Remaining cyber safe while travelling: security recommendations

Purpose

This document is intended to complement cyber security while travelling. It is intended to provide readers with cyber security information to increase their awareness of cyber-based threats that they may face when travelling. This document also provides mitigation advice which may reduce the risk associated with these threats.

Background

Individuals have become increasingly reliant on timely access to digital information, even while travelling. Remote access to business information is generally facilitated through the use of portable electronic devices which can offer the traveller both communications services and access to information, even when this information is stored on internal corporate information technology infrastructure. Devices include personal digital assistants (PDA), cellular and smart phones, laptops and tablets. Employees should be made aware of the risks that they, and the information they take with them, may face while travelling, as well as understand measures that they can take to reduce this risk. This document provides general cyber security information to increase the traveller's awareness of potential risks they face while travelling with electronic devices.

The information that someone travels with, or the data accessed while travelling could be compromised by threat actors and used against the traveller or the organization represented. Potential threat actors include hostile and foreign intelligence services, criminals and competitors. The information targeted by the threat could be technical, political, military, financial, or personal and a compromise of this information could provide the threat with a political, strategic, economic or competitive advantage. The risk associated with the potential information disclosure depends on the nature and/or sensitivity of the information itself.

Consumers and custodians of proprietary and sensitive information need to be aware of the potential for harm should that information become lost or stolen. The risk increases when travelling. The best way to prevent information loss or compromise is not to travel with it in the first place, not to access it remotely; and not to bring back external data files or devices and introduce these to the organization's information systems. These preventative measures may not always be feasible. Therefore, an organizational understanding of the risk travellers face, increased awareness by the travellers themselves, and the implementation of technical and procedural measures to reduce the risk associated with the loss, theft, compromise or corruption of digital information and devices are essential enablers of business or mission objectives.

General security considerations

The following general points have been provided by the Communication Security Establishment Canada (CSEC), the Government of Canada's lead in providing advice, guidance and services to help ensure the protection of electronic information and of information infrastructures of importance to the Government of Canada:

• Individuals holding senior positions within an organization and/or those who work with valuable information may be at higher risk of being targeted through their mobile devices.
• Capabilities exist which allow threat actors to:

• identify and target mobile devices
  • deliver malicious code to the device
  • use device network connections (e.g. wireless, Bluetooth, etc.) for their own purposes
  • leverage the device as a means of infecting other networks
  • access the device as a means to track your location (e.g. GPS)
  • activate the microphone on a device, and
  • intercept communications that are sent electronically
• In some countries, hotel business centres and phone networks are monitored and in some locations, rooms may even be searched. As a general guideline, assume that there is no expectation of privacy in offices, hotels, Internet cafes, or other public areas.
• Mobile devices are a prime target for theft. If stolen, the information contained within may be accessed and/or used for malicious purposes.

Assessment

The following non-exhaustive list describes eight cyber security activities an organization should considered before, during, and after employee travel.

• 1.0 Security of portable and mobile devices
  • 1.1 Phones/smartphones
    • Wireless access
    • Bluetooth access
  • 1.2 Tablets/laptops
  • 1.3 Loaner devices
• 2.0 Wireless access points: publicly available wireless Internet access points
• 3.0 Internet café, kiosks and other public Internet access points
• 4.0 Data encryption: protecting your digital assets
• 5.0 Password security while travelling
• 6.0 Be aware of event related targeted emails
• 7.0 Data backup: backup pertinent data files prior to departure
• 8.0 Conference give-aways: take precautions

1.0 Security of portable and mobile devices

When travelling, users may carry multiple computing platforms and devices that if compromised and/or stolen, could result in harm to their organization. There are two popular types of devices that users travel with: phones/smartphones and tablets/laptops.

1.1 Phones/smartphones: There are many types of phones and smartphones available to users that offer a number of options, each with various applications and capabilities. These types of devices are potential targets for physical and data theft. To a threat actor, these devices offer a centralized source of information, both personal and professional, about the owner and the organization they represent. The majority of phones and smartphones have a number of connectivity functions including service provider digital infrastructure (such as CDMA, GSM and LTE networks), wireless, Near Field Communications (NFC) and Bluetooth. These connection options are often available to other computing devices with associated hardware modules such as tablets and laptops.

Wireless access (or "Wi-Fi"): Many devices offer the ability to connect to the Internet using available wireless Internet access points. These Internet connection points offer various levels of security, and users should be made aware that any information sent over a network they connect to may be intercepted by a motivated and capable threat actor. Free Internet access points are sometimes established for malicious purposes, and they are sometimes purposely named to appear as trusted access points.

For example, a hotel may have established an access point called: “HotelABC Internet”. A threat actor could establish a malicious access point in the vicinity of that hotel called: “SecureHotelABC Internet”. This access point may even have higher signal strength than the legitimate one and is, thus, presented to the user as a preferred connection. It is advisable for the traveller to confirm with the accommodations establishment the name of any Internet connection that they provide.

Bluetooth access: Bluetooth is a short range wireless connection protocol to establish connectivity between two devices. One common use of Bluetooth technology is to enable hands-free talking while driving. Some devices allow automatic connection, meaning that other Bluetooth devices can establish a connection without authorization and, then, potentially access exposed information such as contact lists. Bluetooth settings can be managed at the device level to reduce this risk. Ideally, Bluetooth should be disabled prior to travel by the device administrator.

The following precautionary measures should be considered when travelling with phones and smartphones:

• Enable a password on the device and change the password prior to travel. Ensure the password meets the complexity requirement defined in the organization's security policy. Change the password at regular intervals and when the travel has been completed.
• Display ownership on a visible or accessible area of the phone. For example, enable a screen saver that lists a name and point of contact in case the device is lost.
• Enable the setting that will erase all of the data on the device if the password is entered incorrectly after a certain number of invalid login attempts.
• Some phones/smartphones offer self-locating options and anti-theft software. Become familiar with these options and consider enabling them.
• Keep the device in your possession at all times. If this is not possible, remove the battery, memory expansion and SIM cards, and keep them with you.
• Some devices do not work in specific geographical locations. Contact your service provider or organizational IT department prior to travelling.
• Disable Bluetooth, and
• Avoid charging a device by connecting it to the USB port of an unknown or untrusted computer.

Note: Some countries have laws that allow them to monitor the information transmitted over their networks. Users should always be aware of the information they are transmitting using foreign networks and how the compromise of that data may affect them and the organization they represent.

1.2 Tablets/laptops: Tablets and laptops can also be attractive targets for malicious actors. The following tips may help secure these types of devices during travel:

• Enable a password on the device and change the password prior to travel. Ensure the password meets the complexity requirement defined in the organization's security policy. Change the password at regular intervals and when the travel has been completed.
• Update the antivirus software before travelling.
• Install and enable a firewall on the device.
• Install software updates applicable for the device operating system and applications. If using a corporate laptop or tablet, consult the IT department to ensure such updates are applied.
• Disable wireless (Wi-Fi, Infra-Red and Bluetooth) connections when not in use.
• Ensure that all the required software/hardware is installed to avoid purchasing or downloading them while travelling.
• Avoid connecting USB devices and storage media obtained from unknown sources to the tablet or laptop.
• Encrypt the data stored on the device. Note that some countries do not permit entry of a device with encrypted data. This should be verified prior to travel, and
• If possible, set web browsers to their highest security setting

1.3 Loaner devices: It is common practice for travellers to have their organization provide devices that are used specifically for travel purposes. These are “clean” devices that allow the user to continue to perform their duties while travelling. These devices are often older or cheaper assets configured to provide basic computing abilities, and may or may not include the ability to connect to corporate networks. They are exclusively used for travel purposes. After travel, the information on the device is securely deleted and, at times, the device itself is destroyed. Organizations with an advanced forensic analysis capability may choose to examine the device for evidence of compromise.

Loaner devices may offer a false sense of security. No matter the state of the device, awareness of the risk while travelling is important. If the loaner device connects back to the organizational network, or the organization's information is processed on the device, risk of compromise remains. Loaner devices may therefore be restricted in from accessing critical or sensitive networks.

2.0 Wireless access points: publicly available wireless Internet access points

Travellers will encounter various Internet wireless access points, some of which are free to use. Examples of such services include free Internet provided during conferences, in hotels, in airports, or in other public locations. These access points are often unsecure networks that can be accessed by anyone. A network that requires a password to connect to may not be secured. While any wireless communication faces the risk of interception, the use of strong encryption can reduce the risk of information disclosure.

As a best practice, avoid connecting to public wireless Internet and avoid transmitting information that you do not wish to be disclosed to an undesired or unauthorized party.

3.0 Internet café kiosks and other public Internet access points

Many facilities offer travellers devices that they can use to connect to the Internet. This service is often available in business centres at hotels and airports. These devices should not be considered to be trusted access points. They are subject to the security practices and management of the providing organization. Malicious software and hardware may be inadvertently installed on these devices and made undetectable by its users and the provider. One example is that of a keylogger. A keylogger records information typed by the user on the computer, such as passwords and credit card numbers. They can be either covert software applications, or physical devices attached to computers. Travellers should not use these publicly accessible devices to view or transmit information that, if disclosed, could harm either the traveller or the traveller's organization.

4.0 Data encryption: protecting your digital assets

When travelling, users may also employ encryption mechanisms to protect their data. In short, encryption transforms data in order to make it unreadable without a decryption key (generally a passphrase or token). Encryption may be used by travellers to send emails, or to secure the content of storage media such as laptop hard drives and USB memory sticks. When properly implemented, encryption protects information against theft and interception. Email and file encryption software is available commercially from a number of reputable vendors. PGP, or Pretty Good Privacy, is an example of a commonly used tool for effective email and hard drive encryption. Travellers should consult their IT department regarding supported encryption options for their organization.

Encryption is a very powerful and can be a somewhat unforgiving method of data protection. Depending on the nature of the encryption, should the decryption key required to unlock the encrypted data be lost, the data may not be retrievable.

Note: Some countries have laws that limit the use of and presence of encryption software. Prior to travelling to a foreign country, users are advised to consult the laws and regulations related to encryption that may apply in that specific country. For more details, consult the references provided below.

5.0 Password security while travelling

With the increased risk inherent in travelling, travellers are advised not to use the same passwords that they use at their place of employment when travelling. In today's computing environment, users often have multiple accounts that require password authentication. This may lead to password reuse, where the same password is used for a number of accounts. Should the password be compromised, there is the potential that a threat actor may then be able to gain authenticated access to multiple user accounts. Therefore, employees should be advised that a different and unique password be used while travelling. If it is suspected a password has been compromised, all passwords belonging to the user should be reset and the associated user accounts be monitored for suspect activity.

6.0 Be aware of event-related targeted emails

Targeted email attacks, or spear phishing, rely on exploiting the trust of the intended recipient. Before, during, and after travelling to a scheduled event, a traveller may be subjected to targeted email attacks. These emails are designed to appear authentic and may entice the recipient into providing sensitive information, or may unknowingly install malicious software on their device through a malicious attachment or web link. Travellers attending international conferences on topics of strategic and economic significance such as energy, environment, finance and military, are common targets of spear phishing attacks. Many of these attacks have reportedly been associated with advanced persistent threat (APT) actors. For more information on the mitigation of APT and tactics used in spear phishing attacks, please review the materials provided in the reference section.

7.0 Data backup: backup pertinent data files prior to departure

Prior to departure, travellers are advised to back up pertinent data files to a device that they will not travel with. Equipment is sometime subject to various rigours and inconveniences that are associated with travel. These can range from loss of baggage, theft of equipment and damage in transit to hardware failure and even search and seizure.

Individuals should never travel with data that they are not prepared to lose. In addition, individuals should not travel with information in a manner that violates their employer's policies or applicable laws.

8.0 Conference give-aways: Take precautions

While attending conferences and training events, software and hardware may be offered to participants. These materials can either be free of charge, or part of the paid content for course delivery. Even when provided during the course of a planned activity, it is possible that these materials may inadvertently or purposely contain malicious software. For example, a recent conference on computer security mistakenly distributed USB sticks that contained viruses that were installed during the manufacturing process.

Travellers need to be conscious of all storage devices that they attach or load into the devices they carry. This diligence should not only persist while travelling, but should remain upon return to the office. Do not attach or access any device that was received as a result of travel until it is properly evaluated by the organization's information technology team.

Recommendations

Threats to the cyber security, both physical and technical, can increase significantly when travelling. A user is normally taken from a known and relatively secure environment to one that is open, unknown and, in some cases, where threat actors have the power of government behind them. A heightened sense of cyber security awareness is required when travelling to protect personal and corporate assets.

A set of best practices while travelling was recently published by the Communications Security Establishment Canada and is provided in the reference section below.

The following checklist summarizes a number of these best practices as well as those introduced previously in this document. This checklist is for use by both the traveller and information technology support staff: