We will be hacked soon thanks to a loose BYOD policy

Here is how I learned to handle situations like this. It starts out with understanding that it's not our job to protect the company. It's not our job to keep things running. It's not our job to make any decisions about the I.T. in any way. We are merely operators that do what leadership wants. If leadership tells us that our job is to think, THEN we think. If leadership tells us that it's our job to keep stuff up and running, THEN it's our job. If leadership tells us to create an environment that goes against our professional recommendation, it's our job to do what THEY tell us to do. To avoid situations like this, get used to feeling like you don't own anything and you will do what they ask. But then, to protect yourself, make sure that everything they ask is formally documented and integrated with the business in the form of an approved I.T. policy. Establish an IT steering committee and then write an IT policy. The leaders will feel super special if you call them a steering committee and they will LOVE the idea that you are putting them in a "superior" governing position. Hopefully you can get three people but if there's only and owner then that will do. By calling them the steering committee they will feel super special. To get this started, write an initial I.T. policy, a starter, and then email it to leadership and tell them that you would like to have better governance over what you do and request that they identify people to be a committee over you. Then have the committee agree that they want you to write an IT policy. Write down a policy with everything in it, everything. Make them sign it any time you make changes. Gleefully add anything they want to it. Create a line in the policy that says that the policy is all encompassing and you shall not deviate from or expand on the policy without approval from the committee. Then when you're in the hallway and someone asks you to do something stupid, tell them that you'll be absolutely happy to but it doesn't currently comply with policy and the policy says you can't go outside of policy. If they tell you that they want to host movie torrent servers inside your server room, just say yep, ok, happy to, we'll have to update the policy then I will do it. By simply having the policy and the bureaucracy around it you will be insulated from a lot of adhoc changes and heartache like the above. And then when they see that they have to legally sign and document themselves doing things that might get them put in jail, they'll question a second time. Once you have that done, you just have to stick to the policy and being willing to quit over it. This is where you fight. You don't fight over your opinion of what you think good security is. We always lose when we try to enforce out technical opinions against business direction. When leadership asks you to do something, stop fighting it. Only fight if they want you to violate the written policy. Story time: I had done the above. One night, I had a CEO bring in an "auditor" at the end of the day after the CO went home. He asked me to reset the CFO's password so that the auditor could login to the financial system. I said yep I'm happy to, but it requires an update in policy (because the policy required that I secure things and not share passwords) so if he could call the committee together real quick to update the policy then we could make it happen. He didn't want to do that. So I offered that instead of doing what he asked which would require a policy update, I could just create a brand new account for this person and give them access to the financial system; but no, they didn't want that. The CEO yelled at me and told me that it was urgent and I needed to be cooperative and he took verbal responsibility for this action. I told him that under no circumstance would I ever violate the policy signed by the committee and that the only way for him to make things happen immediately would be to fire me on the spot and I would have over -my- username and password and he could do whatever he wanted to with it. He yelled at me. I yelled back as loudly as possible so that the entire office would hear me, "boss name" I will never violate the IT policy no matter who demands it!!! He and the auditor left. A few weeks later he was fired and I got an 18% raise. I don't know if there's a connection. No one ever said anything to me. I just followed policy.