Operation restriction based on security policy
A computer stores, within a single user account, multiple supervised computing resources and multiple additional computing resources. The multiple supervised computing resources are associated with a security policy. The computer executes a first instance of a specified application that lacks read access and lacks write access to any and all of the multiple supervised computing resources. The computer executes, simultaneously with the first instance, a second instance of the specified application that accesses at least a portion of the multiple supervised computing resources. The computer applies rules from the security policy to the second instance of the specified application while foregoing applying the rules from the security policy to the first instance of the specified application.
1. A method comprising:
storing, at a computing machine, multiple supervised computing resources and multiple unsupervised computing resources, wherein the multiple supervised computing resources are associated with a security policy;
receiving, at the computing machine, a signal representing a request for a specified operation;
determining, based on an active computing resource and other computing resources open at the computing machine when the signal is received, whether the specified operation is associated with a supervised computing resource from among the multiple supervised computing resources;
providing, in response to determining that the specified operation is associated with the supervised computing resource, the request for the specified operation to a security policy enforcement engine, wherein the security policy enforcement engine intercepts the request;
adjusting, using the security policy enforcement engine and based on security rules in the security policy, the request for the specified operation or a state of one or more of the multiple supervised computing resources prior to providing the request to an operating system resource or to the supervised computing resource; and
providing the request to the operating system resource or to the supervised computing resource, wherein the multiple unsupervised computing resources access first common app platform application programming interfaces available to applications of the computing machine that use at least one of registry, remote procedure call, global objects, component object model, or universal application programming interfaces, wherein the multiple supervised computing resources access second common app platform application programming interfaces of the multiple supervised computing resources that is different from the first common app platform application programming interfaces.
2. The method of claim 1 , wherein:
the supervised computing resources comprise organizational computing resources,
the unsupervised computing resources comprise personal computing resources,
the multiple supervised computing resources and the multiple unsupervised computing resources comprise files, cloud file storage access, applications or websites, and
security rules from the security policy are applied to the multiple supervised computing resources and are not applied to the multiple unsupervised computing resources.
3. The method of claim 1 , further comprising:
foregoing adjusting the request using the security policy enforcement engine in response to determining that the specified operation is not associated with the supervised computing resource.
4. The method of claim 1 , further comprising:
determining that the specified operation is associated with the supervised computing resource and an unsupervised computing resource; and
providing, in response to determining that the specified operation is associated with the supervised computing resource and the unsupervised computing resource, the request to the device driver, the supervised computing resource, and the unsupervised computing resource after adjusting, by the security policy enforcement engine, the request for the specified operation or the state of the one or more of the multiple supervised computing resources.
5. The method of claim 1 , wherein the operating system resource comprises a controller associated with an input device or an output device coupled to the computing machine.
6. The method of claim 1 , wherein the security rules comprise one or more rules blocking a set of operations from the specified supervised computing resource to the specified additional computing resource, wherein the set of operations comprises at least one of: a drag and drop operation, a copy and paste operation, a cut and paste operation, a key log operation, a file download operation, a file upload operation, a file attachment operation, a printing operation, an opening a specific website operation, opening a category of website operation, an application launching operation or a screenshot operation.
7. The method of claim 1 , wherein:
the specified operation comprises a copy operation,
the active computing resource is the supervised computing resource,
the security policy enforcement engine, based on the security rules in the security policy, causes data copied by the copy operation to be intercepted, and
the intercepted data is accessible via the multiple supervised computing resources but not accessible via the multiple unsupervised computing resources.
8. The method of claim 7 , further comprising:
granting, based on the security rules in the security policy and in response to a paste operation request subsequent to the copy operation, access to the intercepted data to respond to the paste operation request if the paste operation request is associated with one of the multiple supervised computing resources; and
denying access to the intercepted data to respond to the paste operation request if the paste operation request is not associated with any one of the multiple supervised computing resources.
9. The method of claim 1 , wherein:
the specified operation comprises a keyboard input,
the active computing resource is the supervised computing resource, and
the security policy enforcement engine, based on the security rules in the security policy, blocks access, by the unsupervised computing resources, to the keyboard input provided to the supervised computing resource.
10. The method of claim 1 , wherein:
the specified operation comprises a drag-and-drop operation,
the active computing resource, associated with initiation of the drag-and-drop operation, is the supervised computing resource, and
the security policy enforcement engine, based on the security rules in the security policy, causes data copied by the drag-and-drop operation to be accessible via the multiple supervised computing resources but not accessible via the multiple unsupervised computing resources.
11. The method of claim 10 , wherein the drag-and-drop operation terminates at a destination computing resource, the method further comprising:
granting access to respond to the drag-and-drop operation request if the destination computing resource is one of the multiple supervised computing resources; and
denying access to respond to the drag-and-drop operation request if the destination computing resource is not one of the multiple supervised computing resources.
12. The method of claim 1 , wherein:
the specified operation comprises a screen capture operation,
the security policy enforcement engine, based on the security rules in the security policy, blocks or watermarks screen capture of screen regions associated with supervised computing resources while allowing screen capture of screen regions not associated with the supervised computing resources, and
watermarking comprises overlaying the screen regions associated with the computing resources with a representation of the security policy.
13. The method of claim 12 , wherein the screen capture operation comprises a screenshot operation or a screensharing operation.
14. The method of claim 12 , further comprising:
determining whether a given supervised computing resource, for which screen capture is to be blocked, leverages graphics processing unit (GPU) hardware acceleration;
if the given supervised computing resource leverages GPU hardware acceleration:
causing, by the security policy enforcement engine, the GPU to occlude or watermark a region associated with the given supervised computing resource on a display unit coupled to the computing machine during the screen capture operation; and
if the given supervised computing resource does not leverage GPU hardware acceleration:
occluding or watermarking a representation of the given supervised computing resource within an output of the screen capture operation; and
forgoing occluding and forgoing watermarking the region associated with the given supervised computing resource on the display unit coupled to the computing machine.
15. The method of claim 1 , wherein the first common app platform application programming interfaces comprise a universal windows platform.
16. The method of claim 1 , wherein the first common app platform application programming interfaces comprise at least one of shell infrastructure host, state repository service, background task infrastructure, user manager service, azure active directory broker, azure active directory credentials manager, host activity manager, application activation manager, or view manager.
17. A non-transitory machine-readable medium storing instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:
storing, at a computing machine, multiple supervised computing resources and multiple unsupervised computing resources, wherein the multiple supervised computing resources are associated with a security policy;
receiving, at the computing machine, a signal representing a request for a specified operation;
determining, based on an active computing resource and other computing resources open at the computing machine when the signal is received, whether the specified operation is associated with a supervised computing resource from among the multiple supervised computing resources;
providing, in response to determining that the specified operation is associated with the supervised computing resource, the request for the specified operation to a security policy enforcement engine, wherein the security policy enforcement engine intercepts the request;
adjusting, using the security policy enforcement engine and based on security rules in the security policy, the request for the specified operation or a state of one or more of the multiple supervised computing resources prior to providing the request to an operating system resource or to the supervised computing resource; and
providing the request to the operating system resource or to the supervised computing resource, wherein the multiple unsupervised computing resources access first common app platform application programming interfaces available to applications of the computing machine that use at least one of registry, remote procedure call, global objects, component object model, or universal application programming interfaces, wherein the multiple supervised computing resources access second common app platform application programming interfaces of the multiple supervised computing resources that is different from the first common app platform application programming interfaces.
18. The machine-readable medium of claim 17 , wherein:
the supervised computing resources comprise organizational computing resources,
the unsupervised computing resources comprise personal computing resources,
the multiple supervised computing resources and the multiple unsupervised computing resources comprise files, cloud file storage access, applications or websites, and
security rules from the security policy are applied to the multiple supervised computing resources and are not applied to the multiple unsupervised computing resources.
19. The machine-readable medium of claim 17 , the operations further comprising:
foregoing adjusting the request using the security policy enforcement engine in response to determining that the specified operation is not associated with the supervised computing resource.
20. The machine-readable medium of claim 17 , the operations further comprising:
determining that the specified operation is associated with the supervised computing resource and an unsupervised computing resource; and
providing, in response to determining that the specified operation is associated with the supervised computing resource and the unsupervised computing resource, the request to the device driver, the supervised computing resource, and the unsupervised computing resource after adjusting, by the security policy enforcement engine, the request for the specified operation or the state of the one or more of the multiple supervised computing resources.
21. The machine-readable medium of claim 17 , wherein the operating system resource comprises a controller associated with an input device or an output device coupled to the computing machine.
22. A system comprising:
processing circuitry; and
a memory storing instructions that, when executed by processing circuitry, cause the processing circuitry to perform operations comprising:
storing, at a computing machine, multiple supervised computing resources and multiple unsupervised computing resources, wherein the multiple supervised computing resources are associated with a security policy;
receiving, at the computing machine, a signal representing a request for a specified operation;
determining, based on an active computing resource and other computing resources open at the computing machine when the signal is received, whether the specified operation is associated with a supervised computing resource from among the multiple supervised computing resources;
providing, in response to determining that the specified operation is associated with the supervised computing resource, the request for the specified operation to a security policy enforcement engine, wherein the security policy enforcement engine intercepts the request;
adjusting, using the security policy enforcement engine and based on security rules in the security policy, the request for the specified operation or a state of one or more of the multiple supervised computing resources prior to providing the request to an operating system resource or to the supervised computing resource; and
providing the request to the operating system resource or to the supervised computing resource, wherein the multiple unsupervised computing resources access first common app platform application programming interfaces available to applications of the computing machine that use at least one of registry, remote procedure call, global objects, component object model, or universal application programming interfaces, wherein the multiple supervised computing resources access second common app platform application programming interfaces of the multiple supervised computing resources that is different from the first common app platform application programming interfaces.