Just say no to that @#$@.....................................................................................................

I think we should not allow personal devices in corporate networks. This will add risks from various perspectives including. GRC, ESG , ISO 27001 etc.

It is inevitable. Even the primary device (ex Laptop) is corporate, official emails are configured in handphones (personal). ZTNA, MAM and CASB kind of technical solutions in addition to IRM / DRM may prevent Data leakage to a certain extent.

For personal devices, first of all there should be documented and approved BYOD policy which contains which devices are allowed. When employees are using personal device for work purpose, organisations need to implement container security to segregate work related data and personal data. There should be anti malware and EDR should be installed on the personal device. The BYOD acceptable usage policy must be circulated to all the employees and regularly cyber security awareness session to be conducted for all employees.

Enforcing the BYOD policy, implementation and control over MDM. Integrarion and tracking of devices using SIEM and gps tracking . Implementation of Adaptive authenticarion with MFA. Device binding and Containerisation.