Just when you thought it was safe to plug back into Wi-Fi. Particularly the free kind.
An uptick of data breaches in the news (Pizza Hut and Uber? Really?) has created a sense of unease when it comes to people’s willingness to provide their personal information electronically. And with the overwhelming percentage of events using an online registration and payment portal, event owners are well served to take extra steps to keep data secure.
We got our first glimpse of the concern over information security when the U.K. enacted its General Data Protection Regulation (GDPR) in May. It resulted in a number of companies – both internationally and right here in the U.S. – sending out notices explaining "We care about your privacy" and discussing the way your computer records are being handled. One example follows:
GDPR COMPLIANCE: If you do not want to continue to receive press releases about (subject), please unsubscribe using the link below, and you will be removed from our mailing lists. You can also reply "unsubscribe" to this message, and we will take care of it.
Now, Forbes has noted that it’s easier than ever to have your data compromised by doing something just about every event owner does – plugging into an airport Wi-Fi hotspot while waiting for a flight.
If you’ve never thought about the airport as a potential site for mining information, consider this: plenty of travelers who are in the event business spend a fair amount of their time there. And usually, their computers contain critical information on their events – including participants’ information, which may include personal and financial data. Oh, and they're desperate for connectivity -- enough so that they'll rush through the protocols to get it.
Furthermore, says a recent article in Airport Technology, the problem is far worse than originally imagined:
Cybersecurity is increasingly being identified as a potential danger to airport infrastructure and the welfare of staff, travelers and visitors. Considering the emphasis placed on rigorous physical security procedures in today’s airports, it can come as a shock how unprepared many high-profile airports actually are when it comes to the cyber protection of their own systems and the devices of passengers. Malicious use of unsecured Wi-Fi networks is yet another area where airports may be letting their guard down.
In addition, the article noted, a 2018 report published by security experts Coronet ranked the 45 busiest airports in the US in which passengers were most likely to be subject to a cyberattack. The company identified seven US airports with a threat index score of 6.5 or over, with San Diego International Airport scoring 10.0, the maximum available. But only 10 of the 45 airports scored lower than 5.4, meaning the vast majority of public Wi-Fi systems at airports posed a notable risk to passengers’ devices.
Side note: It’s an excellent, free – and unnerving – report that is worth the download.
Your attendees’ and employees’ information is critically important to keep private, but there are plenty of other things hackers are after, including frequent flyer miles accounts (believe it or not, there is a black market for them on the dark web, according to this article, which also talks about how to safeguard such data).
The Forbes article discusses some of the tactics cybercriminals use to get passengers’ data when they log on, including the creation of spoof airport hotspots:
Many airports will publish their Wi-Fi network names in prominent places like columns, walls, or displays near charging stations. Before you join the first network that appears on the list, read the full name of the hotspot network to make sure it matches the name posted on the official airport Wi-Fi literature.
Identical looking network names are sometimes called "evil twins" because you have to look very closely to make sure you choose the right one. You should look for some of these differences to make help spot one – and as a side note, you’ll need to be on your toes to catch them.
Capitalized words (is it FreeAirportWifi or FreeairportWifi?)
A different number (Airport2 instead of Airport1)
Special or additional characters (i.e. Airport_1 instead of Airport1)
Another clue after you've connected to a network might be if the network has an opt-in page or not to agree to the terms of service. Most airport, hotel, and restaurant Wi-Fi networks require you to enter an email address and agree to the terms and service before you can access the network. If the network doesn't have an opt-in page or the page looks sketchy, it could potentially be a fake hotspot.
The Forbes article additionally notes that some places, such as an airport lounge, offer more secure networks than are found on the general terminal. (Being able to access such places may involve a fee or a frequent flyer account on a specific airline.) Subscribing to a system such as Boingo Wireless may also help, since such networks are encrypted. And visiting only sites with HTTPS encryption is one more way to keep data secure. (In fact, most Internet browsers will flash a warning page if they think you're headed to a dangerous website.)
The article lists a few other steps to take, including using a VPN, disabling print and file sharing capabilities when you travel and installing the latest security updates on mobile devices, laptops and tablets.
Insurance companies that specialize in planned events, such as sports, often offer special coverage for those who want to guard against damages, according to Lorena Hatfield, marketing manager for K&K Instrance:.
Cyber liability insurance does exist; K&K includes it in some, but not all of their program coverage but we really aren’t the experts and don’t offer it as a “stand alone” policy as other insurance companies do."
Having data compromised – and it can happen quickly and without you even knowing it – is a technological and public relations nightmare for any event owner and can have long-term consequences in creating distrust among attendees. In a competitive market, it is more important than ever to keep information secure, and to be able to reassure attendees you have done so as well.
About the Author
