Mobile device policy enforcement

1. A non-transitory computer-readable medium comprising instructions, the instructions when executed causing one or more processors to:

execute a local security agent on a device, the local security agent enforcing a security policy requiring an operating system of the device to check that software code has a valid signature before permitting execution of the software code;

attempt to execute the software code with an invalid signature on the device, the invalid signature preventing execution of the software code on the device if the operating system meets the security policy;

upon unsuccessful execution of the software code with the invalid signature on the device, repeat the attempt to execute the software code with the invalid signature on the device until a given attempt executes the software code on the device, wherein repeating the attempt to execute the software code includes waiting a predetermined time interval between each attempt; and

in response to successful execution of the software code with the invalid signature, take an action to remediate the device, the action including isolating the device from a network and requiring changes to the operating system to check that the software code has the valid signature before permitting execution of the software code.

2. The computer-readable medium of claim 1 , wherein the instructions further cause the one or more processors to receive the software code with the invalid signature.

3. The computer-readable medium of claim 1 , wherein the action to remediate the device includes one or more of: reinstall software on the device, apply changes to software on the device, run remediating software on the device, report a health status of the device that is an unhealthy status, report a health status of the device that indicates that the device is in violation of policy, notify a user, or notify an administrator.

4. A method comprising:

executing a local security agent on a device, the local security agent enforcing a security policy requiring an operating system of the device to check that software code has a valid signature before permitting execution of the software code;

repeatedly attempting to execute the software code with an invalid signature on the device until one of the repeated attempts to execute the software code on the device is successful, wherein repeatedly attempting to execute the software code includes waiting a predetermined time interval between each attempt, the device having a security policy specifying that only software code with a valid signature is permitted to execute on the device, the invalid signature preventing execution of the software code with the invalid signature if the operating system meets the security policy; and

in response to successfully executing the software code with the invalid signature, taking a consequential action by the device, the consequential action including requiring changes to the operating system to check that the software code has the valid signature before permitting execution of the software code.

5. The method of claim 4 , further comprising, receiving the software code with the invalid signature.

6. The method of claim 4 , wherein the method further comprises installing the software code with the invalid signature on the device.

7. The method of claim 4 , wherein the consequential action comprises an action to remediate the device, the action comprising one or more of: reinstalling software on the device, applying changes to software on the device, reporting a health status of the device that is in violation of policy.

8. The method of claim 4 , wherein the consequential action comprises one or more of: notifying a user, and notifying an administrator.

9. A system, comprising:

one or more processors;

a non-transitory computer-readable medium comprising instructions, the instructions when executed causing the one or more processors to perform operations, comprising:

execute a local security agent on a device, the local security agent enforcing a security policy requiring an operating system of the device to check that software code has a valid signature before permitting execution of the software code;

receive the software code with an invalid signature;

repeatedly attempt to execute the software code with the invalid signature on the device until one of the repeated attempts to execute the software code with the invalid signature is successful, wherein repeatedly attempting to execute the software code includes waiting a predetermined time interval between each attempt, wherein the invalid signature causes the device to prevent execution of the software code with the invalid signature if the operating system meets a security policy specifying that only software code with a valid signature is permitted to execute on the device; and

in response to successfully executing the software code with the invalid signature, remediate the device and confirm that the operating system checks that the software code has the valid signature before permitting execution of the software code.

10. The system of claim 9 , wherein the operations further comprise, store the software code with the invalid signature on the device.

11. The system of claim 9 , wherein remediating the device further includes applying changes to an operating system, software, or configuration of the device.

12. The system of claim 9 , wherein remediating the device further includes reporting a health status of the device.

13. The system of claim 12 , wherein reporting the health status of the device is that the device includes reporting that the device is in violation of the security policy.