A security architect is investigating instances of employees who had their phones stolen in public places through seemingly targeted attacks. Devices are able to access company resources such as…

A remote wipe procedure allows an administrator to erase all corporate data, or even the entire device, if it is reported stolen or lost, preventing unauthorized access to sensitive information persisting in application storage.

Enforcing biometric access control (e.g., fingerprint, facial recognition) with short timeouts significantly increases the difficulty for an attacker to gain access to the device and corporate applications, especially immediately after theft.

Geofencing restricts application use based on location but does not directly prevent access to data already on a stolen device outside the geofence, especially if the device is offline or the geofence can be bypassed.

Application control restricts what applications can be installed on a device, which is a good security practice but does not directly address access to existing corporate data on a stolen device by an unauthorized user.

Preventing side-loading helps maintain device integrity by blocking untrusted applications, but it does not prevent an attacker from attempting to access legitimate corporate applications or data already present on a stolen device.

Device certificates authenticate the device to corporate resources, but they do not prevent an unauthorized user who gains access to the stolen device from using those established connections.