Data access verification for enterprise resources

A method in a computing device for responding to a determination that a verification with a user is desired responsive to a detection of activity indicative of a possible insider threat, wherein the computing device is to be communicatively coupled to a traffic capture and analysis module (TCAM), wherein the TCAM is to be coupled between a one or more client end stations and one or more server end stations to analyze network traffic being sent between them, wherein the one or more server end stations are to store enterprise resources including an enterprise application and enterprise data, wherein the possible insider threat comprises a use of one or more of a user account and a client end station to access the enterprise resources, and wherein the determination that the verification with the user is desired was based on one or more of the network traffic, current event data, and stored historical data, wherein the current event data describes an access to one of the enterprise resources that was detected and reported on by the TCAM, the method comprising:

• selecting a target role and a target user for the verification based on an activity context and an enterprise context repository, wherein the activity context describes the activity by identifying a rule used to make the determination and by identifying one or more of the current event data and relevant historical data, wherein the enterprise context repository identifies roles within the enterprise and the users in those roles, the selecting including:
• selecting the target role from a plurality of target roles based on the activity context, wherein the plurality of target roles includes two or more of an owner of the client end station, an owner of the user account, an owner of a particular part of the enterprise data, and a position at the enterprise;
• and
• selecting the target user in the selected target role based on the enterprise context repository, wherein the selected target role and the selected target user in that selected target role is intended to be the user of the enterprise having requisite knowledge to confirm whether or not the activity is indicative of the possible insider threat, wherein the selected target user is a different individual than the owner of the user account and an administrator;
• determining whether a number of verifications with the target user exceeds a predetermined threshold within a predetermined period of time;
• when the number of verifications with the target user exceeds the predetermined threshold within the predetermined period of time, notifying the administrator and forgoing the verification;
• and
• when the number of verifications with the target user does not exceed the predetermined threshold within the predetermined period of time, performing the verification, wherein the verification comprises:
• causing a verification request to be sent to the selected target user, wherein the verification request describes the activity and allows the selected target user to effectively confirm whether or not the activity is indicative of the possible insider threat;
• and
• generating an alert when a verification result, which is based on the verification request and any verification response, indicates that the activity is indicative of the possible insider threat.

A computing device configured to respond to a determination that a verification with a user is desired responsive to detection of activity indicative of a possible insider threat, wherein the computing device is to be communicatively coupled to a traffic capture and analysis module (TCAM), wherein the TCAM is to be coupled between one or more client end stations and one or more server end stations to analyze network traffic being sent between them, wherein the one or more server end stations are to store enterprise resources including an enterprise application and enterprise data, wherein the possible insider threat comprises a use of one or more of a user account and a client end station to access the enterprise resources, and wherein the determination that the verification with the user is desired is based on one or more of the network traffic, current event data, and stored historical data, wherein the current event data describes an access to one of the enterprise resources that was detected and reported on by the TCAM, the computing device comprising:

• a processor and a memory, said memory containing instructions which when executed by the processor cause the computing device to:
• select a target role and a target user for the verification based on an activity context and an enterprise context repository, wherein the activity context describes the activity by identifying a rule used to make the determination and by identifying one or more of the current event data and relevant historical data, wherein the enterprise context repository identifies roles within the enterprise and the users in those roles, the selection including to:
• select the target role from a plurality of target roles based on the activity context, wherein the plurality of target roles includes two or more of an owner of the client end station, an owner of the user account, an owner of a particular part of the enterprise data, and a position at the enterprise;
• select the target user in the selected target role based on the enterprise context repository, wherein the selected target role and the selected target user in that selected target role is intended to be the user of the enterprise having requisite knowledge to confirm whether or not the activity is indicative of the possible insider threat, wherein the selected target user is a different individual than the owner of the user account and an administrator;
• determine whether a number of verifications with the target user exceeds a predetermined threshold within a predetermined period of time;
• when the number of verifications with the target user exceeds the predetermined threshold within the predetermined period of time, notify the administrator and forgoing the verification;
• and
• when the number of verifications with the target user does not exceed the predetermined threshold within the predetermined period of time, perform the verification, where to perform the verification the computing device is to:
• cause a verification request to be sent to the selected target user, wherein the verification request describes the activity and allows the selected target user to effectively confirm whether or not the activity is indicative of the possible insider threat;
• and
• generate an alert when a verification result, which is based on the verification request and any verification response, indicates that the activity is indicative of the possible insider threat.