4 in 10 organizations believe that C-level executives, including the CEO, are most at risk of being hacked when working outside of the office, according to a new study by iPass. Cafes and coffee shops were ranked the number one high-risk venue by 42% of respondents, from a list also including airports (30%), hotels (16%), exhibition centres (7%) and airplanes (4%).

Compiling the responses of 500 organizations from the US, UK, Germany and France, the annual iPass Mobile Security Report provides an overview of how companies are dealing with the trade-off between security and the need to enable a mobile workforce. Indeed, the vast majority (93%) of respondents said they were concerned about the security challenges posed by a growing mobile workforce. Almost half (47%) said they were ‘very’ concerned, up from 36% in 2016. Furthermore, more than two thirds of organizations (68%) have chosen to ban employee use of free public Wi-Fi hotspots to some degree (compared to 62% in 2016), while 33% of organizations ban employee use at all times, up from 22% in 2016.

“The grim reality is that C-level executives are by far at the greatest risk of being hacked outside of the office. They are not your typical 9-5 office worker. They often work long hours, are rarely confined to the office, and have unrestricted access to the most sensitive company data imaginable. They represent a dangerous combination of being both highly valuable and highly available, therefore a prime target for any hacker,” said Raghu Konka, vice president of engineering at iPass. “Cafes and coffee shops are everywhere and offer both convenience and comfort for mobile workers, who flock to these venues for the free high speed internet as much as for the the coffee. However, cafes invariably have lax security standards, meaning that anyone using these networks will be potentially vulnerable.”

Man-in-the-middle attacks, whereby an attacker can secretly relay and even alter communications without the mobile user knowing, were identified by 69% of organizations as being of concern when their employees use public Wi-Fi. However, more than half of respondents also chose a lack of encryption (63%), unpatched operating systems (55%), and hotspot spoofing (58%) as chief concerns.

The dangers that using public Wi-Fi creates was an issue raised in the Business Continuity Institute’s cyber security report, published during Business Continuity Awareness Week, which also highlighted several other areas in which users can leave their organizations vulnerable to a cyber attack.

Some of the other findings of the iPass report and regional trends include:

• The US (98%) is most concerned by the increasing number of mobile security challenges – compared to France (88%), Germany (89%) and the UK (92%)
• Nearly one in ten UK organizations (8%) said that they have no security concerns when employees use public Wi-Fi hotspots. In contrast, this figure is one percent in the US and Germany, and 2% in France
• Similarly, UK organizations are the least likely to ban the use of public Wi-Fi. 44% said that they have no plans to do so, as opposed to 8% in Germany, 10% in the U.S. and 15% in France
• Worldwide, 75% of enterprises still allow or encourage the use of MiFi devices. In France, however, 29% of businesses have banned them due to security concerns

“Organizations are more aware of the mobile security threat than ever, but they still struggle to find the balance between security and productivity,” continued Konka. “While businesses understand that free public Wi-Fi hotspots can empower employees to do their job and be more productive, they are also fearful of the potential security threat. Man-in-the-middle attacks were identified as the primary threat, but the entire mobile attack surface is getting larger. Organizations must recognize this fact and do their best to ensure that their mobile workers are securely connected.”

“Sadly, in response to this growing threat, the majority of organizations are choosing to ban first and think later. They ignore the fact that, in an increasingly mobile world, there are actually far more opportunities than threats. Rather than give in to security threats and enforce bans that can be detrimental or even unenforceable, businesses must instead ensure that their mobile workers have the tools to get online and work securely at all times.”