> 4 - The security team should
> anticipate and expect that end-users
> use their company owned devices for
> personal activities and design their
> detection capabilities with this in
> mind.”
i’m going to say… no
@willb @FritzAdalis very loaded topic.
I’ve always been in camp “incidental personal use, sure”, sort of an Inverse of work resources on personal devices (e.g. Teams, email) for convenience. Radical “you can treat your work device as if it is your personal device” has always been where I drew the line, but that was also hard because our environment is not corporate and there’s been a culture much, much larger than any individual contributor, or even the IT department, that let people get away with doing so.
Best anyone could do is communicate the risks of doing so, such as personal stuff being subject to litigation holds, open records requests, etc., or being lost due to termination, a wipe, etc., and encourage good practice. Back when I did user support that was one of the areas I’d go out on a bit of a limb, I’d consult about personal devices (not touch them) if folks came to me about personal stuff so that they’d get it off their work device.