Should an IT Security Policy allow employees use public Wi-Fi? [closed]

Question

Should an IT Security Policy allow employees use organisation-owned laptops holding potentially sensitive data access public Wi-Fi in locations like hotels and airports?

Answer 1

Wi-fi traffic can be intercepted at will. It's essentially a broadcast, in the clear in open wi-fi, or encrypted with the password if one's present; most of the time, even that encryption is insecure.

Public wi-fi is generally unsecured networks or networks with a shared key. This allows an attacker unfettered access. A typical traveler won't know which of the many appropriately-named networks in the airport is official, and which is an opportunistic attacker. So it's a safe assumption that the traffic routinely sent through open wi-fi networks will at some point, in some network, eventually get intercepted.

As to whether it's a security problem, in the perfect scenario where the sensitive data just lies on the drive, preferably encrypted, the user is not an admin, they only use the wi-fi for their personal needs, never to send sensitive mail or access company data, and they use encrypt&authenticate all their traffic, it's not.

In the imperfect real-world scenario, where sensitive and personal data is mixed up, the users alternate between using their laptop like a workstation and like a public terminal (disregarding security, since they're "just checking the weather"), it is. You'd be trusting several human-dependent protections for security, the breach of even one of which will leak the data. Worst-case scenario, the user's laptop can get a RAT (remote access trojan) uploaded to it.

It's not an automatic security fail - much of the web uses SSL now, so it's not like everyone sees everything, and VPN traffic can come through encrypted as well. But it's a large attack surface for a dedicated or opportunistic attacker.

The best solution is, IMO, to ensure the laptops used for travel aren't holding sensitive information, and aren't plugged into the vulnerable parts of the intranet (assuming zero-trust is not in place). On top of that, ensure the personnel on travel follows at least a minimum of security practices, such as not using open networks and not mailing sensitive data without end-to-end encryption.

If it's absolutely necessary to transfer sensitive data beyond mail to and from laptops while traveling, it's possible to design a corporate network that's secure over insecure channels, but it takes considerably more security expertise to set up and keep secure than can be realistically covered in a SE answer. The VPN has to be secure and always up, the laptops have to reject all other connections, including for Windows update, there shouldn't be any ways around it, and so on.

Given the negligible cost of local SIM cards compared to the expense of business travel, it's best to use them in favor of public wi-fi, together with other security measures (encrypted mail, encrypted files, low privileges, compartmentalization, monitoring, VPN). Even secured wi-fi is still someone else's network, someone local that can be impersonated and that gets two-way access to your traffic.

Answer 2

I think the question has the wrong focus by asking only about public Wi-Fi. In general it is a bad idea to transmit any kind of sensitive information over untrusted networks without additional protection. Such untrusted networks can be public Wi-Fi, but also paid Wi-Fi in hotels, network access when visiting some customer or contractor, mobile networks, ... .

It is possible to use any of these untrusted networks with the proper additional protection on top, preferable a VPN into the trusted company network. Of course one need to make sure that really all traffic is passing always through the VPN, i.e. not only company specific sites, not only IPv4 and not only web traffic but also DNS and that no relevant traffic passes before the VPN is established. This is not easy and many VPN products fail to do it properly, but there are ways to do this correctly.

Apart from that the sensitive data on the laptop itself should be well protected even if the laptop is not inside some network. Laptops easily get stolen so the sensitive data need to be protected against theft, maybe combined with previous password leakage through should surfing.

Answer 3

As steffen mentioned, a good solution may be a company VPN. You probably want to have one anyway, so you just have to enforce all traffic through the VPN. The employees can access the internet and the data is mostly secure. All the other precautions and warnings from Theracs post still apply though, as do all best practices, for example encrypting work data and separating them from personal data.

Answer 4

As the others have touched upon, one of the greatest issues entailed with this scenario is that accessing public WiFi presents significant security challenges. This is the case due to poorly secured Wireless Access Points (WAPs). Additionally, you then face the threat of rogue access points and clone access points (utilized for Evil Twin attacks). Mitigating the threat posed by these security flaws is difficult, but if one must connect to public "hotspots," then the best approach is to utilize a VPN.

However, one could argue that a VPN is not enough in this instance. If we are discussing the prospect of utilizing a machine that contains vital information on a public network, then we must find other means of securing it. Basically, the machine should have a strong password, have anti-malware software on board, be up-to-date with common malware signatures, and potentially have an encrypted hard disk (think FDE [Full Disk Encryption]).

It is worth stating, however, that any system that contains classified/sensitive material is unlikely to be allowed to leave the premises. In removing such a device from the premises an employee usually runs the risk of violating their clearance, violating the terms of their contract, and potentially violating non-disclosure agreements (NDAs). You might also potentially risk being accused of stealing that information for some nefarious purpose.

In the post-Snowden era, you can be guaranteed that most companies that have highly sensitive information are going to ensure their employees cannot bring this information home. The only exception may be found with remote employees, of whom work from home and have different conditions applied to their access of sensitive material. Generally speaking, information security specialists (especially information assurance experts) should ensure employees follow so-called best practices and do not violate their own security and/or the company's.