How can you keep employees from using public Wi-Fi networks?

I don't think this question is well posed, as it assumes that public WiFi is dangerous ('begging the question'). It appears not to take into consideration advances in security such as TLS1.3, HSTS (force HTTPS connection) and DoH (encrypted DNS), which have made many attacks impossible or very hard. Attackers are likely to view using this vector as less interesting than many others. For example, social engineering attacks may make better sense in these conditions. This, again, reduces the risk of using public WiFi, and means users should focus their attention elsewhere. A better core question would have been around *whether* public WiFi is actually dangerous, and if so, how? This is indeed an ongoing debate on LinkedIn and elsewhere.

Public WiFi isn't dangerous. The internet is more secure than ever, and the likelihood of a data breach stemming from working in Starbucks is lower than ever. Use a VPN to be sure, but otherwise, work as normal.

Public Wi-Fi networks are easily accessible not just to users, but also to potential attackers. This accessibility makes it easier for malicious individuals to connect to the same network and launch attacks against other users. Many public Wi-Fi networks are not encrypted, which means the data sent over these networks can potentially be intercepted by others. Without encryption, sensitive information such as passwords, credit card details, and personal emails can be easily accessed by cybercriminals.

They're not. The need for physical presence while having almost no control over who connects or what they do isn't worth the expense or risk for attackers. Modern WiFi encrypts traffic so eavesdropping isn't possible. If you connect to a rogue or compromised WiFi then yes the attacker could redirect your traffic, but they can do this remotely with social engineering or phishing; cheaper, safer, targeted. There's been one documented case of rogue WiFi being a material factor, it was over a decade ago and targeted diplomats and high level execs in the nuclear and defense sectors. The WiFi was only used to deliver malware, which again can be done remotely more easily and with less risk to the attacker.

To prevent employees from using public Wi-Fi networks, organizations should educate them about associated risks, strengthen security measures, establish mobile device policies, offer secure alternatives, and monitor network activity. This combination helps mitigate risks and encourages the use of secure networks or VPNs for remote access to business data or systems.

When you consider the risk of an employee using public Wi-Fi, you need to distinguish between personal and work related. For example, whilst you may be able to set policies on corporate devices that prevent unknown Wi-Fi networks, this doesn't stop an employee from using the same network on their personal mobile or laptop. Most corporate traffic is encrypted in transit with SSL, so the risk to corporate data isn't data loss from interception, it's password compromise. Password compromise can occur on any device - corporate or personal. How can we mitigate the risk of password compromise? Reduce the number of times users need to use passwords! If a user connects to a fake network and uses passwordless, the risk is far smaller.

This is a little contradictory - it says to offer secure alternatives to public WiFi, but the VPN suggestion REQUIRES a WiFi connection. Realistically, unless you implement borderline draconian policies you’re not going to fully prevent users from connecting to public WiFi. The best solution would be an always-on VPN which enforces full-tunnel encryption while the computer is connected to an untrusted connection. Done this way, it doesn’t matter if the user connects to public WiFi, as they’ll be protected from any in-transit security risks. This approach is also far simpler and cost-effective when compared to hotspots, especially when international travel is accounted for.

Interdisez l'utilisation du Wi-Fi public, sensibilisez les employés aux risques, encouragez l'utilisation d'un VPN, restreignez l'accès via la gestion des appareils, assurez la sécurité des appareils, surveillez les activités réseau, et ajustez les politiques en fonction des évolutions.

A few strategies to be considered: 1. Implementing a VPN connection that will need to be established whenever there is need to connect to a public Wi-Fi network. 2. Providing employees with the option to use mobile hotspot/tethering from their work phones. 3. Using endpoint security solutions that can detect -and prevent- unauthorized access to public Wi-Fi networks. 4. Providing cybersecurity training to educate employees further about the risks of public Wi-Fi usage and the importance of following the security protocol that has been established by the company. 5. Creating a culture where employees feel comfortable reporting any security incidents or concerns to data breach or security vulnerabilities.

All employees that work in the field should have smartphones with unlimited data plans. Explain that they must connect to their mobile instead of the Wi-Fi networks. The convenience alone will be enough for most employees to avoid insecure networks.

Consider using next generation security technology like Secure service Edge (SASE) and Cloud Access Security Broker (CASB) to protect employee internet communications. These security solutions provide some level of encryption, auditing and reporting, thus giving you insight into the risks that user endpoints may get exposed to from connecting to external networks.

A corporate-approved VPN to encrypt ANY Internet traffic before an employee can use a public Wi-Fi network should do the trick. In such setup, ANY internal and Internet traffic would be routed through a corporate web proxy. In my view, this would protect an employee and organisation against any threats originating from using public Wi-Fi networks.

Providing interactive training sessions can effectively educate employees about the significance of using a VPN connection, ensuring the activation of a Multi-Factor Authentication (MFA) method, and adhering to established security protocols.

Protecting employees when using public Wi-Fi involves promoting secure practices. Encourage the use of virtual private networks (VPNs) to encrypt data, reducing the risk of interception. Implement multi-factor authentication (MFA) for an added layer of security. Educate employees on the importance of verifying network legitimacy and avoiding unsecured hotspots. Regularly update and patch devices for enhanced security. By fostering awareness and providing tools for secure connectivity, organizations can empower employees to navigate public Wi-Fi environments with reduced vulnerability to potential cyber threats.

If an employee must use a public Wi-Fi network, they should at least use a virtual private network (VPN) to encrypt data in transit. Ensure the VPN is reputable, those provided by the enterprise itself are likely robust. The strongest level of encryption (cipher) currently is AES-256. Additionally, employees should ensure the public Wi-Fi network is legitimate before connecting. At Starbucks, they may connect to a rogue mobile hotspot with a Service Set Identifier (SSID) titled "Starbuckss." Threat actors may set up this type of spoofed Wi-Fi hotspot so they can steal sensitive data, distribute malware, and conduct other types of nefarious activity. When in doubt, ask an employee to confirm the legitimate SSID!

Testing employees' awareness of public Wi-Fi risks involves simulated scenarios. Conduct phishing exercises that mimic public Wi-Fi login prompts to gauge their responses. Implement quizzes or interactive training modules focusing on recognizing secure connections versus potential threats. Monitor adherence to company policies during remote work. Encourage reporting of suspicious incidents and provide feedback to reinforce learning. Regularly update training content to reflect emerging threats. By employing a combination of practical simulations and educational assessments, organizations can effectively evaluate and enhance employees' awareness of risks associated with public Wi-Fi usage.

Stupid, stupid, stupid! We need to design our cybersecurity assuming that our users are going to make mistakes. If you do your job correctly, the users don't have any risks in using a public network. Users are accessing enterprise assets from their home networks. How many of them gave out SSID passwords to the people who attended a party last weekend? Oops, that home network just became a public network. Any device connected that has been compromised has the potential of compromising the devices on the home network now. And then the compromise could spread to the corporate assets because the home devices are treated as trusted devices once a VPN connection is made.

Most users won't know how to spot a deauth attack so adding live demos during awareness training (not recorded) will provide the situational experience for users to make the right decisions. You can also spin up a whack fake wifi APs around your site and gather connection logs.

To update security policies and procedures, conduct regular reviews to align with evolving threats and industry standards. Collaborate with key stakeholders to gather insights and address emerging risks. Ensure clarity, simplicity, and accessibility of policies. Provide comprehensive training to employees on updated procedures and reinforce the importance of compliance. Regularly communicate changes, leveraging feedback for continuous improvement. By fostering a dynamic and responsive approach, organizations can adapt their security framework to effectively mitigate new and evolving security challenges.

You are wasting your time if you try to "communicate and disseminate your security policies and procedures clearly and consistently to your employees and stakeholders". Network access should be transparent and easy for users. And stakeholders should be engaged in creating the policies and procedures. When they are actively involved, the communication will have started before the process is far along.

Your policies and procedures should be based on industry best practices and ideally aligned to a security framework. They need to be reasonable and have little to no friction for adoption. The lower the barrier to adoption the less likely users will attempt to circumvent them in an attempt to get work done. Making an effort to communicate the reasons behind the policy and/or procedure to users and taking feedback and use cases into consideration will go a long way in helping maintain a strong security posture.

It is time to evolve and mature our security practices. The decades of incidents and breaches should motivate us to look for what really works and not just what worked in the past. We need to abandon the old way of thinking, VPN and email/SMS MFA is no longer the gold standard. Look at what enterprises are accomplishing with Zero Trust Network Access (ZTNA). No more account compromises and true work from anywhere including public Wi-Fi.

DNS DNS DNS, It's always DNS. When you setup your connection to the public wifi, try not to use the router DNS and configure your own DNS servers or better yet, use the ones from CIRA.