Having spent a lot of time in this domain, you have to (and most seem to be coming to the same conclusion) just assume that everything that connects to your network is untrusted and likely owned and work inwards from there for your threat modelling.<p>You have to really forget about trying to secure the client (and this includes campus supplied gear) and up your monitoring game.<p>ISTR that Google has also taken a similar approach with its employees access to their LAN.