What about the human factor? You can patch, close ports, set a policy, etc., but if the education hasn't been done for everyone accessing the network, than your parameter is still Swiss cheese.

I'm curious why you the problems with WLAN connection (or other open connection protocols) haven't come up more. Not man in the middle per se, rather devices authenticating themselves to the network, open the door for packet drops onto the device. Big problem here.

A company called NCP engineering has a VPN client that makes any network authenticate itself to the device (no packet transfer at all). They call this 'friendly net detection'. I don't think anyone else does this.