. We also use VMWare for virtualisation (the basis for our ‘private cloud’ hosting platform), because it seemed to be the most widely used platform and we had first hand experience of its absolute stability and ease of use as a hypervisor system.

I welcome any move towards the deployment of opens systems technologies, lets hope all GDS providers follow their lead.

Rob Wortham

October 2012

Want to keep updated with the latest news and information in travel technology? Then why not subscribe and follow our latest travel technology blog. Up to date information on online security issues, Mobile strategies for travel companies etc.

 Visit our blog

I read a very sensible article by Oliver Burkeman in the Guardian today – Online passwords: Keep it complicated. Oliver voices some important issues about the passwords that we all have to set up, try and remember, and use every to secure our online activities. I won’t re-iterate all the good points he makes, other than to say that I agree that stupid rules about password formation, coupled with an inability to use long passwords, certainly makes them more crackable. Everyone would do well to review their passwords and at least make them longer.

My purpose for writing this to relate the general concerns over online security specifically to travel systems. If you hack a private consumer’s login details, then maybe you get all their personal info and credit card details – bad enough. If you hack a login into a travel system, then maybe you get access to hundreds of peoples names, addresses, credit card details and travel itineraries. The stakes are clearly much higher, and as a result the security that is in place had better be up to the job.

There is also a historical problem within the travel industry that logins, and therefore passwords, were often shared at an agency rather than individual user level, and the most obvious passwords you could possibly imagine were used. Historically, access to travel systems was in effect “locked down” by the necessity of connection to the private X.25 network infrastructure for Viewdata and GDS access, and so insecure passwords were really not a big deal. The X.25 network was also connection oriented, so a ‘call log’ was also inherently available at the network level. 

Despite the move to Internet based services, I’m confident that this lax approach to security persists in travel. Users are still sharing logins, and using easy-to-guess and trivial-to-hack passwords.  The problem is, they are now using web sites which can be accessed from Eastern Europe, China and who knows where.

The risk is reduced by at least having 2 security tokens, by which I mean a username that is not your email address, and a separate password. Companies like American Express mandate this as a minimum for all systems access. Its also important to force individual, as opposed to agency wide, logins and passwords should certainly be of some sensible minimum length and contain some non alpha characters. This at least stops “Wendy Smith” logging in as wsmith/wendy.

Passwords should never be stored in plain text (or in fact at all) by the web sites or systems you use. Passwords are ‘hashed’ (an algorithm that creates a new string of characters from the password), and the hash is then stored. When a user logs in, the password they give is hashed and compared with the stored hash. If it matches, you’re in. There is no algorithmic way to go back from the hash to the password itself, so stealing the hash becomes less useful. Problem solved? Well, not really. Given brute force and time, you can try every possible password combination, and see which ones create the hash you want. Say there are about 10 billion possible passwords, then that’ll take about 8 seconds using current technology. Ah, problem not so solved. But, if there are many more combinations, then it will take correspondingly longer. That’s why longer passwords are more secure, but only if the hash algorithm creates a long enough hash. The default Unix (or Linux) hash is only 8 characters, so it’s crackable by brute force in seconds.

By the way, assuming all uppercase and lowercase letters, numbers 0-9, and 31 special characters (like @^:;+!=] etc) are available, then a 5 character password has about 6.9 billion combinations, so not secure at all. Conversely, a 20 character password has about 2342 billion billion billion billion combinations (so my Excel formula tells me anyway). At a rate of  10 billion password tries in 8 seconds it would take 59421 billion billion years to try all combinations for a 20 character password. Things are not quite that great as that, as you would try all the combinations in order of likelihood, based on some other algorithms that try words or part words first, but you get the idea: A 5 character password is hopeless. A 20 character password is very robust from a brute force attack. If you want my calculations sheet, email me and I’ll send it to you. Back to the plot now …

So, there is definitely a problem with security in travel, so what can be done. Well, what we’ve been doing for years is what the banks are now increasingly doing, especially with mobile banking. The connection to your secure service is secured not only with some kind of username and password, but also by tying the connection to a specific device. In the case of banking, your mobile banking app will be registered to and be verifying the device (phone or tablet) that it’s running on. If you install the app on another phone and try your password/passcode, it wont work. In the case of our systems, we check that you have installed a ‘digital certificate’ onto your PC, and we validate this certificate as part of a secure tunnel between our systems and your desktop/laptop. You may not know if your password has been stolen, but you’ll certainly know if your mobile phone or laptop has been. Also, even if your device is stolen or lost, its vanishingly unlikely that the person who stole/found it also has your username/password combination.

So, we have now tied the connection not only to a person with  knowledge of a secret (i.e. their username and password), but also to a set of pre-validated devices. The key thing here is that if either your password or your device is compromised, your security is still intact. 

So, what are the key things that can be done today:

• Make sure every user has a separate login, and that none are shared in the workplace.
• Write a password policy and make sure your staff do not use work related passwords for personal use.
• If you have the option to do so, use a username rather than just your email address.
• Make all your passwords decently long (more than 8 characters), and include numbers and special characters
• For core systems, see if there is any option to tie down your access via some 2nd level security to a specific device, via a VPN or secure tunnel connection.
• If any web site emails you your current password when you forget it, then they are not storing your personal information is an appropriate way (imho), and you should not be dealing with them. Passwords should always be stored in a one-way hash, meaning that they cannot be recovered, only changed.
• Try and use different passwords for different types of things e.g. don’t use your banking password for facebook , twitter, LinkedIn etc

This is all just common sense, but maybe not so obvious to everyone. The threats of data loss, fraud, identity theft and worse are real threats, and the travel industry really needs to wake up and think carefully about these issues. Understanding how easily passwords can be hacked is a good place to start.

Rob Wortham

October 2013

It is a pleasure working with you and the 1time Holidays team in particular.

Holiday Tours has been running a series of MasterChef themed events for South African travel agents. The “MasterTech” roadshows start with each travel agent being shown how to bake a simple muffin and croissant. This was then followed by a demonstration of Holiday Tours’ new online system and a Q&A session. The message: “See how easy it was to bake? Now see how easy it is to use our online booking system.“

Click here to view more information 

The company is using RWA’s Sell-It Suite for it’s new agency selling platform which provides online booking tools for travel agents and their customers. To request more information for how Sell-It Suite can help your business click here.

 Go to holidays.holidaytours.co.za to view website.