The big challenge is about people like me that want to bring their won device to the party - I bring my own pen to work so why can't I bring my own other facilitator.
And the flipside is that a pen can't do much damage to the security of a corporate IT infrastructure, nor can it easily leave with corporate data. Also, if it is lost, then the biggest issue is that it needs to be replaced (and not the company having to deal with mandatory reporting of lost customer personal information!).
I support the notions that (in the majority of cases) personal IT devices and corporate networks shouldn't co-exist. It blurs the line considerably between what is corporate data and what is personal data. An Ipad that someone takes on a weekend trip to Byron Bay shouldn't contain a mixture of corporate and personal data. It should only contain personal data or corporate data.
If you are in some industries, visits to certain countries trigger a "reimaged" laptop policy where there is no corporate data on it due to espionage/security concerns. VPN is the only link allowed to deal with corporate material. How do you deal with this in a mixed use device situation?
When an employee leaves a company who has a mixed use device, then how do you ensure the corporate data is removed? Likewise if they decide to sell their personal device, are you also sure it has been correctly wiped?
Also being corporately owned, it is an asset that can be tracked. You can't easily track personal devices. If a personal device is lost, the person might just replace it and re-sync. If it's a corporate device, then the loss will be discovered eventually (whenever an appropriate audit is done).
It is an interesting discussion. But there isn't a simple answer to the problem. In every implementation of IT there is a level of risk. No risk would mean companies wouldn't have IT!
It's how that risk is firstly defined, then mitigated and finally signed off as an accepted risk that matters.
