Use of an application controller to monitor and control software file and application environments
In embodiments of the present invention, a framework for an extensible, file-based security system is described for determining an appropriate application, application environment, and/or access or security control measure based at least in part on a file's reputation. In response to the selection of a file, an application controller may be used to select a software application from two or more software applications to open the selected file, based at least in part on the selected file's reputation. If launched, a software application may be configured to open the file in an environment, such as a virtual machine, quarantined environment, and the like, that is appropriate for the file based at least in part on the reputation information. A software application may be a secure software application configured to manage secure files, or an insecure software application configured to manage insecure files. The selected file, and communications relating to the selected software application, may be managed according to the selected software application's secure or insecure configuration. Further, the selected software application may associate reputation information with all files that are modified and/or created by the selected software application, including at least in part, reputation information matching that of the selected file.
1. A computer program product for operating an application controller on an endpoint in an enterprise network, the computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of:
in response to a selection of a file, retrieving a reputation of the file stored in metadata for the file, wherein the reputation includes at least one security parameter for the file and wherein the reputation is remotely stored in a database independent of the application controller and accessible by the application controller;
in response to the at least one security parameter, selecting a software application with the application controller from a number of software applications on the endpoint for opening the file based on the reputation of the file and a security configuration of the number of software applications, wherein the number of software applications includes at least one insecure application for opening the file in an application environment when the file has a good reputation and at least one secure application for opening the file in the application environment when the file has a poor or unknown reputation, and, as compared to opening the file in the application environment with the at least one insecure application, the at least one secure application opens the file in the application environment with more limited access to resources of the application environment;
launching the selected software application to open the file and access the file in accordance with the security configuration for the selected software application;
managing use of the file by the software application with the application controller, wherein the application controller is configured to adjust resources available to the selected software application on the endpoint based on the reputation of the file; and
escalating the selected software application to an insecure application by granting the selected software application access to additional resources of the application environment upon determination that the file has a good reputation.
2. The computer program product of claim 1 , wherein the application controller is enabled to store the reputation that is associated with the file.
3. The computer program product of claim 1 , wherein the application controller is configured to adjust resources available to the selected software application by managing communications related to the selected software application.
4. The computer program product of claim 3 , wherein communications relating to the selected software application include a network access communication.
5. The computer program product of claim 3 , wherein communications relating to the selected software application include a file access communication.
6. The computer program product of claim 3 , wherein communications relating to the selected software application include a process access communication.
7. The computer program product of claim 3 , wherein communications relating to the selected software application include a memory access communication.
8. The computer program product of claim 1 , wherein reputation information in the metadata includes data relating to a file format.
9. The computer program product of claim 1 , wherein reputation information in the metadata includes data relating to an originating location of the file.
10. The computer program product of claim 9 , wherein the originating location is an Internet URL.
11. The computer program product of claim 9 , wherein the originating location is an IP address.
12. The computer program product of claim 9 , wherein the origination location is a third software application.
13. The computer program product of claim 12 , wherein the third software application is a secure application.
14. A method for operating an application controller on an endpoint in an enterprise network, the method comprising:
in response to a selection of a file, retrieving a reputation of the file stored in metadata for the file, wherein the reputation includes at least one security parameter for the file and wherein the reputation is remotely stored in a database independent of the application controller and accessible by the application controller;
selecting a software application with the application controller from a number of software applications on the endpoint for opening the file based on the reputation of the file, wherein the number of software applications include at least one insecure application for opening the file in an application environment when the file has a good reputation and at least one secure application for opening the file in the application environment when the file has a poor or unknown reputation, and, as compared to opening the file in the application environment with the at least one insecure application, the at least one secure application opens the file in the application environment with more limited access to resources of the application environment;
launching the selected software application to open the file and access the file in accordance with a security configuration for the selected software application that controls access to resources of the application environment;
managing use of the file by the software application with the application controller;
updating the reputation of the file; and
changing the selected software application to an insecure software application with access to additional resources of the application environment in response to updating the reputation of the file.
15. The method of claim 14 , wherein adjusting the selected software application includes increasing access to resources of the application environment by adjusting to one of the at least one insecure applications when the reputation of the file is updated to a good reputation.
16. The method of claim 14 , wherein adjusting the selected software application includes decreasing access to resources of the application environment by adjusting to one of the at least one secure applications when the reputation of the file is updated to a poor reputation.
17. The method of claim 14 , wherein selecting the software application includes selecting one of the at least one secure applications when the reputation of the file is unknown.
18. The method of claim 14 , wherein managing use of the file by the software application includes managing access to resources of the application environment by the software application based on the reputation of the file.
19. The method of claim 14 , wherein reputation includes data relating to an origin of the file.
20. An endpoint comprising:
a memory storing computer executable instructions that, when executed, provide an application controller for managing applications executing on the endpoint; and
a processor configured to:
in response to a selection of a file on the endpoint, retrieve a reputation of the file including at least one security parameter stored in a database remote from the endpoint and accessible by the application controller;
in response to the at least one security parameter, select a software application from a number of software applications on the endpoint for opening the file based on the reputation of the file and a security configuration of the number of software applications, wherein the number of software applications include at least one insecure application for opening the file in an application environment when the file has a good reputation and at least one secure application for opening the file in the application environment when the file has a poor or unknown reputation, and, as compared to opening the file in the application environment with the at least one insecure application, the at least one secure application opens the file in the application environment with more limited access to a network of the application environment;
launch the selected software application to open the file and access the file in accordance with the security configuration for the selected software application; and
change the selected software application to an insecure software application with access to additional resources of the application environment based on a change in the reputation of the file.