Anybody out there actually practicing Kolide’s https://honest.security model?
Honest Security

A guide to endpoint security and device management that doesn't erode your values.

@ajn142 @FritzAdalis

> 4 - The security team should
> anticipate and expect that end-users
> use their company owned devices for
> personal activities and design their
> detection capabilities with this in
> mind.”

i’m going to say… no

@willb @FritzAdalis very loaded topic.

I’ve always been in camp “incidental personal use, sure”, sort of an Inverse of work resources on personal devices (e.g. Teams, email) for convenience. Radical “you can treat your work device as if it is your personal device” has always been where I drew the line, but that was also hard because our environment is not corporate and there’s been a culture much, much larger than any individual contributor, or even the IT department, that let people get away with doing so.

Best anyone could do is communicate the risks of doing so, such as personal stuff being subject to litigation holds, open records requests, etc., or being lost due to termination, a wipe, etc., and encourage good practice. Back when I did user support that was one of the areas I’d go out on a bit of a limb, I’d consult about personal devices (not touch them) if folks came to me about personal stuff so that they’d get it off their work device.

@willb @FritzAdalis I don’t think that stance will change. We have neither the inclination nor time to spend looking into folks personal usage, as long as they aren’t doing things that put the org’s interests at risk. Anything that does create a risk, is gonna be treated the same whether it’s e.g. pirating Adobe products to build graphics for a work presentation or pirating games to play on their lunch break.