Systems and methods for generating device-specific security policies for applications

1. A computer-implemented method for generating device-specific security policies for applications, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

directing, by the computing device, an application running on the computing device to perform a series of tasks;

while the application is performing the series of tasks, monitoring, by the computing device, interactions between the application and a computing environment in which the application operates to identify:

computing resources within the computing environment that are required by the application to operate properly within the computing environment;

computing resources within the computing environment that are not required by the application to operate properly within the computing environment; and

potential security concerns related to the application within the computing environment;

generating, at least in part by the computing device, based on the monitored interactions, a set of device-specific security policies that enable the application to operate properly within the computing environment while mitigating the potential security concerns by:

allowing, by the computing device, the application to access the required computing resources while the application operates within the computing environment; and

restricting, by the computing device, the application from accessing at least a portion of the computing resources that are not required by the application; and

enforcing, by the computing device, the set of device-specific security policies within the computing environment while the application runs on the computing device.

2. The method of claim 1 :

further comprising installing the application onto the computing device in an application container that separates the application from other applications on the computing device; and

wherein monitoring the interactions between the application and the computing environment comprises monitoring communications sent to and from the application container.

3. The method of claim 2 , further comprising a backend security server that ships the application in the application container to the computing device in response to a request from the computing device to receive the application.

4. The method of claim 1 , wherein the potential security concerns related to the application comprise a potentially malicious computing resource within the computing environment.

5. The method of claim 1 , wherein:

the computing environment comprises at least one network accessible to the computing device; and

monitoring the interactions between the application and the computing environment comprises at least one of:

identifying network ports within the network used by the application;

identifying additional applications connected to the network; and

identifying characteristics of the network.

6. The method of claim 5 , wherein generating the set of device-specific security policies comprises generating policies that restrict the access of the application and the additional applications to the network ports used by the application based on at least one of:

the characteristics of the network; and

characteristics of the additional applications.

7. The method of claim 5 , wherein the characteristics of the network comprise at least one of:

a type of the network;

a security level of the network; and

a provider of the network.

8. The method of claim 1 , wherein:

the computing environment comprises at least one file system within the computing device; and

monitoring the interactions between the application and the computing environment comprises intercepting attempts by the application to access files within the file system.

9. The method of claim 8 , wherein generating the set of device-specific security policies comprises generating policies that define at least one of:

permissions granted to the application within the file system; and

files accessible to the application within the file system.

10. A system for generating device-specific security policies for applications, the system comprising:

a monitoring module, stored in memory, that:

directs, on a computing device, an application running on the computing device to perform a series of tasks; and

monitors, on the computing device, while the application is performing the series of tasks, interactions between the application and a computing environment in which the application operates to identify:

computing resources within the computing environment that are required by the application to operate properly within the computing environment;

computing resources within the computing environment that are not required by the application to operate properly within the computing environment; and

potential security concerns related to the application within the computing environment;

a generation module, stored in memory, that:

generates, on the computing device, based on the monitored interactions, a set of device-specific security policies that enable the application to operate properly within the computing environment while mitigating the potential security concerns by:

allowing, on the computing device, the application to access the required computing resources while the application operates within the computing environment; and

restricting, on the computing device, the application from accessing at least a portion of the computing resources that are not required by the application; and

enforces, on the computing device, the set of device-specific security policies within the computing environment while the application runs on the computing device; and

at least one hardware processor configured to execute the monitoring module and the generation module.

11. The system of claim 10 :

further comprising an installation module that installs the application onto the computing device in an application container that separates the application from other applications on the computing device; and

wherein the monitoring module monitors the interactions between the application and the computing environment by monitoring communications sent to and from the application container.

12. The system of claim 11 , further comprising a shipping module, implemented on a backend security server, that ships the application in the application container to the computing device in response to a request from the computing device to receive the application.

13. The system of claim 10 , wherein the potential security concerns related to the application comprise a potentially malicious computing resource within the computing environment.

14. The system of claim 10 , wherein:

the computing environment comprises at least one network accessible to the computing device; and

the monitoring module monitors the interactions between the application and the computing environment by at least one of:

identifying network ports within the network used by the application;

identifying additional applications connected to the network; and

identifying characteristics of the network.

15. The system of claim 14 , wherein the generation module generates the set of device-specific security policies by generating policies that restrict the access of the application and the additional applications to the network ports used by the application based on at least one of:

the characteristics of the network; and

characteristics of the additional applications.

16. The system of claim 14 , wherein the characteristics of the network comprise at least one of:

a type of the network;

a security level of the network; and

a provider of the network.

17. The system of claim 10 , wherein:

the computing environment comprises at least one file system within the computing device; and

the monitoring module monitors the interactions between the application and the computing environment by intercepting attempts by the application to access files within the file system.

18. The system of claim 17 , wherein the generation module generates the set of device-specific security policies by generating policies that define at least one of:

permissions granted to the application within the file system; and

files accessible to the application within the file system.

19. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

direct, by the computing device, an application running on the computing device to perform a series of tasks;

while the application is performing the series of tasks, monitor, by the computing device, interactions between the application and a computing environment in which the application operates to identify:

computing resources within the computing environment that are required by the application to operate properly within the computing environment;

computing resources within the computing environment that are not required by the application to operate properly within the computing environment; and

potential security concerns related to the application within the computing environment;

generate, at least in part by the computing device, based on the monitored interactions, a set of device-specific security policies that enable the application to operate properly within the computing environment while mitigating the potential security concerns by:

allowing, by the computing device, the application to access the required computing resources while the application operates within the computing environment; and

restricting, by the computing device, the application from accessing at least a portion of the computing resources that are not required by the application; and

enforce, by the computing device, the set of device-specific security policies within the computing environment while the application runs on the computing device.

20. The method of claim 1 , wherein directing the application to perform the series of tasks comprises directing the application to perform at least one task the application is expected to perform during normal operation of the application.