There is a distinction of trusted and untrusted, but I wasn't implying a trust by default method because that's not good either. I also wasn't trying to imply t

There is a distinction of trusted and untrusted, but I wasn't implying a trust by default method because that's not good either. I also wasn't trying to imply that a vetted device is necessarily a trusted device. For example, we allow Blackberry, Apple and Android devices on our network as "officially supported" mobile devices. We don't trust them but we know if something goes wrong we can issue a single command and wipe the device which effectively ends all access that device had/has to our network resources. The point is, and you hit on it, that you have to prevent intrusion, compromise or infection from all places and allowing people to work on their own hardware or without a VPN means that job becomes exponentially more difficult.