Hardware-based virtualized security isolation

A device comprising:

• one or more processors;
• and
• one or more computer-readable storage media storing computer-readable instructions that are executable by the one or more processors to perform operations comprising:
• detecting that a web application that is running on a host operating system is attempting to access to a network resource that is accessible to the device via a network;
• in response to detecting that the web application is attempting to access the network resource, determining whether the network resource is an untrusted network resource by comparing the network resource to a policy received from a management and monitoring service that is located remotely from the device;
• in response to determining that the network resource is an untrusted network resource:
• activating a container that is isolated from the host operating system, the container being configured to run a version of the web application;
• passing the untrusted network resource to the container thereby allowing the version of the web application running in the container to access the untrusted network resource;
• passing an additional untrusted network resource to the container thereby allowing the version of the web application running in the container to access the additional untrusted network resource;
• and
• preventing the version of the web application running in the container from accessing a trusted network resource;
• and
• in response to determining that access to the untrusted and additional untrusted network resources has ended, suspending the container.

A device comprising:

• one or more processors;
• and
• one or more computer-readable storage media storing computer-readable instructions that are executable by the one or more processors to perform operations comprising:
• detecting that an application that is running on a host operating system is attempting to access a network resource that is accessible to the device via a network;
• in response to detecting that the application is attempting to access the network resource, determining whether the network resource is an untrusted network resource;
• in response to determining that the network resource is an untrusted network resource:
• activating a container that is isolated from the host operating system, the container being configured to run a version of the application;
• and
• passing the untrusted network resource to the container thereby allowing the version of the application running in the container to access the untrusted network;
• and
• in response to determining that access to the untrusted network resource has ended, suspending the container.

A computer program product comprising a storage device having computer-readable instructions recorded thereon that, when executed by a processor, cause the processor to perform operations that include:

• detecting that an application that is running on a host operating system is attempting to access a network resource that is accessible to the device via a network;
• in response to detecting that the application is attempting to access the network resource, determining whether the network resource is an untrusted network resource;
• in response to determining that the network resource is an untrusted network resource:
• activating a container that is isolated from the host operating system, the container being configured to run a version of the application;
• and
• passing the untrusted network resource to the container thereby allowing the version of the application running in the container to access the untrusted network resource;
• and
• in response to determining that access to the untrusted network resource has ended, suspending the container.