Teams on the move: securing laptops, phones and public Wi-Fi

It is not the hotel Wi-Fi. It is a lost or stolen device without encryption and an email account without a second factor. Away from the office there is no firewall, no known network and no physical control over the devices; laptops and phones pass through taxis, departure lounges, hotel rooms and X-ray machines.

Then there is attention. On a business trip or on holiday, people read messages in a hurry, between a check-in and a queue. According to CNCS data, around half of the 3,864 incidents recorded by CERT.PT in 2025 exploited failures linked to human behaviour, and phishing, by email, SMS or social media, was the dominant method.

Ten minutes per device is enough. This is the checklist we apply to the fleets we manage:

• Encryption switched on BitLocker on Windows or FileVault on Mac, with the recovery key held by the company. Even if the disk is removed, the data remains unreadable.
• Central management The device must be enrolled in the company's management platform so that it can be located, locked or wiped remotely.
• Updates applied Operating system, browser and antivirus patched before the device leaves the protected network.
• MFA On email and critical applications, so that a password captured along the way does not open the door.
• VPN tested Installed and tried out at the office. Finding the fault at the hotel is too late.
• Files in the company cloud Nothing important stored only on the laptop desktop.
• Automatic screen lock A few minutes of inactivity is enough; a laptop left open on a café terrace is unprotected.
• Support contact on the phone Whoever loses a device must know whom to call in the first minute.

For decision-makers: encrypting the disk is like locking the laptop's contents in a safe that only opens with the user's password. Anyone who steals the device and connects the disk to another computer sees only meaningless data. BitLocker and FileVault are already part of the operating system; they simply need to be switched on and the key stored somewhere safe.

Public networks: safer than ten years ago, but not yours

Most websites and services now encrypt the connection, that is the padlock in the address bar. The FTC, the US consumer protection agency, acknowledges that this has reduced the risk of public networks, but stresses that encryption does not protect against a fake site: the data arrives safely in the fraudster's hands. Three concrete threats remain:

• Decoy networks Access points named after the hotel or airport, set up to capture connections.
• Abusive captive portals Pages that ask for personal data, social media credentials or the installation of a “certificate”.
• Exposed shares Laptop folders and printers visible to other users on the same network.

In practice: confirm the exact network name at reception, refuse any installation requested to grant access and switch on the company VPN immediately. The current role of the VPN is explained in why a VPN on its own is no longer enough.

Mobile hotspot: often the safest choice

Connecting the laptop to the phone removes the third-party network altogether. In the European Union, and also in Iceland, Liechtenstein and Norway, EU roaming rules put calls, SMS and data at the same price as at home; for data, the operator may still apply fair-use limits. Outside this area prices can soar, and it pays to buy a bundle before departure.

Charging the phone from public USB ports

The subject generates plenty of warnings. The FCC, the US communications regulator, says it is not aware of confirmed cases, but recommends the simple solution: your own charger plugged into the wall socket or a power bank, and the “charge only” option whenever the phone asks.

The whole team should know the procedure before anyone travels:

1. Call support immediately: with the user's name and the approximate time of the loss.
2. Lock or wipe remotely: on a managed device, the IT team resets the laptop to factory settings remotely; in Intune, Microsoft provides this reset for Windows, macOS, iOS and Android. On a Mac with FileVault, deleting the encryption key makes the disk unreadable instantly.
3. Revoke sessions: end active sessions, change the Microsoft 365 or Google account password and review the associated MFA methods.
4. Report the theft or loss to the local authorities and keep the receipt.
5. Assess the exposure of personal data: with encryption on, the risk is far lower, and that weighs in the assessment the company has to carry out.

Without encryption and central management, none of these steps offers any guarantee. That is why preparation happens at the office. For Apple teams, see how to manage and protect a Mac fleet; for accounts, how to roll out MFA without friction.

Tourist entertainment, alternative transport and technology: that is the business of Boost Portugal, present in Lisbon, Porto, the Douro and Madrid. Under an IT Unlimited contract, DataRoad provides ongoing user support, backups, internet redundancy, remote monitoring with alerts and management of the remote desktop environment and the VPN. This is what allows a team spread across several cities to work with the same level of protection as at the office. The full case is in Boost Portugal: Unlimited monitoring and support.

DataRoad's mobility and remote working solutions combine encryption, device management, VPN and MFA. Because losses often happen at weekends, IT Unlimited Premium 365 extends support to nights, weekends and public holidays.

DataRoad - IT Services and Consulting checks encryption, remote management, MFA, VPN and updates on every company laptop and phone, and hands over a ready-to-use loss procedure. In 11 years, DataRoad has never suffered a security incident.

Request a no-commitment proposal: +351 211 459 950 * · sales@dataroad.pt. More than 10 workstations · support contract · remote, on-site and telephone support.

*Call to a Portuguese landline.

• Microsoft Learn: BitLocker overview
• Apple: volume encryption with FileVault
• Microsoft Learn: wiping devices in Intune
• Your Europe portal: EU roaming rules
• FTC: public Wi-Fi network safety
• FCC: tips on “juice jacking”
• Lusa / DNoticias: incidents recorded by CNCS in 2025