Applying a security policy to an instance of an application
A computer stores, within a single user account, multiple supervised computing resources and multiple additional computing resources. The multiple supervised computing resources are associated with a security policy. The computer executes a first instance of a specified application that lacks read access and lacks write access to any and all of the multiple supervised computing resources. The computer executes, simultaneously with the first instance, a second instance of the specified application that accesses at least a portion of the multiple supervised computing resources. The computer applies rules from the security policy to the second instance of the specified application while foregoing applying the rules from the security policy to the first instance of the specified application.
1 . A method comprising:
storing, within a single user account at a computing machine, multiple supervised computing resources and multiple additional computing resources, wherein the multiple supervised computing resources are associated with a security policy;
executing a first instance of a specified application that lacks read access and lacks write access to any and all of the multiple supervised computing resources;
executing, simultaneously with the first instance, a second instance of the specified application that accesses at least a portion of the multiple supervised computing resources;
applying rules from the security policy to the second instance of the specified application while foregoing applying the rules from the security policy to the first instance of the specified application; and
causing display, by a display unit displaying a graphical user interface of the computing machine, of a visual indicator that the second instance of the specified application is associated with the security policy, wherein the visual indicator comprises a border for a portion of the display unit associated with the second instance, wherein the border comprises pixels that are external to the portion of the display unit associated with the second instance and within a threshold distance from an edge of the portion, wherein multiple computing resources are displayed on the display unit, wherein each displayed computing resource is associated with a display priority value based on a time when the displayed computing resource was last selected, wherein the border comprises pixels that are not occupied by a computing resource that was selected after a last selection time of the second instance, wherein the security policy causes tracking, by a tracking service, of use of the second instance of the specified application, while forgoing causing tracking, by the tracking service, of use of the first instance of the specified application.
2 . The method of claim 1 , further comprising:
identifying a computing resource as a supervised computing resource based on one or more of: a location of the computing resource in a directory or file system, a cloud storage location, a rule in the security policy, a process name or path, a uniform resource locator (URL) address, and whether the computing resource is launched from an application launcher associated with the multiple supervised computing resources.
3 . The method of claim 1 , wherein the multiple additional computing resources comprise personal computing resources, wherein the multiple supervised computing resources comprise organizational computing resources, wherein the multiple supervised computing resources and the multiple additional computing resources comprise files, applications or websites.
4 . The method of claim 1 , wherein the first instance of the specified application accesses least a portion of the multiple additional computing resources.
5 . The method of claim 1 , wherein the second instance of the specified application has read access and lacks write access to at least a portion of the multiple additional computing resources, wherein, when the second instance access the at least the portion of the multiple additional computing resources, application of the security policy is based on a setting associated with the computing machine.
6 . The method of claim 1 , further comprising:
accessing, using a third instance of the specified application, an unsecure computing resource;
blocking access, by the third instance of the specified application, to any and all of the multiple supervised computing resources and any and all of the multiple additional computing resources.
7 . The method of claim 6 , further comprising:
identifying the unsecure computing resource based on the unsecure computing resource residing in a download memory region, a memory region associated with attachments for an email application, or a memory region associated with a web browser.
8 . The method of claim 7 , wherein the download memory region comprises a download folder, wherein the memory region associated with the web browser comprises the download folder, wherein the memory region associated with the attachments for the email application comprises an attachment folder.
9 . A non-transitory machine-readable medium storing instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:
storing, within a single user account at a computing machine, multiple supervised computing resources and multiple additional computing resources, wherein the multiple supervised computing resources are associated with a security policy;
executing a first instance of a specified application that lacks read access and lacks write access to any and all of the multiple supervised computing resources;
executing, simultaneously with the first instance, a second instance of the specified application that accesses at least a portion of the multiple supervised computing resources;
applying rules from the security policy to the second instance of the specified application while foregoing applying the rules from the security policy to the first instance of the specified application; and
causing display, by a display unit displaying a graphical user interface of the computing machine, of a visual indicator that the second instance of the specified application is associated with the security policy, wherein the visual indicator comprises a border for a portion of the display unit associated with the second instance, wherein the border comprises pixels that are external to the portion of the display unit associated with the second instance and within a threshold distance from an edge of the portion, wherein multiple computing resources are displayed on the display unit, wherein each displayed computing resource is associated with a display priority value based on a time when the displayed computing resource was last selected, wherein the border comprises pixels that are not occupied by a computing resource that was selected after a last selection time of the second instance, wherein the security policy causes tracking, by a tracking service, of use of the second instance of the specified application, while forgoing causing tracking, by the tracking service, of use of the first instance of the specified application.
10 . The machine-readable medium of claim 9 , the operations further comprising:
identifying a computing resource as a supervised computing resource based on one or more of: a location of the computing resource in a directory or file system, a cloud storage location, a rule in the security policy, a process name or path, a uniform resource locator (URL) address, and whether the computing resource is launched from an application launcher associated with the multiple supervised computing resources.
11 . The machine-readable medium of claim 9 , wherein the multiple additional computing resources comprise personal computing resources, wherein the multiple supervised computing resources comprise organizational computing resources, wherein the multiple supervised computing resources and the multiple additional computing resources comprise files, applications or websites.
12 . The machine-readable medium of claim 9 , wherein the first instance of the specified application accesses least a portion of the multiple additional computing resources.
13 . The machine-readable medium of claim 9 , wherein the second instance of the specified application has read access and lacks write access to at least a portion of the multiple additional computing resources, wherein, when the second instance access the at least the portion of the multiple additional computing resources, application of the security policy is based on a setting associated with the computing machine.
14 . The machine-readable medium of claim 9 , the operations further comprising:
accessing, using a third instance of the specified application, an unsecure computing resource;
blocking access, by the third instance of the specified application, to any and all of the multiple supervised computing resources and any and all of the multiple additional computing resources.
15 . The machine-readable medium of claim 14 , the operations further comprising:
identifying the unsecure computing resource based on the unsecure computing resource residing in a download memory region, a memory region associated with attachments for an email application, or a memory region associated with a web browser.
16 . The machine-readable medium of claim 15 , wherein the download memory region comprises a download folder, wherein the memory region associated with the web browser comprises the download folder, wherein the memory region associated with the attachments for the email application comprises an attachment folder.
17 . A system comprising:
processing circuitry; and
a memory storing instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:
storing, within a single user account at a computing machine, multiple supervised computing resources and multiple additional computing resources, wherein the multiple supervised computing resources are associated with a security policy;
executing a first instance of a specified application that lacks read access and lacks write access to any and all of the multiple supervised computing resources;
executing, simultaneously with the first instance, a second instance of the specified application that accesses at least a portion of the multiple supervised computing resources;
applying rules from the security policy to the second instance of the specified application while foregoing applying the rules from the security policy to the first instance of the specified application; and
causing display, by a display unit displaying a graphical user interface of the computing machine, of a visual indicator that the second instance of the specified application is associated with the security policy, wherein the visual indicator comprises a border for a portion of the display unit associated with the second instance, wherein the border comprises pixels that are external to the portion of the display unit associated with the second instance and within a threshold distance from an edge of the portion, wherein multiple computing resources are displayed on the display unit, wherein each displayed computing resource is associated with a display priority value based on a time when the displayed computing resource was last selected, wherein the border comprises pixels that are not occupied by a computing resource that was selected after a last selection time of the second instance, wherein the security policy causes tracking, by a tracking service, of use of the second instance of the specified application, while forgoing causing tracking, by the tracking service, of use of the first instance of the specified application.
18 . The system of claim 17 , the operations further comprising:
identifying a computing resource as a supervised computing resource based on one or more of: a location of the computing resource in a directory or file system, a cloud storage location, a rule in the security policy, a process name or path, a uniform resource locator (URL) address, and whether the computing resource is launched from an application launcher associated with the multiple supervised computing resources.
19 . The system of claim 17 , wherein the multiple additional computing resources comprise personal computing resources, wherein the multiple supervised computing resources comprise organizational computing resources, wherein the multiple supervised computing resources and the multiple additional computing resources comprise files, applications or websites.
20 . The system of claim 17 , wherein the first instance of the specified application accesses least a portion of the multiple additional computing resources.
21 . The method of claim 1 , wherein the first instance accesses first common app platform application programming interfaces available to applications of the computing machine that use at least one of registry, remote procedure call, global objects, component object model, or universal application programming interfaces, wherein the second instance accesses second common app platform application programming interfaces of the multiple supervised computing resources that is different from the first common app platform application programming interfaces, wherein the first common app platform application programming interfaces comprise a universal windows platform.
22 . The method of claim 1 , wherein the first instance accesses first common app platform application programming interfaces available to applications of the computing machine that use at least one of registry, remote procedure call, global objects, component object model, or universal application programming interfaces, wherein the second instance accesses second common app platform application programming interfaces of the multiple supervised computing resources that is different from the first common app platform application programming interfaces, wherein the first common app platform application programming interfaces comprise at least one of shell infrastructure host, state repository service, background task infrastructure, user manager service, azure active directory broker, azure active directory credentials manager, host activity manager, application activation manager, or view manager.