Public WiFi and Remote Work: 6 Rules to Keep Your Data Safe
1. Introduction
Public WiFi is the most exposed network an employee connects to, and at the same time the least controlled one. Hotels, airports, coworking spaces and client offices offer open connectivity with no guarantees of administration, isolation or identity verification. When we talk about public WiFi security for business, the problem is not the network itself, but what the user trusts to it: corporate email, internal applications, invoices, contracts and credentials.
Remote and hybrid work has stopped being the exception and become the norm. According to the Eurobarometer, more than half of European professionals work at least partially outside the office, and a consultant who travels between clients connects to an average of 10-15 third-party networks every month. Each of those connections is an opportunity to intercept traffic, capture credentials or impersonate legitimate services. Public WiFi security for business is not solved with a single tool: it is solved with six operational rules and their systematic enforcement.
This article summarizes the essentials of chapter 11 of the book “Practical cybersecurity protocols and procedures” (Confemetal, 2026): why public WiFi is a real attack vector, which six rules your organization should apply, and how to detect a compromise before it becomes a reportable breach. The regulatory framework — NIST SP 800-114, ENISA, NIS2, GDPR, ENS mp.com.4 and DORA — requires treating mobility as a managed risk surface, not as an exceptional case.
2. Why Public WiFi Is an Attack Vector
A network offered to third parties has three characteristics that make it a hostile environment. First, the user does not control its administration: the router may be an outdated consumer device, managed by staff with no security training. Second, there is no guaranteed isolation between clients: any other user of the network can try to reach your device or intercept your communications. Third, and most important, the SSID is not verifiable: an attacker can clone the name of the legitimate network and create an Evil Twin impossible to distinguish at a glance.
The Evil Twin is the most effective technique against the mobile worker. With a pocket Raspberry Pi or a Wi-Fi Pineapple, an attacker creates a network called “Starbucks_Free” when the legitimate one is “Starbucks-Free”, or simply clones the real SSID and broadcasts a stronger signal. The device automatically joins the strongest signal and the user has no way to know they are inside the fake network. Then the attacker deploys a fake captive portal that asks for corporate credentials, card details or the installation of a supposed “network certificate”.
Add to this local ARP and DNS spoofing attacks, the possibility that the operator itself or a compromised router exports all traffic, and metadata capture: even when everything is encrypted, connection profiling enables industrial espionage and the tracking of executives. That is why public WiFi security for business requires understanding the vector first, before discussing tools.
| Risk | How it is executed | Impact on the business |
|---|---|---|
| Evil Twin | SSID cloning with a stronger signal | Impersonation of the legitimate network |
| Fake captive portal | Access page that asks for credentials or a certificate | Theft of corporate credentials |
| ARP/DNS spoofing | Poisoning of ARP tables and DNS responses | Traffic interception and redirection |
| Compromised router | Operator or modified firmware exporting traffic | Capture of communications without presence on the network |
| Metadata capture | Profiling of connections and services used | Industrial espionage and tracking |
Fig. 1 – Main public WiFi risks and their impact on the business.
3. The 6 Rules to Keep Your Data Safe on the Move
Chapter 11 of the book structures the defense in five fronts, synthesized here into six operational rules. They are policy rules and technology rules at the same time: without the former, the latter is never applied; without the latter, the former is just a piece of paper. Management approves the rules, but it is the IT team or the SOC that must guarantee they are enforced automatically.
3.1. VPN or ZTNA Always On
The first rule is that access to email and internal tools from a third-party network should only happen through a corporate VPN or a ZTNA agent, with transparent activation. The phrase “always on” is not rhetoric: if activation depends on the user, there are entire weeks in which it never happens. That is why configuration is enforced through MDM (Intune, Jamf, Workspace ONE or Kandji) with Always-On VPN profiles, or with ZTNA agents such as Zscaler ZIA/ZPA, Netskope or Cisco Secure Connect, which activate the broker as soon as they detect an untrusted network. The additional advantage of ZTNA is that it does not expose the whole corporate network, only the resources authorized for each user: if the device ends up compromised, the blast radius stays limited.
3.2. Mobile Data as the Preferred Alternative
For sensitive operations, the preferred network is not the hotel WiFi: it is mobile data. Payments, irreversible approvals, contract signatures or access to financial applications should be done over the operator’s data plan, which offers a path that is far harder to intercept than a shared network with dozens of strangers. The policy must say it explicitly: if the task is sensitive and there is coverage, there is no excuse to use third-party WiFi. This habit is cheap, universal and removes the attacker’s most lucrative scenario.
3.3. Device Hardening for Mobility
The device that connects to a third-party network must arrive hardened. The corporate policy requires: firewall with the “public network” profile, SMB, AirDrop and file sharing disabled, automatic screen lock in 1-2 minutes with a long PIN or biometrics, full disk encryption (BitLocker, FileVault or LUKS) and up-to-date patches with active EDR. A device without these settings turns every connection into a possible entry point into the workstation and, from there, into the rest of the infrastructure.
3.4. Forget Networks and Disable Auto-Join
The device should only reconnect automatically to trusted networks. That implies two concrete habits: disabling auto-join to open networks and tapping “forget this network” when leaving each hotspot, except for the ones marked as trusted. It is the only control that prevents the device from joining an Evil Twin on its own when it replicates the SSID of a hotel visited last week, without the employee even looking at the screen.
3.5. A Ban on Manual Certificates
No captive portal, not even that of a well-known hotel chain, should ask you to install a “network certificate” or a “connection profile”: if it does, it is a fake captive portal. The rule extends to TLS certificate warnings: accepting a browser warning when entering corporate email is handing the session to the attacker. Nor should sensitive work be done on airplane WiFi, where the operator controls the infrastructure and there is no mobile data alternative. These prohibitions are included in the written policy and reinforced in every training session.
3.6. Awareness Training with Real Scenarios
Training must present the four scenarios that chapter 11 considers typical, with concrete questions: are “Hotel_Marriot_Free” and “MarriotGuest” the same network? The answer is no, and the SSID is not verifiable. Is a captive portal that installs a certificate legitimate? Never. Is a TLS warning when entering email ignored or dismissed? It is dismissed and reported. Should you sign a banking document at a coworking space? Only over mobile data. The goal is for the employee to recognize the pattern before it becomes an incident.
4. Checklist Before Connecting to a Third-Party Network
The following checklist condenses the six rules into a verifiable list that the IT team can print, distribute and include in onboarding training. Every time an employee ticks all ten points, the probability of falling into an Evil Twin or a fake captive portal drops dramatically.
Public WiFi checklist - public WiFi security for business
[ ] Always-On VPN or ZTNA agent active and verified
[ ] Auto-join to open networks disabled
[ ] SSID verified by the employee before connecting
[ ] Automatic screen lock in 1-2 minutes
[ ] SMB, AirDrop and file sharing disabled
[ ] Encrypted disk and EDR operational
[ ] Mobile data for sensitive operations
[ ] No certificates or profiles installed from the network
[ ] No TLS warnings accepted under any condition
[ ] "Forget this network" when disconnecting
Fig. 2 – Operational checklist for a secure connection to public WiFi.
5. Signs of Compromise and Immediate Response
Detecting an attack on mobility requires watching three signals. The first is certificate warnings on regular services: a browser that never fails and starts showing TLS errors when entering corporate email is probably facing an interception proxy. The second is strange device behavior: redirects, unexpected authentication prompts or pages that change appearance. The third is the cloud provider alert: a sign-in from an unusual geography or ASN in Entra ID or Google Workspace must trigger an immediate review.
If compromise is suspected, the immediate actions are: disconnect from the WiFi and switch to mobile data, contact the IT team or the SOC, do not perform sensitive operations until the review is complete, change the credentials of the services accessed and revoke active sessions in Entra ID or Google Workspace. If the anomalous behavior persists, escalate to forensics with device preservation and evaluate notification under GDPR and NIS2. At Jaymon Security we cover these cases in detail in how credentials are stolen with SSLStrip and MITM tools and in how to secure devices against possible espionage.
6. Conclusion
Public WiFi security for business is not an unsolvable technical problem: it is a problem of operational discipline. Six rules — VPN or ZTNA always on, mobile data for sensitive work, device hardening, forgetting networks, zero manual certificates and awareness training with real scenarios — dramatically reduce the mobile worker’s attack surface. None of them is expensive; all of them are ignored every day in hotels, airports and coworking spaces.
The consultant who connects to 10-15 third-party networks a month is the highest-risk employee and, at the same time, the one who can teach the rest of the organization the most. If your team works on the move with clear rules and technology that enforces them — Always-On VPN through MDM, ZTNA agents and hardened devices — the Evil Twin, the fake captive portal and the compromised router stop being threats. They become background noise.
Need help with Public WiFi security for business?
At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.
Contact us for a free infrastructure assessment.
