I developed a mobile application that runs on our company's mobile terminals. The mobile application connects to the company servers via GSM network.
We had a meeting to decide how to secure the communication between mobile application and server application. Our security team insists that we must install a VPN application on the mobile terminals, connect to our company network with VPN firstly and then our mobile application should connect to the server via https.
I could not understand their insistence. I think giving VPN rights to every mobile terminal owner is more dangerous than securing a connection with https. As I know, https connection could provide required security between client and server applications which I wrote both of them and they use https for communication.
Is there any security related information that my knowledge is not enough to understand? If I am right , how I could show them that https is enough for security and giving VPN is more dangerous. Any other convincing information is welcome.