Network data collection and response system

A computer program product for providing a user-supplied computing device with access to an enterprise network comprising local network resources accessible to the device via the enterprise network, the computer program product comprising:

• a non-transitory computer readable storage medium readable by a processing circuit and storing instructions that, when executed by the processing circuit, perform a method comprising:
• tracking, by the enterprise network, network activity of the device through passive monitoring without utilization of a data monitoring agent installed on the device;
• inferring type and configuration information of the device;
• creating a device inventory comprising device type and one or more of configuration information for the device and a resource utilization profile for the device;
• detecting, by the enterprise network, one or more of high-risk or unauthorized network activity involving the device, wherein the detecting high-risk or unauthorized network activity comprises identifying attempted access to applications that offer services that are not authorized by the enterprise;
• and
• implementing a response action to mitigate the high-risk or unauthorized network activity, wherein the response action comprises one or more of:
• blocking the unauthorized network activity and providing notice to a user of the device that the device has attempted to conduct unauthorized network activity;
• notifying a user or monitoring system of the device of malware present on the device and removal of the malware from the device;
• detecting malware transmitted from the device;
• and
• removal of the malware from the enterprise network.

A network data recording and response system for enhancing security in a computer enterprise network providing a computing device with access to the enterprise network, the system operable for:

• assigning, by a processor executing instructions stored on a memory of a connection protocol server, a network address to the device to identify the device on the enterprise network in response to a network access request received from the device;
• tracking, by the enterprise network, network activity of the device through passive monitoring without utilization of a data monitoring agent installed on the device;
• inferring one or more of type and configuration information of the device;
• creating a device inventory comprising one or more of device type and configuration information for the device and a resource utilization profile for the device;
• detecting, by the enterprise network, high-risk or unauthorized network activity involving the device, wherein the detecting high-risk or unauthorized network activity comprises identifying attempted access to applications that offer services that are not authorized by the enterprise;
• and
• implementing a response action to mitigate the high-risk or unauthorized network activity, wherein the response action comprises one or more of:
• blocking the unauthorized network activity and providing notice to a user of the device that the device has attempted to conduct unauthorized network activity;
• notifying a user or monitoring system of the device of malware present on the device and removal of the malware from the device;
• detecting malware transmitted from the device;
• and
• removal of the malware from the enterprise network.