Several corporate users returned from an international trip with compromised operating systems on their cellular devices. Additionally, intelligence reports confirm some international carriers are…

Disabling third-party app stores addresses application-layer threats and has no effect on firmware modifications delivered through the carrier's baseband channel.

Firmware-over-the-air updates are delivered exclusively over the cellular carrier's own network infrastructure, so disabling the cellular radio removes the only path through which a carrier can push unauthorized firmware modifications. Requiring WiFi instead routes all data through networks outside carrier control, directly and operationally mitigating the specific threat identified in the intelligence report without requiring changes to MDM policy that vendors have already been able to bypass.

An always-on VPN protects data in transit at the application and network layers but operates above the baseband radio level where carrier-initiated FOTA updates occur, so it cannot prevent firmware compromise.

PKI device certificates provide mutual authentication for network access but do not grant the device control over what firmware the carrier pushes through its own radio network infrastructure.