Should the Network/Business Security people now be a separate department from IT, so that anyone setting up a personal network could get it checked out without implicating the IT department? As Security needs to know about the systems in place, they could be the impartial helper in minimising duplication.