Use of an application controller to monitor and control software file and application environments
In embodiments, a framework for an extensible, file-based security system is described for determining an appropriate application, application environment, and/or access or security control measure based at least in part on a file's reputation.
1 . A method for operating an application controller on an endpoint in an enterprise network, the method comprising:
in response to a selection of a file, determining at least one access and security parameter for the file;
selecting a secure software application from a number of software applications on the endpoint suitable for opening the file based on a security configuration according to the at least one access and security parameter, wherein the secure software application includes a secure application for opening the file when the file has a poor or unknown reputation because the file was received from the Internet, and wherein the secure software application limits access by the file to resources of an environment of the endpoint more than one or more other files with a good reputation;
launching the selected software application to open the file and access the file in accordance with the security configuration;
controlling a use of the file by the secure software application in a test mode to require that the use of the file is in accord with the at least one access and security parameter for the file;
receiving an update to a reputation of the file; and
in response to the update, permitting a user to escalate the use of the file by the secure software application from the test mode to an insecure mode by providing the secure software application with access to additional resources of the endpoint based on the reputation of the file.
2 . The method of claim 1 , wherein permitting the user to escalate the use of the file includes increasing access to files on the endpoint when the reputation is updated to the good reputation.
3 . The method of claim 1 , wherein permitting the user to escalate the use of the file includes increasing access to network resources of the endpoint.
4 . The method of claim 1 , wherein permitting the user to escalate the use of the file includes increasing access to memory resources of the endpoint.
5 . The method of claim 1 , wherein permitting the user to escalate the use of the file includes increasing access to processes executing on the endpoint.
6 . The method of claim 1 , further comprising decreasing access to resources of the endpoint by the secure software application using the file when the reputation of the file is updated to a poor reputation.
7 . A computer program product for operating an application controller on an endpoint in an enterprise network, the computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of:
receiving a file at an endpoint from a network;
determining that a reputation of the file is untrusted based on metadata for the file indicating that a source of the file is the network;
selecting a software application to open the file based on the metadata for the file;
opening the file with the software application, wherein the software application uses an application controller to open the file with limited access to one or more resources based on the reputation of the file being untrusted due to the source of the file in the metadata;
managing use of the file by the software application;
receiving a reputation update to the reputation of the file; and
escalating the software application to an insecure configuration by granting the software application access to additional resources based on the reputation update.
8 . The computer program product of claim 7 , wherein the application controller stores the reputation that is associated with the file.
9 . The computer program product of claim 7 , wherein the application controller is configured to adjust the one or more resources available to the selected software application by managing communications related to the selected software application.
10 . The computer program product of claim 9 , wherein the one or more resources include a network.
11 . The computer program product of claim 9 , wherein the one or more resources include a local file system on the endpoint.
12 . The computer program product of claim 9 , wherein the one or more resources include a process executing on the endpoint.
13 . The computer program product of claim 9 , wherein the one or more resources include a memory.
14 . The computer program product of claim 7 , wherein the one or more resources include a registry of the endpoint.
15 . The computer program product of claim 7 , wherein the metadata for determining the reputation includes data relating to a file format.
16 . The computer program product of claim 7 , wherein the source of the file includes data relating to an originating location of the file.
17 . The computer program product of claim 16 , wherein the originating location is an Internet URL.
18 . The computer program product of claim 16 , wherein the originating location is an IP address.
19 . An endpoint comprising:
a memory storing computer executable instructions that, when executed, provide an application controller for managing applications executing on the endpoint; and
one or more processors configured by the computer executable instructions to operate the application controller by performing the steps of:
in response to a selection of a file, determining at least one access and security parameter for the file;
selecting a software application on the endpoint suitable for opening the file based on a security configuration according to the at least one access and security parameter, wherein the software application limits access by the file to resources of the endpoint when the file has an untrusted reputation due to a source of the file more than the software application limits access to resources for one or more other files with a good reputation;
launching the selected software application to open the file and access the file in accordance with the security configuration;
controlling a use of the file by the software application in a test mode to require that the use of the file is in accord with the at least one access and security parameter for the file;
receiving an update to a reputation of the file; and
in response to the update, permitting a user to escalate the use of the file by the software application from the test mode to an insecure mode by providing the software application with access to additional resources of the endpoint based on the reputation of the file.
20 . The endpoint of claim 19 , wherein the reputation of the file is untrusted because the source of the file is the Internet.