Studies have shown that most mobile device users — even those who are security-savvy — tend to throw caution to the wind when it comes to connecting to open-access, public Wi-Fi networks. Public networks are displayed in the list of Wi-Fi networks without a lock icon. When connecting to a public Wi-Fi network like one at a coffee shop or airport, the network is generally unencrypted — you can tell because you don’t have to enter a passphrase when connecting. Even when provided by a trustworthy business or location, these networks can put financial and personal data at greater risk.
Smartphones and tablets are used frequently by people of all ages, and more and more sensitive data is accessed by, stored on, and transmitted via these devices on a daily basis. Mobile devices themselves offer few (if any) instructions about establishing safe Wi-Fi connections; on the contrary, many users seek out Wi-Fi whenever possible in order to minimize mobile data usage. In addition, the increasing availability of Wi-Fi hotspots in public places can lull device users into believing there is safety in numbers. This, unfortunately, is not the case. The bottom line is that free Wi-Fi is not a safe, secure option if you’re transmitting sensitive data. There are a number of ways that even relatively inexperienced hackers can compromise open-access networks.
You need to be more cautious about your Wi-Fi habits more now than ever, the following three best practices can guide you to make more thoughtful connections in the future. Though you cannot completely eliminate the risks associated with open-access Wi-Fi, adopting better habits will help to protect your devices and your data.
- Restrict Your Activities
When on open Wi-Fi, it’s important to limit your online activities. If you sign into email and social media accounts or make a purchase on compromised networks, hackers could easily obtain your credentials or financial data and use them for their own gain. It’s always best to refrain from logging into secure sites or doing anything financial in nature (like shopping or checking account balances).
If you absolutely cannot wait until you’re on a secure network to complete one of these riskier actions, the safest choice is to turn off Wi-Fi and use your mobile network instead. If you are not able to do that, or if you are regularly in situations in which you need to access Wi-Fi to transmit personal or university data, a virtual private network (VPN) application can offer an additional layer of security. A VPN can prevent hackers from “snooping” on your Wi-Fi transmissions. Using a VPN is like creating a tunnel for your information to pass through, and that tunnel helps to create a secure barrier between your data and a hacker.
A word of caution, however: Because you need to connect to a network before connecting to a VPN, you could be compromised before you’re even able to turn on your VPN. For example, a rogue Wi-Fi hotspot could install malware on your device when you connect to your network and still intercept your traffic after you activate your VPN. Essentially, a VPN is only effective if you can confirm the legitimacy of the network you’re using.
Current faculty, students, and staff of the University are eligible to use cVPN. Access cVPN by logging in to cvpn.uchicago.edu with your CNetID and password. You will need to verify your identity using two-factor authentication (2FA) in order to access cVPN. Upon logging in, you will be prompted to download the appropriate AnyConnect VPN app for your device’s operating system.
If you do opt to install a different retail VPN on your personal device, be sure to research available options and choose an application that has been well-reviewed and highly rated by reliable sources for your specific device. And if you feel you must connect university or personal devices to public Wi-Fi networks for business purposes while traveling, have a conversation with someone from your unit IT team about organizational policies for remote networking and the best way to keep data secure.
- Don’t Confuse a Trusted Location with a Trusted Network
When you travel in your local area and beyond, you’re likely to visit many upstanding establishments, including coffee shops, restaurants, stores, and hotels. But just because you trust those locations, that doesn’t mean you can trust the free Wi-Fi they offer. As was noted earlier: No open Wi-Fi network is 100% safe.
Also keep in mind that a Wi-Fi network’s name is not a true indicator of the network’s owner. The names of Wi-Fi networks are manually created, which means that hackers can mimic brands, landmarks, and other elements to make networks appear reliable. So-called “rogue” and “evil twin” hotspots are common; to fool mobile users, these networks are given names that seem logical or are similar to other networks in a given location (Airport Lounge or Lobby Wi-Fi, for example).
If you make the decision to connect to free Wi-Fi in a public (or private) location, check with an employee or another trusted source (an official sign or brochure, for example) to confirm the name of the network. And be careful: just a little difference in the name — one letter or number, for instance — means it’s not the network you’re looking for.
- Turn off Wi-Fi When Not in Use
It’s safer for you — and less draining for your battery — if you disable Wi-Fi when you are not using it. You should also turn off automatic Wi-Fi connections to avoid joining unsafe networks. Did you know that, for example, if you connected to a safe hotspot with the name “AirportWiFi” in the past, you could end up automatically connecting to a malicious network with the same name in another location?
On most mobile devices, you can turn Wi-Fi on and off via an easy-to-access menu; options to disable automatic connections are generally available in network settings. A quick online search or support call can help point you in the right direction for your specific device. These choices will help you better control your Wi-Fi usage and ensure that any connections you make are informed and intentional.
#CybersecurityAwarenessMonth2020 #BeCyberSmart