1. A computer program product for protecting an enterprise data server against insider attack, comprising: a computer readable storage device having computer readable program code embodied therewith, the computer readable program code comprising computer readable program code configured to: generate a display interface through which an authorized entity using a given policy specification language specifies characteristics of an insider attack including illegitimate access by a trusted user, wherein the given policy specification language enables the authorized entity to specify a set of one or more policy filters that specify characteristics of an insider attack and that is associated with a given enterprise data server type and defines (a) a given action that a trusted user may attempt to take with respect to a given enterprise information asset stored on a given enterprise data server, and (b) a given response that is to be taken upon detection of the given action; monitor a trusted user's given data access against the set of one or more policy filters, at least one policy filter including an expression with one or more data access attributes each associated with a behavior of a trusted user with respect to one or more information assets stored on the enterprise data server, the data access attribute defined by a statistical function that receives a property value of a given data access of a trusted user, compares the property value of the given data access to corresponding property values of prior data accesses within a data access history, determines a frequency of occurrence of the property value in the data access history, and provides an indicator based on the frequency of occurrence of the property value indicating whether the property value represents an illegitimate access; analyze the trusted user's given data access against the set of one or more policy filters by calculating the statistical functions of the data access attributes and determining an overall value for the expression of the at least one policy filter; determine whether the trusted user's given data access is indicative of an illegitimate access based on the overall value for the expression as specified by a given policy filter in the set of policy filters; and in response to the trusted user's given data access being indicative of an illegitimate access as specified by the given policy filter, take the given response specified by the given policy filter.