Security on the ROAD

Security on the road is an absolute necessity and there is no getting around it but how we work on the road is something that could use some work. for example consider below disturbing fact from a company.

48% of senior managers and 43% of mid-level managers use unsecure public access Wi-Fi networks to connect work devices on the road.
44% of senior managers and 40% of mid-level managers use Wi-Fi to transmit work emails with sensitive or confidential attachments.

Security professionals see numbers like this and get some fits because why, well there are enumerable number of reasons.

Problem points on the road

Just like inside an organizational network there is an attack surface represented by remote workers and several possible attack vectors. Laptops, well incredibly useful can be compromised if left alone and lost.

Wi-Fi access points aren't always secure innfact the opposite.
Mobile has its own risk category
Keys and security passes. No one thinks keys as a security risk but if someone with malicious intent can set a hand on a pass it could be disastrous
The cloud also represents a risk, while it can be secure more companies are moving their informations to the cloud.
Physical documents like confidential files and reports can be stolen or destroyed.
Device configuration can be an issue for example a smart phone which has been locked down with a pin or fingerprint.
The internet of course and the web browsers represent a risk if improper links and pages are accessed.
Removable media like USB drives are a problem because they are small and easier to misplace.
Security settings on mobile devices are problematic and it's not common practice to have legitimate malware software installed on them more companies are offering or requiring it for employees who use a personal device's for business however, I hope this practice continues.
Bluetooth which has a limited range is also considered as a security risk.

Why travel troubles IT admins?

Public Wi-Fi is often unsecured and even unencrypted. It's very convenient to stop into a coffee shop and check your email over the coffee shops network but how certain are you that they set up their security such that your information is secure?

A lack of mobile security or poor security software represents vulnerability.

Auto connect also convenient is not always a good idea. If you frequent a place it is nice not to have reconnect manually every time you go there but it is easy to forget all the different places we've connected to and things change maybe some hacker got wise and hit a wireless router that uses the same SSID as the coffee shop and its not that hard to do.

Bluetooth which connects devices to each other over a limited range can actually connect to devices 100 meters away its a vulnerability and I recommend to disabling bluetooth until you need it.

Speed of business which can lead to sloppiness you get a text telling you that the report has to be there within an hour you are not going to be near an secure connection in that time the report contains very sensitive information you are sitting in a restaurant that has free Wi-Fi and because you have been their before your device automatically connected to their network which they haven't secure with encryption thats a vulnerability.

Other travel troubles include:

Lack of device locking say automatic locking after a minute or two of inactivity. My devices are set up normally to do that but to routinely ask for my pin in addition to my fingerprints after the phones been reset. Its just a nice additional feature which provides some peace of mind.

Passwords especially easier ones are fairly easy to device when someone is looking over your shoulder.

Lack of current software can be troublesome. Patching is an ongoing process and its not a bad idea to ensure your devices are up to date before you leave on a trip.

The failure to back your data in the event of a catastrophic failure

Thumb drives and other removable media because they are easy to loose and easy to remove in pocket its a good idea to avoid using these to store sensitive information.

When you are on the road and loose a devices and suspect that it has been stolen you should treat it like a lost credit card, report it immediately. If you suspect that it has been stolen and it has remote locking capability a must for any device then lock it or wipe it.

Always remember this:

Its easy to feel the pressures of business, especially on the road
Business travellers must be aware of the additional risks and trained to be aware of the risks of handling business information while on the go.