Business travel, especially international business travel, can put organizations and their employees at risk for cyberattacks. In 2017, International SOS found that 75 countries were impacted by cybersecurity attacks between the months of January and September alone. Protecting a mobile workforce is challenging for any business; risk mitigation plays an integral role in keeping both personal and business information secure while on assignment.
Cybersecurity is generally built around three main principles: Confidentiality, keeping data private and preventing unauthorized access to data; Integrity, confidence that data has not been modified or manipulated by an outside source; and Availability of Data, the ability to access required data when you need it. Business travelers can put these three principals at risk by simply transferring data through non-encrypted channels.
Although business travelers encounter several points of cybersecurity vulnerability while traveling, such as use of Wi-Fi hotspots in public places, use of USB chargers that can download and execute malware, and eavesdropping, there are a number of steps organizations can take to asses travel risk and keep company information and devices secure. The first step for a business to protect against cyberattacks, is to understand the techniques used against business travelers. Typical cyberattack techniques include:
- Theft or Loss of Devices: Theft or loss of laptops is the number 1 threat faced by business travelers. Travelers leave laptops at airport security, in taxis and have them stolen from hotel lobbies and rental cars. Loss of laptop can be loss of data, which can be as damaging as any remote attempts to access the network
- Data Breach: Theft of data due to limited security measures, potentially leads to leaks of sensitive, reputation-damaging information
- DDoS (Distributed Denial of Service): The use of a large number of infected devices that lead to slow or unresponsive web-facing devices and applications
- Ransomware: When malware is downloaded to a device that encrypts data until ransom is paid. This technique is often used as a smokescreen for deeper network intrusions. Travelers could be affected by this if they download and execute software that contains the ransomware code
- Unauthorized Access: The use of stolen credentials or brute force attacks such as guessing usernames and passwords, to gain access to a network or device that has a high threat score due to its potential for privilege escalation and lateral movement. The threat for travelers here is people “shoulder surfing” while travelers are entering their usernames and passwords while connecting remotely. This could happen on the plane, in the hotel lobby or in a coffee shop.
One of the most effective ways companies can mitigate cyberattack risks is to use a Virtual Private Network (VPN) to access data remotely. Organizations can implement VPN's for their employees as part of its travel risk management program. Those traveling for pleasure can also implement VPN’s as a precautionary measure to prevent theft of personal information.
Use of screen protectors, storing data in a cloud instead of on a laptop, encrypting files on a hard drive, and removal of unnecessary files on devices, are also great precautionary measures to ensure cybersecurity. If possible, businesses should encourage travelers to avoid connecting to non-secure networks such as public Wi-Fi hotspots and to disable their Wi-Fi and Bluetooth capabilities while traveling. By not using a secure network, company data is put at higher risk and online accounts are more vulnerable, also putting employees at risk for identity theft.
Over the last year, concerns about information security while traveling for business or on assignment have increased. In 2017, reports predicted that corporate information theft will cost businesses between $2.1 trillion in 2019 and $6 trillion by 2021. This serves as proof that business travelers are more and more vulnerable to cyber and physical information security threats. It is crucial for organizations to implement preventive programs to teach their travelers and expats how to identify potential cyber and information security threats, and how they can reduce exposure to risk of data theft, within their travel risk management programs. Effective prevention will help ensure information, whether it’s business critical, sensitive personal, or otherwise confidential information is safe and protected from cyber threats.
