Your laptop and phone are where the sensitive work actually happens — and travel is where the adversary gets them alone. This lesson hardens the device and builds the discipline for taking it into hostile places.
Day 2EndpointTravel
Notes: Connect back: Lesson 04 gave personal baselines; this goes deeper on the device as a battleground and on the specific risks of travel.
Lesson 07 · Slide 2
The endpoint is the prize
It holds your data, your sessions, your keys, and your identity
Compromise the endpoint and encryption in transit no longer helps you
It is the one asset that leaves your controlled environment — daily
So it must be hardened to survive contact with hostile surroundings
The reframe
Don't think "a laptop." Think "a portable copy of everything I can reach, carried through the adversary's territory."
Notes: Sets up why baseline hardening matters and why travel is the sharp end.
Lesson 07 · Slide 3
The hardening baseline
Full-disk encryption — so a seized or stolen device yields nothing
Prompt patching — close the flaws attackers reuse for years
Application allow-listing — only approved software runs
Endpoint detection & response — see and stop malicious behaviour
Least-privilege local accounts — no daily work as administrator
Secure configuration baselines — hardened by standard, unused interfaces off
Notes: Reveal one at a time. Reference recognised configuration baselines (e.g., CIS/DISA categories) without endorsing products. These are capability categories, not brands.
Lesson 07 · Slide 4
The travel threat model
Border seizure & inspection — your device out of your hands, lawfully or not
"Evil maid" — physical tampering while the device is unattended in a room
Hostile networks — hotel, airport, and conference Wi-Fi you do not control
Coercion & shoulder-surfing — pressure to unlock; eyes on your screen
Higher-risk jurisdictions — where the environment itself is the adversary
Notes: Travel strips away your controlled environment. Each item is a place the device is exposed or taken. Sets up the intrusion diagram.
Lesson 07 · Slide 5
How a travel compromise unfolds
A device left alone, on a network you don't control. Press →.
Laptop left in hotel room / joined to hotel Wi-Fi
→
Physical tamper or network attack
→
Implant or captured session installed
→
Quiet data exfiltration after you return home
Notes: Reveal step by step. The kicker is the last node: the damage lands after the trip, when your guard is down. This motivates post-travel quarantine.
Lesson 07 · Slide 6
Which common travel practice creates the most risk?
C. A, B, D, and E are all good practices. Leaving a device that contains everything you can reach unattended in an uncontrolled space hands the adversary exactly what they need: time alone with the prize. The fix is data minimisation (don't carry what you don't need) and custody (don't let it out of your control).
Notes: The distractors are all sensible habits, so the answer stands out: the risk is the unattended, fully-loaded device. Custody + minimisation.
Lesson 07 · Slide 7
Clean devices & data minimisation
Travel clean
For higher-risk trips, carry a loaner or "clean" device holding only what the trip needs — not your whole digital life.
Minimise
The data you don't carry cannot be seized, copied, or coerced out of you. Absence is the strongest control.
Notes: The single highest-leverage travel idea: reduce what is on the device before it enters hostile territory.
Lesson 07 · Slide 8
Before you travel
Decide what you actually need; strip the rest from the device
Confirm encryption, patches, and remote wipe are on
Back up before you go, so a lost device is a cost, not a catastrophe
Plan your connectivity — your own trusted link for anything sensitive
Notes: Pre-travel is where most risk is removed cheaply. Reveal each.
Lesson 07 · Slide 9
While you travel
Keep custody — the device stays with you, not in the room or the checked bag
Treat hotel/airport Wi-Fi as hostile; use your own connection for sensitive work
Power-only charging cables; no found media; Bluetooth off when unused
Assume screens are watched and unlock requests may be coerced
Custody is the control
Most travel compromises need time alone with the device. Deny that and you deny the attack.
Notes: Echoes Lesson 04 connectivity habits, applied under travel pressure. Custody is the through-line.
Lesson 07 · Slide 10
After you travel
The trip is not over when you land. A device taken into a hostile environment should be treated as potentially compromised until proven otherwise.
Return quarantine
For high-risk trips: don't reconnect a travel device straight into your core environment. Re-image or inspect it first, and rotate credentials used on the road.
Notes: This closes the loop with the diagram's "exfil after you return." Post-travel hygiene is the most-skipped step.
Lesson 07 · Slide 11
If your device leaves your sight
Assume tampering — treat it as suspect, not "probably fine"
Report it promptly, without embarrassment (the golden hour again)
Rotate credentials and sessions that touched it
Have it inspected or re-imaged before it rejoins your environment
Notes: Connect to Lesson 04's golden hour. The instinct to hope "it's fine" is exactly the failure mode.
Lesson 07 · Slide 12
Two-minute drill: what would you not carry?
For your next real trip: list what is on your work device that you would not want a hostile border officer or hotel intruder to have. That list is your data-minimisation target.
Notes: Start the timer. Turning "minimise data" into a concrete list makes the abstract advice actionable before they leave the room.
Lesson 07 · Slide 13
Recap & what's next
The endpoint is a portable copy of everything you can reach — harden it
Travel is where the adversary gets it alone; custody and minimisation are king
Pre / during / post discipline — and quarantine on return — closes the loop
Next
Lesson 08 — Mobile, MDM/UEM & Wireless/RF: the phone in your pocket and the invisible signals around it.
Notes: Bridge: the laptop is one endpoint; the phone — always on, always broadcasting — is the next.