Is your laptop telling secrets? In a WiFi world, logging into your computer on the road is risky business.

Every day, at conventions or in hotel rooms, your company's executives routinely open their laptops, log on and check their email. They assume if no one is looking, or their room door is locked, the information on their computers' hard drives is secure.

[ILLUSTRATION OMITTED]

IT departments believe that firewalls and virtual private networks (VPNs) are good enough to protect confidential spreadsheets, contracts or customer lists. However, in many hotels and convention centers, someone just down the hall or sitting across the convention room still could penetrate the laptop of one of your executives, steal his email login and password information, and log into your corporation's computer network to steal confidential, market-moving data. When you or your employees use laptops in a public place, you risk unknowingly exposing this confidential hard drive data to prying eyes.

Think about the way we use our computers. We generally save critical information--data that we may need to access at any given time--on our hard drives. Unfortunately, most of us don't put special passwords on every file we save--and therein lies the problem.

Traveling laptop users, pressed for time and eager to get business done, connect to unsecured hotel networks, unprotected airport WiFi systems and unknown networks in offsite meeting rooms to check email and to work. While doing that, they unintentionally expose their hard drives to other, potentially malevolent people on the network if their laptops are not properly protected.

CEOs must be aware of the potential catastrophe their executives could unleash inadvertently by working from the road without effective security safeguards. Imagine the legal liabilities and business risks that could result. In the Sarbanes-Oxley era, you would violate the most basic Section 404 compliance tests. Quarterly earnings reports, proprietary product pricing, product specifications--all can become open secrets.

Recently, a computer publication reported an experiment undertaken by a security expert. She took software, available for free on the Internet, to hotels and other public places. Using this software, she tried to pick up passwords from laptop users around her. She discovered that, on average, she could detect 118 user passwords a night at hotels that used an insecure system to provide high-speed Internet access.

With explosive growth of radio-based networking, such as WiFi, the situation has taken on new urgency. More than 80 percent of newly purchased computers are laptops designed for portability, and nearly 75 percent of all laptops sold are ready-to-use WiFi to communicate to a network. Many coffee shops, airport lounges, waiting rooms and even entire cities now offer wireless connections.

Technology created network insecurity, and it might seem reasonable that technology can solve it as well. But it cannot do so completely. Networks now used by hotels and other mobile locations originally were designed for sharing information among employees within corporate environments. They were never intended to seal off users in hotel rooms or convention centers in isolated, one-on-one sessions with corporate computers. Hence, from the beginning, security vulnerability was built into commonly used networks, and this cannot be removed easily when they are used in public places.

There are ways to determine when one is working in an unsafe environment. There are tools available that can alert a user when a network is open to prying eyes, but travelers should generally assume they are at risk whenever they enter a new environment. Although many hotels, convention centers and off-site-meeting locations offer a secure network built specifically to protect travelers, most do not. And the vast majority of public-access WiFi is not secure.

There are three common-sense things a corporation can and should do to cut down on the risk of data theft from laptops:

* Ensure that no laptop leaves the organization without proper protection. IT departments should turn off file-sharing and peer-to-peer communications, install a firewall and close vulnerable ports into the computer.

* Train employees who work on the road about the dangers of networked computing in hostile environments. Training should be renewed at least once a year, because network environments change constantly and new viruses and methods of intrusion appear regularly. Road warriors also should understand that safeguarding corporate data can protect them from personal identity theft.

* Require traveling employees to seek safe and secure lodging and work environments whenever possible. This requires the IT department to work with the travel department to determine locations where network security is in place and to steer employees to these locations whenever possible. This step has the dual effect of enhancing employee safety while pressuring hospitality vendors to secure their networks in order not to lose business.

These three critical steps cost little but do require time and attention. CEOs can ask whether time spent on securing corporate secrets is worth the reduction in risk to their companies. The answer is obvious. In the past year, hackers stole hundreds of thousands of customer names and sensitive personal data from the databases of several major U.S. corporations. The embarrassment, loss of reputation, and apologies to customers and lawsuits were substantial. Why would any CEO want to put a company through that?

David W. Garrison is president and CEO of iBAHN, a leading provider of wired and wireless broadband services for the hospitality industry.