By Nuno Gonçalves, Head of CSIRT, the cybersecurity service of FCT, operated by FCCN
Travel expands our horizons, but it also rapidly expands our digital attack surface. Picture a standard travel scenario: settling in for a 3.5-hour bus ride for a meeting. You might pull out a tablet to read or open a computer to catch up on a few tasks before arriving. The moment a device leaves your bag in a public space, the rules of engagement change.
When we travel, convenience often overshadows caution. However, keeping your data secure does not require a paranoia-driven lockdown, it simply requires adopting a few practical habits to protect your hardware, your connections and your data.
The physical reality of device security
The most common cybersecurity incident on the road is not a sophisticated hack, it is a stolen or lost device.
- Enable full-disk encryption: Before leaving home, ensure your devices have native encryption enabled (like FileVault on macOS or BitLocker on Windows for instance). Encryption scrambles your hard drive’s data into unreadable If a laptop is swiped from a cafe table, the thief gets the hardware, but your files and data remain securely locked away.
- Lock remote access apps: If you manage infrastructure remotely, the apps you use are gateways to critical systems. When possible, it is desirable to configure the usage of a two-factor authentication, a code or a biometric authentication (such as Face ID or Touch ID).
Navigating the public Wi-Fi minefield
Airport lounges, cafes, hotels, restaurants and public transport networks offer free Wi-Fi, but these open networks are inherently hostile environments where anyone can “listen” to the traffic passing through the air.
- Beware of evil twins: Attackers easily create fake Wi-Fi hotspots with legitimate-sounding names (like “Free_Airport_WiFi”). Connecting to these allows them to intercept your unencrypted data in a “Man-in-the-Middle”
- Use a VPN (Virtual Private Network): Using a VPN as an absolute necessity. It creates a secure, encrypted tunnel between your device and the internet, blinding anyone trying to snoop on your local network.
- Forget auto-join: Disable the setting that allows your phone or laptop to automatically connect to known open networks to prevent silent, background connections to malicious access points.
Managing credentials on the move
Accessing different accounts while traveling means typing in passwords in unpredictable environments. Relying on cloud-based browser autofill can sometimes leave sessions exposed if a device is compromised.
- Keep vaults local and synced: Use offline password managers to maintain control of your cryptographic keys. A setup combining a software vault like KeePassXC on a computer and a client like KeePassium on a mobile device, synced securely via a personal cloud drive, ensures you have complex passwords at your fingertips without exposing the master database to third-party web services.
- Beware of juice jacking: Public USB charging stations can secretly transfer data while providing power. Always plug your actual AC power adapter directly into a standard wall outlet or use a data blocker, a small adapter that blocks data pins and only lets electricity flow.
- Watch out for “Quishing” (QR Code Phishing): In many restaurants, cafes or tourist areas, physical menus have been replaced by QR codes. Attackers frequently print malicious QR code stickers and paste them directly over the legitimate ones on restaurant tables, transit stops, or parking meters. When you scan the fake code, you are directed to a perfectly cloned website designed to steal your credit card details or harvest your credentials. Always run your finger over a public QR code to check for overlapping stickers. Use your smartphone’s default camera app to scan it and it will preview the URL before opening it and verify if the web address looks genuine before entering any sensitive information.
By taking these few precautions, you can focus on the journey ahead, knowing your digital footprint is more securely packed.
About the author
With over two decades of experience at the Portuguese National Research and Education Network, Nuno previously managed corporate IT services, network security, and a large-scale national VoIP project at FCCN. He holds a degree in Computer Science from the University of Lisbon and a Postgraduate Diploma in Project Management from the Catholic University of Portugal.
