I have a mobile application (ioS) which only certain users are allowed to use, and its coded in such a way that they could only login using secured VPN (with tokens) in order to access our internal network servers for data retrieval.
My auditor request that, according to good practices, all mobile apps development should try to incorporate certificate pinning.
I would like to challenge that argument: using VPN with multi factor is, in my opinion, sufficient because both are methods of authentication and enables us to know who is really using the app. My mobile app is not an internet based app and the database server which the app will retrieve data from is hosted internally.
So my question is: Are VPN and Cert pinning serving different purposes or they are approximately equivalent?