Providing a security boundary

1. A computer-implemented method for providing a security boundary, the computer-implemented method comprising performing computer-implemented operations for:

executing, by a computer, a security monitor in a learning mode of operation wherein the security monitor performs operations for

intercepting by way of the security monitor one or more application programming interface (API) calls placed by an application for accessing one or more system resources,

storing data in a security monitor database associated with accessing the system resources,

associating one or more access control lists (ACLs) with the system resources requested when intercepting the API calls to be used by the application, and

loading the security monitor database with the one or more ACLs; and

executing the security monitor in an enforcement mode of operation wherein the security monitor performs operations for

determining by way of the security monitor at a runtime of the application whether the application placing the one or more API calls is authorized to access the system resources,

allowing the application access to the system resources when data associated with the application is located in the security monitor database, and

preventing the application access to the system resources when data associated with the application is not located in the security monitor database.

2. The computer-implemented method of claim 1 , further comprising providing data related to the application prevented access to the system resources to an administrator.

3. The computer-implemented method of claim 1 , wherein the application is a virtual application.

4. The computer-implemented method of claim 3 , wherein the virtual application is running on a single physical machine on which other virtual applications are running.

5. The computer-implemented method of claim 4 , wherein the virtual application and other virtual applications are executed within a partition.

6. The computer-implemented method of claim 1 , wherein the system resource comprises at least one of a communications port, a registry, an open database connectivity connection string, or an endpoint.

7. An optical disk, a magnetic storage device, or a solid state storage device having computer-readable instructions stored thereupon which, when executed by a computer, cause the computer to:

execute a security monitor in a learning mode of operation, wherein when in the learning mode of operation, the security monitor

intercepts by way of a security monitor one or more application program interface (API) calls placed by an application for accessing one or more system resources,

stores data related to the API calls in a security monitor database,

associates one or more access control lists (ACLs) with the system resources requested when intercepting the API calls to be used by the application, and

loads the security monitor database with the one or more ACLs;

execute the security monitor in an enforcement mode of operation, wherein when in the enforcement mode of operation, the security monitor

isolates one or more other applications from accessing the system resources based on the data stored in the security monitor database,

allows the application access to the system resources when data associated with the application is found in the security monitor database, and

prevents the application from accessing the system resources when data associated with the application is not found in the security monitor database.

8. The optical disk, the magnetic storage device, or the solid state storage device of claim 7 , having further computer-executable instructions stored thereon which, when executed by the computer, cause the computer to:

provide a security monitor within a virtualization layer; and

associate one or more access control lists (ACLs) with the system resources.

9. The optical disk, the magnetic storage device, or the solid state storage device of claim 7 further comprising providing data related to the application prevented from accessing the system resources to an administrator.

10. The optical disk, the magnetic storage device, or the solid state storage device of claim 9 , wherein the administrator can allow access to the system resources to the application prevented from accessing the system resources.

11. The optical disk, the magnetic storage device, or the solid state storage device of claim 7 , wherein the application is a virtual application.

12. The optical disk, the magnetic storage device, or the solid state storage device of claim 11 , wherein the virtual application is running on a single physical machine on which other virtual applications are running.

13. The optical disk, the magnetic storage device, or the solid state storage device of claim 12 , wherein the system resources are hidden from the other virtual applications running on the single physical machine using namespace hiding.

14. The optical disk, the magnetic storage device, or the solid state storage device of claim 13 , wherein the system resource comprises at least one of a communications port, a registry, an open database connectivity connection string, or an endpoint.

15. A computer-implemented method for providing a security boundary, the computer-implemented method comprising performing computer-implemented operations for:

executing, by a computer, a security monitor in a learning mode of operation during which application programming interface (API) calls placed by an application for accessing a system resource are intercepted and access control lists (ACLs) associated with the system resource are stored in a security monitor database; and

executing the security monitor in an enforcement mode of operation during which application programming interface (API) calls placed by the application are intercepted and a determination of whether ACLs associated with the application are stored in the security monitor database, wherein the application is authorized to access system resources when ACLs associated with the application are stored in the security monitor database, and the application is not authorized to access system resources when ACLs associated with the application are not stored in the security monitor database.

16. The computer-implemented method of claim 15 , wherein the application comprises a virtual application and wherein the system resource comprises at least one of a communications port, a registry, an open database connectivity connection string, or an endpoint.