Best Practices for Securing Public Wi-Fi Networks in Nairobi

With 1 in 4 public Wi-Fi hotspots in Nairobi remaining unsecured according to IBM Security, cybercriminals are increasingly exploiting unsecured café and public networks to intercept sensitive user information. Here’s how to protect yourself and your network.

For Users: Personal Security Tips

1. Use a Trusted VPN (Non-Negotiable)

• Why: A Virtual Private Network encrypts your entire internet connection, protecting data from interception

• When: Always use VPN when accessing confidential or financial information

• Best VPNs: Use trusted services like NordVPN, ExpressVPN, or OpenVPN

2. Avoid Sensitive Transactions

• Never do on public Wi-Fi:

  • Banking or financial accounts

  • E-commerce or shopping

  • Official work or accessing corporate resources

• Instead: Use mobile data or secure corporate networks for sensitive tasks

3. Verify Network Authenticity

• Check the exact spelling of the Wi-Fi network before connecting

• Avoid fake networks: Hackers create spoofed networks (e.g., “FreeWiFi_Nairobi” vs. legitimate “CafeWiFi_Nairobi”)

• Only join networks that are:

  • Authentic (official venue name)

  • Encrypted (asks for WPA/WPA2 password)

  • Password-protected

4. Use HTTPS-Only Browsing

• Look for “https:” before the URL (not just “http:”)

• HTTPS uses SSL encryption to protect data between you and the website

• Install browser extensions: Use HTTPS Everywhere or similar privacy-protecting extensions

5. Enable Two-Factor Authentication (MFA)

• Use Duo multi-factor authentication for critical accounts

• Benefit: Even if password is stolen, second factor blocks unauthorized access

• Enable on: Email, banking, social media, work accounts

6. Turn Off File and Printer Sharing

• Disable file sharing on Windows/Mac before connecting

• Prevents: Other users accessing your laptop, smartphone, or printer files

• Settings: Windows → Network & Internet → Sharing options → Turn off all sharing

7. Enable Firewall and Antivirus

• Windows Firewall: Must be enabled to block viruses, worms, and hackers

• Antivirus software: Keep updated (e.g., Bitdefender, Kaspersky, Windows Defender)

• Check: Ensure protection is active before connecting to public Wi-Fi

8. Don’t Stay Permanently Signed In

• Log out after each session: Don’t stay permanently signed into accounts

• Why: Prevents others from accessing your accounts if they borrow your device

• Use: “Don’t save password” option when logging into websites on public Wi-Fi

9. Turn Off Auto-Connect

• Edit Wi-Fi settings: Disable “Connect automatically to available networks”

• Prevents: Device from connecting to malicious hotspots without your knowledge

• Setting: iPhone → Settings → Wi-Fi → Auto-Join → Off for suspicious networks

10. Forget Network After Use

• Disconnect and forget: Remove network from your device’s saved list

• Why: Prevents automatic reconnection in the future

• Setting: Wi-Fi → Network Name → “Forget This Network”

11. Avoid Pop-Ups and Suspicious Links

• Don’t click: Pop-ups or suspicious links while on public Wi-Fi

• Risk: Could steal information or install malware

• Install: Ad-blocker browser extension to block malicious ads

12. Limit Usage to Public Domain

• Safe activities: News websites, public information

• Avoid: Online forms requiring personal details, social media, email login

• Ringfence privacy: Restrict social media to home/mobile connections only

For Businesses: Securing Your Public Wi-Fi Network

1. Use WPA3 or WPA2 Encryption

• Set router security: WPA3 (best) or WPA2 (minimum)

• Never use: WEP (obsolete, easily cracked) or “No encryption”

• Password: Require strong password (12+ characters, mix of letters/numbers/symbols)

2. Implement Network Segmentation (VLANs)

• Create separate VLANs: Guest traffic isolated from internal network

• Benefit: Hackers on guest WiFi can’t access your servers or customer data

• Setup: TP-Link Omada, Ubiquiti, or Cisco Meraki support VLANs

3. Enable Client Isolation

• Prevent: Guest devices from accessing other guest devices

• Setting: Enable “AP isolation” or “Client isolation” in router

• Why: Stops malware spreading between users on same network

4. Use Captive Portal with Authentication

• Require login: Email, SMS, or social login before internet access

• Benefits:

  • Track user engagement

  • Collect demographic data

  • Prevent unauthorized access

• Add: Terms & Conditions for GDPR compliance

5. Set Content Filtering

• Block: Malware sites, adult content, illegal streaming

• Protects: Your IP reputation and prevents bandwidth waste

• Tools: TP-Link Omada, Ubiquiti, or cloud-based filtering services

6. Configure Bandwidth Limits Per User

• Set cap: 5–10 Mbps per user to prevent network abuse

• Prevents: One user downloading entire Netflix library, slowing everyone

• Router setting: Maximum bandwidth per client

7. Set Time Limits

• Session duration: 1–4 hours, auto-disconnect after limit

• Why: Prevents long-term unauthorized access

• Extend: Offer premium unlimited access for paid customers

8. Monitor Network Activity

• Analytics dashboard: Track login count, session duration, user demographics

• Detect anomalies: Unusual traffic spikes, multiple failed login attempts

• Tools: Cloud-based platforms (GoZone, Ubiquiti Cloud) provide real-time monitoring

9. Keep Firmware Updated

• Update router firmware: Regularly check for security patches

• Why: Prevents hackers from exploiting known vulnerabilities

• Setting: Auto-update in router admin dashboard

10. Use HTTPS for Captive Portal

• Portal must be HTTPS: Ensure login page uses SSL encryption

• Benefit: Protects user credentials during login

• Setup: Most modern routers support HTTPS portals by default

Nairobi-Specific Threats to Watch

Common Cyberattacks in Nairobi

Quick Security Checklist for Nairobi Users

✅ Use VPN for any confidential/financial access
✅ Avoid banking/shopping on public hotspots
✅ Default to mobile data for sensitive tasks
✅ Verify network is authentic, encrypted, password-protected
✅ Check for “https:” before entering personal info
✅ Enable 2-factor authentication on critical accounts
✅ Turn off file sharing before connecting
✅ Enable firewall + antivirus
✅ Don’t auto-connect to networks
✅ Forget network after use

Bottom line: Public networks are convenient but inherently risky. Protecting your data isn’t optional—it’s your first line of defense against cyber threats. Stay cautious, stay secure.