All Articles

An executive itinerary is more than just a piece of information that includes a departure and arrival. It could show you where to meet, which businesses you need to deal with, where you will stay while you are there and when senior decision makers are not available.

This can be sensitive information when used along with corporate calendars, email accounts or public announcements.

Attackers don't have to be on the inside of an organization's network. If a travel agency account is compromised, or a hotel employee impersonates himself as an employee of the hotel, or a booking is sent as a notification from a hotel, enough information may be present to set up a credible request.

The FBI's business email compromise advice includes all financial instructions and changes to account information to be verified independently. This not only applies to travel expenses, but also to any changes to travel plans.

Use the Booking Process Before Departure to make reservations.

Security starts the moment a booking is made and not at the airport.

CPCs need to set up approved travelling channels, check service providers and write down how to communicate properly with the legitimate changes.

Verify the Specialized Travel Providers and Payment Requests.

Sometimes business trips are not limited to business trips on the business jet and a normal hotel. Business travellers who attend international conferences, go to outlying sites or arrange private flights may require specialist air travel services.

Aero Connect Nepal, for instance, offers helicopter trips, chartered flights and shared flights to the Himalayan areas of Nepal. These should be good examples of the need for travel coordinators to verify passenger information, departure locations, flight changes and payments with specific operators.

The security problem is the trust to trust in the communication channel.

It will be the coordinator's responsibility to ensure that it is the operator's official domain and that the contact information is established by the operator themself before making a payment. If the account is moved to another by the account holder, there should be further approval for this event.

Not enough evidence to prove authenticity if it has a company logo or name similar to the one you are looking for.

Reduce the sharing of Passenger Information.

It is reasonable to request the identification, contact numbers and other information about the passengers if you have to travel arrangements.

But it's not desirable for a full executive profile to be bounced through all corresponding emails or messaging groups throughout the process.

Limited information sharing among travel teams to provide the functions of each member. Where appropriate, there should be expectations of retention and deletion of the passport copy and other sensitive documents passed through approved channels.

The need for administration convenience is not enough to justify the making of multiple uncontrolled copies.

Take care of Itineraries as Sensitive Business Information.

Even if confidential projects are not mentioned in an itinerary, it could show commercial priorities.

If a senior executive visits a potential acquisition target, for example, then his or her plans and timing of the visit can reveal the strategy and intentions.

Limit access to Calendar and to documents.

Don't show the travel calendar to everyone.

Complete itineraries may be needed for administrative assistants, security staff, and/or designated coordinators. Others might not need to be told that the senior is out.

Don't put passport photos, personal information, or complete hotel bookings in public calendars.

Security staff should also check third-party travel apps that make requests to access corporate email or calendars. Permissions should be consistent with the legitimate operational needs.

Defend Travel Messages from Spoofing

Disruptions at the last minute put pressure on making hasty decisions. Messages may sound normal if the flight is delayed, pick-up points change, and the phone numbers are unknown.

There must also be a reliable verification procedure that performs when the traveller is tired, disconnected or under time pressure.

Set up a Verified Callback Procedure.

The travel coordinator should take the verified contact information and the operator's emergency contact number.The travel coordinator should note the operator's verified contact information and the emergency contact for the company prior to departure.

If a call is made to the individual asking for a large amount of money change or confidential information, then the staff member should make a second call using the previously verified information.

This defeats the purpose by calling the number that is included in the suspicious message.

Ask an approved employee out of the original thread of the message for approval if you need to change the payment. Raising the alarm to watch should be the opposite of what it is.

Minimize Miscommunication in Voice Communication.

Arrangements for traveling internationally can include names and locations you've never heard before and reference codes for reservations. Call to call errors can be caused by language barriers and poor connections.

This can be minimised by having clear phonetic communication.

Tools, like the Phonetic Spelling Generator, provide examples of how words can be spelt using NATO phonetic alphabet and pronunciation guides. These conventions can be used with travel teams for practice in naming and stating locations and reference examples that are not sensitive.

Don't submit sensitive booking identifiers or personal information to public tools that are not approved. Phonetic spelling also makes it easier to understand the spelling, rather than to ensure identity, which requires authentication by known means.

A Practical Executive Travel Security Framework is a guide to developing and executing travel security plans for business travelers.

A good travel security programme can take place in five stages:

• Prior to booking: Check approved travel providers, payment options and who they accept as a contact.
• Before leaving: Check the sensitivity, device setting, access control and emergency contacts of the itinerary.
• When travelling: Communicate using the designated channels, safeguard documents and confirm requests independently.
• Upon an incident: Trigger procedures, shut down affected accounts and communicate with appropriate providers.

Once back: Discuss security alerts, discard temporary access cards, and delete unnecessary travel documents, along with lessons learned.

These measures are to be suitable to the distance travelled. The rules of a routine domestic conference are not as stringent as those for travel for sensitive negotiations or high-risk areas.

Conclusion

Transporting laptops in airports isn't the only part of travel security. It includes protecting the connections, identities, payment process and business information included in an itinerary.

There are several steps CISOs can take to minimize exposure including verification of bookings, avoiding unnecessary data sharing, enhancing communication protocols and training staff on unforeseen changes.

The best travel security program is the one that is easily followed when plans change - and doesn't force an executive to make the decision between making the trip or following the security program.