I am planning a company wide discussion on this topic for our employees. I will go over some of the main points (without getting too technical as it will be targeted to end users) given in this topic and steps to spot and protect yourself. I know I will have many questions regarding this as I build my presentation.

My first question is regarding protecting our end users while on a 3rd party WiFi connection. From the meeting it sounds like the best approach is to not use the auto connect feature and manually connect to all wireless networks. From an end users view this is not a very workable situation and many may not follow my advice on this. However lets go a step further and say one of our people is at a location and their computer does connect (manually or automatically) to a device masquerading as another wireless network (man in the middle.) What steps, aside from disconnect, can they do to prevent the data from being intercepted? Would opening a VPN connection and tunneling all traffic though it be effective?

In addition to providing users education about the dangers of public Wi-Fi, and the "correct" usage/behavior of auto-connect (good luck...) my recommendation would be to utilize an encrypted tunnel to establish a connection through a known, safe gateway and route all outbound traffic through it. Traditional VPN clients, SSLVPNs, or products utilizing SSL encapsulation, such as a Citrix Access Gateway, Remote Desktop Web Access, or Remote Desktop Gateway provides this level of security.

This way, even if your user unknowingly connects to a malicious AP, the traffic is encrypted and the attacker would most likely move on to an easier target. Why break into a random home with a full blown security system, when the next house down is dark and unlocked?

However, I am slightly hesitant to completely recommend SSLVPNs requiring users to first authenticate via a website when utilizing public Wi-Fi, as they could be vulnerable to something like SSLSTRIP.

Again, it's all cat and mouse. Evaluating risk, and how far down the rabbit hole your users are willing to go.