Attempted security breach remediation

An apparatus comprising at least one processor and at least one memory storing program code instructions, the at least one memory and program code instructions being configured to, with the at least one processor, direct the apparatus to at least:

• install an agent application configured to monitor operation of the apparatus;
• receive, from a remote compliance server by the agent application, a plurality of compliance rules defined by an enterprise and including:
• restrictions for authenticating to the apparatus within one of a plurality of geofence boundaries of known suspicious locations;
• and
• restrictions that define a manner in which the apparatus must be operated to gain access to resources of the enterprise, the apparatus being a user device;
• receive information regarding at least one authentication attempt;
• determine, based at least in part on the information regarding the at least one authentication attempt, whether the at least one authentication attempt comprises a suspected attempted security breach;
• and
• in an instance in which it is determined that the at least one authentication attempt comprises a suspected attempted security breach:
• cause at least one recording to be captured via at least one recording device communicatively coupled to the at least one processor,
• cause at least a portion of the at least one recording to be compared against at least one database, the database comprising information regarding at least one person,
• receive a command to turn on a global positioning sensor on the apparatus in response to determining that the at least one authentication attempt comprises a suspected attempted security breach,
• determine whether the apparatus is located within one of the defined geofences identifying a suspicious location, based on a location of the computing device determined using the global positioning sensor,
• cause a countdown timer to begin executing when the comparison indicates a suspected attempted security breach and when the apparatus is located within one of the defined geofence boundaries, and
• cause at least one remedial action to be automatically performed upon expiration of the countdown timer without completing a successful authentication attempt, the at least one remedial action having been determined based at least in part on at least one result of comparing the at least one recording against the at least one database.

A computer program product comprising a non-transitory computer-readable storage medium having program code portions embodied therein, the program code portions being configured to, upon execution, direct an apparatus to at least define, by an enterprise using a remote compliance server, a plurality of geofence boundaries of known suspicious locations;

• create, at the remote compliance server, a plurality of compliance rules that define:
• restrictions for authenticating to the computing device within one of the plurality of geofence boundaries;
• and restrictions that define a manner in which the computing device must be operated to gain access to resources of the enterprise, the computing device being a user device;
• install, at the computing device, an agent application configured to monitor operation of the computing device;
• receive, from the compliance server by the agent application executing on the computing device, the plurality of compliance rules;
• receive information regarding at least one authentication attempt;
• determine, using at least one processor, based at least in part on the information regarding the at least one authentication attempt, whether the at least one authentication attempt comprises a suspected attempted security breach on the computing device;
• and in an instance in which it is determined that the at least one authentication attempt comprises a suspected attempted security breach:
• cause at least one recording to be captured via at least one recording device communicatively coupled to the at least one processor, cause at least a portion of the at least one recording to be compared against at least one database, the database comprising information regarding at least one person, transmit a command to the agent application executing on the computing device to turn on a global positioning sensor on the computing device in response to determining that the at least one authentication attempt comprises a suspected attempted security breach;
• determine whether the computing device is located within one of the defined geofence boundaries identifying a suspicious location, based on a location of the computing device determined using the global positioning sensor, transmit the location of the computing device to the remote compliance server;
• lock the computing device and initiate a countdown timer when the comparison indicates a suspected attempted security breach and when the computing device is within one of the defined geofence boundaries, and automatically wipe data from the computing device when the countdown timer expires without completing a successful authentication attempt.