Danger lurks quietly in the airport. It floats silently in the air at many coffee shops. Even entire cities have become hazards for the unwary.

This is the new world of security threats, a world created by an ever-increasing implementation of public wireless networks. For many traveling corporate executives, laptops, cell phones and BlackBerries are an indispensable part of their jobs, and therefore exposure to security breaches and information theft has never been more prevalent. And it is only going to get worse.

Take for example the “evil twin” phenomenon. First reported a year ago, this novel hacking approach has the potential to steal sensitive information from dozens of users at once. Hackers create a wireless access point in the middle of an airport or a coffee shop. They give the point an innocuous name such as Caf?? 1/2 Hotspot. Then, they wait. Users unknowingly log onto the shadow network, allowing the hackers to access their laptops. From here hackers can tap into a company's private network, potentially stealing everything from trade secrets to customer credit card information.

“Laptops are a huge security risk,” says Joel Smith, chief technology officer of AppRiver, a Florida-based company specializing in technology security solutions. “There is always the scenario of the man in the middle who can sit there and watch the packets.”

With the prevalence of public hotspots, wireless office tools and organized hacking circles, companies need to take a hard look at how employees are using wireless gadgets. The consequences of not doing so can be staggering.

“Many companies say they protect all their wireless access points and have everything firewalled,” says Ross Kodner, president of MicroLaw Inc., a firm that specializes in legal technology consulting. “That doesn't do any good if you are sending people out with laptops that are connecting from an unsecured hotspot.”

Wireless World

Wireless hardware is fast changing from an amenity to a necessity in the corporate world. According to Business Communications Review, North American businesses purchased more than 16 million Wi-Fi equipped laptops in 2003.

These laptops aren't just being used in the office. According to Gartner Group, a technology research firm, 4.5 million people will regularly use public hotspots next year. As the usage grows, so do the security risks.

“Employees who have access to company laptops need to abide by certain personnel procedures,” says Steve Wu, a partner at Cooke Kobrick & Wu. “For example, they may allow someone to audit what they do at home.”

Even if employers keep tabs on employees' laptop usage, they may not be able to catch a hacker in the act. This is because hackers can break into a network under the guise of the employee.

“If somebody exploits the unsecure connection, they effectively become the laptop user and can enter right through onto the corporate network,” Kodner says. “And worse, if they do something insidious, it looks like the employee did it.”

But it's not only outside the office that laptops create security holes. Bringing a laptop onto a corporation's premises creates vulnerable access points.

“Bringing in a completely unsecure wireless access point and plugging it into the secure corporate network is like putting a 30-foot lit neon sign on top of the corporate headquarters saying, 'Confidential information available here for free. Come and get it,'” Kodner says.

And it's not just laptops that pose a threat. Cell phones and other wireless devices create similar exposures. This came to light after hackers accessed Paris Hilton's T-Mobile Sidekick and posted its contents online. Bluetooth technology, which comes standard with most new wireless devices, creates additional inroads for hackers as well.

“Even with secured wireless connections, they forget that there is Bluetooth that is sitting wide open,” Kodner says.

Costly Breaches

Kodner's words ring true. With recent reports of security breaches at big-name companies such as LexisNexis and Bank of America, it seems that any company is susceptible. But what's worse than the actual hacking are the legal consequences of not stopping the hackers.

Retail giant Designer Shoe Warehouse (DSW) is learning this the hard way. In late 2004 and early 2005, war drivers, hackers who cruise in cars looking for open access points, tapped into a DSW store in Dadeland, Fla. Over a four-month period, they stole more than a million consumers' credit information from the company's network.

No consumers have stepped forward to file class actions against DSW. However, many consumers may not even know their information was stolen. DSW has been slow to inform consumers about the break-in–so slow in fact that the state of Ohio is suing DSW to force it to expedite the process.

“There are grounds for negligence claims,” Wu says. “Also, if a company claims to have policies to protect customer information and they fail to take care of that information, then there may be an unfair trade practices claim.”

But besides litigious consumers, companies have to worry about legislation as well. A bill proposed by Andy Spano, county executive of Westchester County, N.Y., would force companies to establish security procedures, including a firewall, on their wireless networks.

“We want to bring public awareness that businesses need to protect data they are capturing,” says Andrew Neuman, senior assistant to Spano. “Clearly this isn't the silver bullet to eliminate the problem. But we want to send a wake-up call.”

Although the so-called wakeup call consists of a measly fine of $250 to $500, if passed, the bill may encourage other jurisdictions to pass similar legislation and may eventually lead to national regulations of wireless networks.

Educating The Uneducated

Aside from litigation and new laws, the old standby compliance issues under HIPAA and SOX also demand attention. If a hacker steals corporate HR records or tampers with financial data, the targeted company could face hefty fines. For example, if hackers tapped into a company's network and made employee health-related information public, a company could potentially face a fine of $25,000 per incident. For large companies with hundreds of employees, such sanctions could be crippling.

“If adequate security precautions aren't taken to protect health care information, there is certainly significant exposure of the company to HIPAA suits,” Kodner says. “Also, allowing corporate records to be subject to data poisoning or alteration could be peripherally violative of the spirit of SOX.”

Education is a company's main line of defense from break-ins. In the hands of the ignorant, wireless hardware is a wide-open portal begging for hackers to enter. If a company fails to educate employees or understand its liabilities, it will find that cyberspace is a dangerous, untrustworthy universe.

“These are not issues that are so geeky that you could never understand them if you didn't own a pocket protector,” Kodner says. “There is no excuse for companies to be ignorant of these issues.”?