Process-level control of encrypted content

A method comprising:

• encrypting a plurality of files on an endpoint to prevent unauthorized access to the plurality of files;
• receiving, from one of a plurality of processes executing on the endpoint, a request to access one of the plurality of files;
• decrypting the one of the plurality of files for the one of the plurality of processes with an extension to a file system of the endpoint that responsively applies rules for whether to allow or prohibit access to encrypted files within the file system on a process-by-process basis;
• monitoring a security state of the one of the plurality of processes, wherein monitoring the security state of the one of the plurality of processes includes monitoring network traffic associated with the one of the plurality of processes;
• and
• if the security state of the one of the plurality of processes becomes a compromised state, prohibiting access by the one of the plurality of processes to one or more of the plurality of files.

A system comprising:

• an endpoint;
• a first memory on the endpoint storing a plurality of files, the plurality of files encrypted to prevent unauthorized access;
• a second memory on the endpoint storing key material for decrypting the plurality of files;
• a plurality of processes executing on the endpoint;
• a file system on the endpoint configured to manage access by the plurality of processes to the plurality of files, the file system configured to respond to a request from the one of the plurality of processes for one of the plurality of files by conditionally decrypting the one of the plurality of files based on a security state of the one of the plurality of processes, with an extension to the file system on the endpoint that responsively applies rules for whether to allow or prohibit access to encrypted files within the file system on a process-by-process basis;
• and
• a gateway coupled in a communicating relationship with the endpoint, the gateway configured to monitor the security state of the one of the plurality of processes based on network traffic associated with the one of the plurality of processes.