December 17, 2015 By David Strom 3 min read

When you travel with your digital devices, you need to be aware that your data can be compromised, even if you aren’t going to a high-risk country. Keeping a high travel security profile means you have to be constantly vigilant and understand the places and circumstances where you will be most at risk.

Here are some specific strategies you can use to protect yourself no matter where in the world you are.

Travel Security Best Practices

Switch Your Laptop

Instead of bringing your usual work laptop, consider using a burner or stripped-down laptop that doesn’t have any user information on it, or possibly a Chromebook or some other device that has a limited attack surface. Other ideal options include some type of sterile device such as throwaway mobile phones, especially if you’re heading to high-risk locations.

If you must bring your laptop, limit the amount of corporate and personal, confidential information that will be on its hard drive. Clear your cookies and disable the auto-login features of your browser. Delete any software that isn’t going to be used for your trip. If you use a cloud-based file-sharing service, make sure that your connections are over SSL. You can even take this one step further by encrypting your files on the cloud service, too.

Don’t forget to bring a cable lock to physically secure the computer, as well. Better yet, don’t leave it alone in your hotel room at all. And don’t forget to disinfect any equipment when you return home.

Don’t Bring Your Phone

If you do bring your phone when traveling abroad, keep it turned off. Consider purchasing prepaid SIM cards or temporary phones when you arrive to the destination country. Your IT department should consider having a supply of travel-ready phones for this purpose. This will likely also save costs since many international cell plans are quite expensive, and local phone plans in many countries include free calls to the U.S.

Anticipate Your Authentication Woes

If you’ve enabled two-factor or multifactor authentication for your key application services, review what you have done. If these services send your phone a one-time password as a text message, you will have to make other arrangements since your phone won’t be operating on your home network when you travel. This happened to me when I went abroad, and I couldn’t log into my accounts without a lot of work.

Think About Security Before Reaching Your Destination

There are two aspects at play here: your network security and your surroundings. For the former, consider establishing programs such as full-disk encryption for your hard drive, using some form of mobile device management (MDM) software and using a virtual private network (VPN).

But it is also important that you remain aware of where you are and what you are discussing, either on the phone or in person. I almost never work on planes because they are so crowded that it’s easy for someone to snoop on what I have open on my screen (not to mention that with the shorter seat pitch, you barely have enough room to type). Yes, there are laptop filters that can limit the viewing angle of your screen, but your seatmate or person sitting behind you can still see something.

Don’t Use Any Wi-Fi Networks

Hotel Wi-Fi is probably not secure. If possible, avoid using any public network, including those at local Internet cafes. Limit your data connections to wired and trusted networks whenever possible. Don’t download anything to your laptop, even if it looks benign — it probably isn’t. If you need a connection, tether your laptop to your mobile phone and use the broadband phone data network.

Always Remain Alert

There are a few other measures you can take to keep your data, possessions and person secure. For example, don’t trust any USB thumb drives. Blindly using these devices is an easy way to get infected.

You should also pay careful attention to how and when you use a VPN. Some business users inadvertently download malware before they bring up their VPN software, which could compromise these networks.

Paranoia is key. Be aware of what you are doing at all times and you will be able to travel more securely.

More from Advanced Threats

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

16 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant also specifically targets over 1500 global banks, enabling attackers to perform banking fraud in over 60 countries…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today