What are the appropriate steps to recommend for people to take after they connect their Android device to questionable open WiFi access points?
When I say "people", I mean friends and colleagues. I am not referring to establishing a corporate security policy.
This seems especially important for Android, since unlike some other operating systems, very few people actually use properly patched systems. For Android, the users can't really be blamed: manufacturers often do not release patches for their Android devices, and Google does not typically offer patches that can be applied on most devices.
If possible, in your answer, please cover any differences in best practices for non-rooted and rooted devices.
In your answer, please explain why you recommend each step.
Of course, the best advice is to instruct people to not connect to open WiFi access points. But getting people to abide by that advice is an uphill battle.
UPDATE: For those who thought their Android devices might be somewhat secure, Google just disclosed a slew of Android security issues, including six (6) that they categorized as critical. Has your Android device received patches for all these security issues?