He should check that he is only visiting websites that have HTTPS protocol. This is so if someone intercepts the traffic, they will not be able to decipher it, since it is encrypted with RSA keys. He should also check the validity of the network (making sure it's a legitamate network that is owned by legitimate business.)
He should also consider using a VPN.