It’s pretty safe to say that if you own a device that connects to the internet, chances are you’ve connected to public Wi-Fi. But did you know that by doing so, you may be putting your private information at risk? Sometimes, even if we know the risks, we still connect. It is a convenience that many of us are not willing to go without. Sometimes you might even plan out where to go based on if they have public Wi-Fi or not. Your employees are no different in this regard and some of may access work in public places. Public Wi-Fi though often times are not the most secure connection points and malicious actors could be playing the man-in-the-middle role while sitting right next to you or one of your employees.
You’ll often come across unsecured public Wi-Fi networks at coffee shops, restaurants, airports, train stations, hotels, malls, public parks, and even some unsecured home networks. So what exactly is meant by unsecured? Well, any network that does not require a password or some sort of credential to log in to. They often leave users exposed to password theft, credit card information, malware installation, and man-in-the-middle interceptions.
So now imagine your employee logging into your network from a public location, a hacker would know what address to go to and what credentials to use. It might not even come off as a suspicious login since your employee was actually at the location as well. Just the use of public Wi-Fi by your employees or yourself can expose your company to malicious actors. This is another form of insider threat, well another negligent action that an insider might do. Let us examine the dangers some more and provide some definition to them.
When you or your employee is online there is a lot of information transmitted that might be valuable to cyber criminals. Some of this information includes browsing history, communications, contacts information, files, login credentials, and even credit card information. The most common activities on Wi-Fi are communications, remote work, and viewing financial information.
With malicious actors on the prowl none of this is safe. The following attacks are the common security incidents that happen over public Wi-Fi:
- Credential Theft: This is one of the easier attacks and can be the beginning of a very damaging effort. On public Wi-Fi, tools such as packet analyzers and LAN keylogger software can give someone sitting nearby everything they need to act as you or your employee. In some cases the software can monitor the screen activity of each computer on the network. All of this unknown to the victim.
- Malware Installation: Malicious code can be injected into any device on the network. This opens up a world of opportunity for a hacker. Malware can be used to continuously feed information to someone outside your organization. The malware can also be used to activate the microphones on laptops and mobile devices for eavesdropping. The installation of malware is the most dangerous risk. This is because your employee could have compromised your network a long time ago and you wouldn’t know because they access from various locations all the time. So any behavior may not be immediately detectable while using their credentials. The depth of compromise is entirely dependent on the creativity of the hacker.
- Man-in-the-Middle Attacks: These are common especially for people who do not visit sites with https. A man-in-the-middle attack occurs when a hacker interceptions your communications. So before you data reaches its intended audience, it goes through the hacker first. This can also apply to passwords and usernames. The man-in-the-middle method is commonly used for eavesdropping and intercepting file or financial transfers.
Preventing Public Attacks and Theft
Thankfully, there are a few things you can do to prevent this type of attack from happening to you or your employees. It may be good to require them to do this if they wish to work in public or communicate over a public Wi-Fi network.
- Virtual Private Network (VPN): A VPN is one of the best lines of defense you can have against malicious actors on public Wi-Fi. When using a VPN your connection to the internet is encrypted, which will likely make you an unworthy target to a hacker. On a VPN no one is able to see or intercept your communications.
- HTTPS: You should always browse the web using HTTPS, this ensures that communication between your browser and the website is secure as well. These often are the first line of defense against man-in-the-middle attacks. Just the simple addition of an “s” when visiting a website could prevent a data breach at your organization.
- Firewalls: That familiar term we’ve heard since the 90s. You should always be using a firewall and thankfully they come installed on many computers now. They are able to alert you to attempted access to your computer.
Public Wi-Fi can be really convenient but it is a dangerous risk when exchanging sensitive information. Most of the time attacks often go unseen, so you wouldn’t notice until the damage is done. So take care when you’re on public Wi-Fi and make sure your employees are practicing good security as well.
This article was originally published on IT Security Central and was reprinted with permission.