Some carriers have (very expensive) plans that connect the IP part of the mobile connection to an IPSec gateway, making your mobile appear as if it were on the company's network. If such plans are in use, then it's the same as if you were browsing directly from the company's Wi-Fi or Ethernet networks.

Using a VPN terminated on your mobile device will help in regards to network monitoring (your company will only see an outgoing VPN connection to a server you control), that is, if their network will actually allow you to VPN out to an untrusted (to the eyes of the company) server - after all, outgoing encrypted connections can be used for sensitive data exfiltration or malware traffic. If this even works, it'll most likely be forbidden by your IT acceptable use policy and definitely raise some red flags on the sysadmin's side.

Note that no matter which network monitoring solutions might be in place, you still can't be safe as the company-provided device shouldn't be trusted - it's most likely managed by an MDM solution and the sysadmins have root access to the device. See the nice picture your girlfriend sent you ? The sysadmins are already looking at it. The super secure HTTPS-enabled webmail you're used to accessing ? The sysadmins can look at them because their CA certificate is in the device's trust store and they can thus impersonate any site by issuing valid (to the eyes of that device) certs.

I suggest you at least make it clear with the IT department whether you're allowed to use company-provided mobile network access for personal usage and whether you can VPN out to your personal server (or a third-party VPN service). If you are allowed, you should initiate the VPN connection from a trusted (non-work) device like your computer, and only use the company-provided hardware as a hotspot. In any case, don't trust their hardware with personal files even if they allow you to do so - the fact that you're allowed to use them doesn't mean they aren't allowed to look at what you do.

Some carriers have (very expensive) plans that connect the IP part of the mobile connection to an L2TP or IPSec gateway, making your mobile appear as if it were on the company's network. If such plans are in use, then it's the same as if you were browsing directly from the company's Wi-Fi or Ethernet networks.

Using a VPN terminated on your mobile device will help in regards to network monitoring (your company will only see an outgoing VPN connection to a server you control), that is, if their network will actually allow you to VPN out to an untrusted (to the eyes of the company) server - after all, outgoing encrypted connections can be used for sensitive data exfiltration or malware traffic. If this even works, it'll most likely be forbidden by your IT acceptable use policy and definitely raise some red flags on the sysadmin's side.

Note that no matter which network monitoring solutions might be in place, you still can't be safe as the company-provided device shouldn't be trusted - it's most likely managed by an MDM solution and the sysadmins have root access to the device. See the nice picture your girlfriend sent you ? The sysadmins are already looking at it. The super secure HTTPS-enabled webmail you're used to accessing ? The sysadmins can look at them because their CA certificate is in the device's trust store and they can thus impersonate any site by issuing valid (to the eyes of that device) certs.

I suggest you at least make it clear with the IT department whether you're allowed to use company-provided mobile network access for personal usage and whether you can VPN out to your personal server (or a third-party VPN service). If you are allowed, you should initiate the VPN connection from a trusted (non-work) device like your computer, and only use the company-provided hardware as a hotspot. In any case, don't trust their hardware with personal files even if they allow you to do so - the fact that you're allowed to use them doesn't mean they aren't allowed to look at what you do.

Some carriers have (very expensive) plans that connect the IP part of the mobile connection to an IPSec gateway, making your mobile appear as if it were on the company's network. If such plans are in use, then it's the same as if you were browsing directly from the company's Wi-Fi or Ethernet networks.

Using a VPN terminated on your mobile device will help in regards to network monitoring (your company will only see an outgoing VPN connection to a server you control), that is, if their network will actually allow you to VPN out to an untrusted (to the eyes of the company) server - after all. If this even works, it'll most likely be forbidden by your IT acceptable use policy and definitely raise some red flags on the sysadmin's side.

Note that no matter which network monitoring solutions might be in place, you still can't be safe as the company-provided device shouldn't be trusted - it's most likely managed by an MDM solution and the sysadmins have root access to the device. See the nice picture your girlfriend sent you ? The sysadmins are already looking at it. The super secure HTTPS-enabled webmail you're used to accessing ? The sysadmins can look at them because their CA certificate is in the device's trust store and they can thus impersonate any site by issuing valid (to the eyes of that device) certs.

I suggest you at least make it clear with the IT department whether you're allowed to use company-provided mobile network access for personal usage and whether you can VPN out to your personal server (or a third-party VPN service). If you are allowed, you should initiate the VPN connection from a trusted (non-work) device like your computer, and only use the company-provided hardware as a hotspot. In any case, don't trust their hardware with personal files even if they allow you to do so - the fact that you're allowed to use them doesn't mean they aren't allowed to look at what you do.

Some carriers have (very expensive) plans that connect the IP part of the mobile connection to an IPSec gateway, making your mobile appear as if it were on the company's network. If such plans are in use, then it's the same as if you were browsing directly from the company's Wi-Fi or Ethernet networks.

Using a VPN terminated on your mobile device will help in regards to network monitoring (your company will only see an outgoing VPN connection to a server you control), that is, if their network will actually allow you to VPN out to an untrusted (to the eyes of the company) server - after all, outgoing encrypted connections can be used for sensitive data exfiltration or malware traffic. If this even works, it'll most likely be forbidden by your IT acceptable use policy and definitely raise some red flags on the sysadmin's side.

Note that no matter which network monitoring solutions might be in place, you still can't be safe as the company-provided device shouldn't be trusted - it's most likely managed by an MDM solution and the sysadmins have root access to the device. See the nice picture your girlfriend sent you ? The sysadmins are already looking at it. The super secure HTTPS-enabled webmail you're used to accessing ? The sysadmins can look at them because their CA certificate is in the device's trust store and they can thus impersonate any site by issuing valid (to the eyes of that device) certs.

I suggest you at least make it clear with the IT department whether you're allowed to use company-provided mobile network access for personal usage and whether you can VPN out to your personal server (or a third-party VPN service). If you are allowed, you should initiate the VPN connection from a trusted (non-work) device like your computer, and only use the company-provided hardware as a hotspot. In any case, don't trust their hardware with personal files even if they allow you to do so - the fact that you're allowed to use them doesn't mean they aren't allowed to look at what you do.