Restricted execution mode for network-accessible devices

1 . A computer-implemented method to restrict processes being executed on a user device, the method comprising:

receiving an indication of a security threat to the user device associated with a user;

in response to receiving the indication of the security threat, identifying a first plurality of processes being executed on the user device;

identifying a second plurality of trusted processes from the first plurality of processes;

receiving, from a remote device in operative communication with the user device, a command to enter a restricted execution mode and to terminate or suspend one or more processes from the first plurality of processes that are not in the second plurality of trusted processes, wherein in the restricted execution mode, execution of subsequent processes on the user device is limited to the second plurality of trusted processes;

saving an execution state of the user device, wherein the execution state comprises a log of processes that are to be terminated or suspended;

after saving the execution state, terminating or suspending the one or more processes from the first plurality of processes that are not in the second plurality of trusted processes;

after the terminating or suspending, remediating the security threat on the user device; and

responsive to remediating the security threat on the user device, restarting at least one process from the one or more processes on the user device based on the saved execution state.

2 . The computer-implemented method of claim 1 , wherein receiving the indication of the security threat comprises at least one of:

receiving the indication from the remote device and wherein the security threat is suspicious or malicious activity on the user device identified by the remote device; or

receiving the indication of suspicious or malicious activity on the user device from security software that executes on the user device.

3 . The computer-implemented method of claim 1 , wherein the second plurality of trusted processes comprises processes that are identifiable as being directed by one or more trusted software installations at the user device.

4 . The computer-implemented method of claim 1 , wherein identifying the second plurality of trusted processes comprises one or more of:

determining that a process in the first plurality of processes is from a trusted source;

determining that a process in the first plurality of processes is digitally signed by the trusted source; or

determining that a process in the first plurality of processes matches a hash value of a previously trusted process.

5 . The computer-implemented method of claim 1 , further comprising:

responsive to remediating the security threat on the user device, restarting terminated or suspended processes that are unaffected by the remediating.

6 . The computer-implemented method of claim 1 , wherein remediating the security threat on the user device comprises:

receiving, from the remote device, a command to direct security software on the user device to remediate the security threat.

7 . The computer-implemented method of claim 6 , further comprising:

receiving, from the remote device, a second command to block previously terminated or suspended processes from restarting.

8 . The computer-implemented method of claim 1 , wherein

the at least one process is from suspended processes unaffected by the remediating.

9 . The computer-implemented method of claim 1 , further comprising:

responsive to remediating the security threat on the user device, restarting previously terminated or suspended processes in response to a command from the remote device that utilizes a remote application programming interface (API) function exposed by the user device.

10 . The computer-implemented method of claim 1 , wherein the second plurality of trusted processes are directed by an employee access policy, and wherein the indication of the security threat is termination of employment of the user associated with the user device.

11 . A non-transitory computer-readable medium with instructions stored thereon that, responsive to execution by a processing device, causes the processing device to perform operations comprising:

receiving an indication of a security threat to a user device associated with a user;

in response to receiving the indication of the security threat, identifying a set of trusted processes being executed on the user device from processes being executed on the user device;

receiving, from a remote device in operative communication with the user device, a command to enter a restricted execution mode and to terminate or suspend processes that are not in the set, wherein in the restricted execution mode, execution of subsequent processes on the user device is limited to the set of trusted processes;

saving an execution state of the user device, wherein the execution state comprises a log of processes that are to be terminated or suspended;

after saving the execution state, terminating or suspending the processes that are not in the set;

after the terminating or suspending, remediating the security threat on the user device; and

responsive to remediating the security threat on the user device, restarting at least one process not in the set based on the saved execution state.

12 . The non-transitory computer-readable medium of claim 11 , wherein receiving the indication of the security threat comprises at least one of:

receiving the indication from the remote device and wherein the security threat is suspicious or malicious activity on the user device identified by the remote device; or

receiving the indication of suspicious or malicious activity on the user device from security software that executes on the user device.

13 . The non-transitory computer-readable medium of claim 11 , wherein the set of trusted processes comprises processes that are identified as being directed by one or more trusted software installations at the user device.

14 . The non-transitory computer-readable medium of claim 11 , wherein identifying the set of trusted processes being executed on the user device comprises one or more of

determining that a process in the set is from a trusted source;

determining that a process in the set is digitally signed by the trusted source; or

determining that a process in the set matches a hash value of a previously trusted process.

15 . The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise:

responsive to remediating the security threat on the user device, restarting terminated or suspended processes.

16 . The non-transitory computer-readable medium of claim 11 , wherein remediating the security threat on the user device comprises:

receiving, from the remote device, a command to direct security software on the user device to remediate the security threat.

17 . The non-transitory computer-readable medium of claim 16 , wherein the operations further comprise:

receiving, from the remote device, a second command to block previously terminated or suspended processes from restarting based upon results of the remediating.

18 . The non-transitory computer-readable medium of claim 11 , wherein restarting the at least one process not in the set comprises

rebooting the user device to the saved execution state.

19 . The non-transitory computer-readable medium of claim 11 , wherein the operations further comprise:

responsive to remediating the security threat on the user device, restarting previously terminated or suspended processes through a command from the remote device that utilizes a remote application programming interface (API) function exposed by the user device.

20 . A threat management computer system to manage active security threats on an enterprise network, comprising:

a memory with instructions stored thereon;

a processing device, coupled to the memory, the processing device configured to access the memory and execute the instructions; and

a network device coupled to the processing device and configured to receive indications of security threats from a plurality of user devices, wherein the instructions cause the processing device to perform operations including:

receiving an indication of a security threat to a user device associated with a user;

in response to receiving the indication of the security threat, identifying a set of trusted processes being executed on the user device from processes being executed on the user device;

receiving, from a remote device in operative communication with the user device, a command to enter a restricted execution mode and to terminate or suspend processes that are not in the set, wherein in the restricted execution mode, execution of subsequent processes on the user device is limited to the set of trusted processes;

saving an execution state of the user device, wherein the execution state comprises a log of processes that are to be terminated or suspended;

after saving the execution state, terminating or suspending the processes that are not in the set;

after the terminating or suspending, remediating the security threat on the user device; and

responsive to remediating the security threat on the user device, restarting at least one process not in the set based on the saved execution state.