Should organisations allow staff to use public Wi-Fi without extra controls?

Why Public Wi-Fi Needs a Policy, Not a Memory Test

Public Wi-Fi is a hostile trust boundary, not a convenience feature. The practical problem is not just interception, it is that users are repeatedly asked to make security decisions in places where they have little context. A sound policy removes those decisions from memory and puts them into device controls, access rules, and a clear exception process.

That matters because “open” networks vary widely in quality and can expose traffic, captive portals, and user credentials if staff are trained to click through prompts instead of verifying what they are joining. Organisations should assume that any uncontrolled network can create both confidentiality and account-takeover exposure unless traffic is protected and user behaviour is constrained.

What Extra Controls Should Be Mandatory on Public Networks?

At minimum, organisations should treat VPN use as the baseline control for public Wi-Fi access, because it reduces the value of local network exposure and limits what an attacker can observe or manipulate. They should also disable auto-join behaviour so devices do not reconnect to arbitrary networks without a deliberate user action.

Those two controls work best when they are paired with endpoint policy that blocks weak network choices and reduces the chance of accidental trust drift. The goal is not to make public Wi-Fi “safe” in an absolute sense, but to ensure the device maintains a consistent security posture even when the local network is untrusted.

For broader control design, organisations should align this with NIST Cybersecurity Framework 2.0 by treating the public network as an access risk to be governed, protected, and monitored. Strong endpoint control also fits NIST SP 800-207 Zero Trust Architecture when the organisation wants to avoid implicit trust in the transport path.

How Should Staff Be Trained to Reject Fake Login Prompts?

Staff need a simple rule they can apply under pressure: never enter email or social media passwords into a prompt that appears after joining public Wi-Fi, unless it is clearly the organisation’s approved sign-in flow. That instruction works because captive portals and lookalike prompts are designed to collect credentials by exploiting rushed behaviour and weak visual checking.

The better practice is to move the decision into policy and browser or device behaviour so the user is not asked to judge every prompt from scratch. Organisations can reinforce that rule with endpoint restrictions, password manager guidance, and a reporting path for suspicious portals or unexpected authentication requests.

This is consistent with the control logic in CIS Controls v8, which emphasises secure configuration and account protection, and with NIST SP 800-53 Rev 5 Security and Privacy Controls where access control and configuration management reduce avoidable exposure.

Risk and Threat Considerations

Public Wi-Fi introduces two distinct risks: network exposure and prompt-based credential theft. The first is that local traffic and session metadata may be observable or tampered with if the connection is not protected; the second is that fake login pages can harvest passwords, tokens, or personal account access from users who assume the prompt is legitimate.

Failure mechanism: Users connect to an untrusted network, then accept automatic prompts or enter credentials into a counterfeit portal, giving an attacker visibility into traffic or direct access to accounts.

Impact: The result can be account compromise, session theft, lateral exposure into corporate services, and a wider incident if stolen credentials are reused elsewhere.

Practitioner Guidance

What to prioritise: Enforce the controls that reduce user judgement first, VPN by default on public networks, no auto-join, and a device policy that suppresses unnecessary network prompts. If a control depends on the user “doing the right thing” every time, it is too weak for this scenario.

What to verify: Check that the VPN really activates before corporate access is allowed, that auto-connect is disabled on unmanaged networks, and that the organisation has a clear escalation path for suspicious captive portals or password requests.

Practitioner takeaway: Public Wi-Fi should be managed as an untrusted access condition, not a normal workplace convenience, because the real control objective is to make unsafe choices difficult, visible, and policy-driven rather than dependent on user memory.

Related resources from NHI Mgmt Group

• What happens when employees use public Wi-Fi without extra protections?
• What happens when organisations allow public AI tools without data loss prevention controls?
• What happens when organisations use public proxies without strong policy controls?
• How should organisations reduce public Wi-Fi risk for remote workers and travelling staff?