Here we go... All secure tasks like handling of IDs, banking, trading, etc. must be done through managed Linux workstations (Landscape with master image), or m

Here we go... All secure tasks like handling of IDs, banking, trading, etc. must be done through managed Linux workstations (Landscape with master image), or managed VDI. Keepass is used to store credentials. There is a network storage accessible only to those workstations containing important documents. A second storage area is avaliable for unmanaged and Windows devices. Windows devices have Group Policy set for update settings, but generally users can do whatever they like. Mobile devices are expected to be patched but they have free reign. Haven't found a good management solution for Windows and mobile yet. Wifi uses EAP-TLS, no exceptions and no guest devices permitted. As a result IOT and smart home devices are not allowed on the network since they don't support EAP-TLS. Certificates are issued per device and allow access to different services like VPN etc. I currently don't have managed switches so mobile devices and personal workstations do share the same network as my servers and such, but all local services like network storage are encrypted and require authentication. Ideally I'd have VLAN segregation, but this will have to wait for the next network upgrade.