Unified file system on air-gapped endpoints

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for performing user experience (UX) functions on a virtually air-gapped endpoint that has at least a first virtual machine and a second virtual machine, the first virtual machine instantiating a first security zone and the second virtual machine instantiating a second security zone, the process comprising:

• name mirroring folders and files within common folders across the first and second security zones by placing stub files and folders within the common folders of the second security zone that are linked to corresponding, respective files and folders within the common folders of the first security zone;
• monitoring the first and second security zones instantiated on the virtually air-gapped endpoint to intercept at least one file system operation to access files on the first security zone;
• determining if the detected file system operation triggers a display of a file system dialog window of the second security zone;
• and
• when the file system dialog window of the second security zone is determined to be triggered,
• preventing the display of a file system dialog window in the first security zone;
• and
• displaying the file system dialog window of the second security zone in the second security zone so as to display at least one of the name mirrored folders and files of the first security zone.

A computing system, comprising:

• a network card interface;
• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to become a virtually air-gapped endpoint that has at least a first virtual machine and a second virtual machine, the first virtual machine instantiating a first security zone and the second virtual machine instantiating a second security zone, the instructions further configuring the processing circuitry to:
• name mirror folders and files within common folders across the first and second security zones by placing stub files and folders within the common folders of the second security zone that are linked to corresponding, respective files and folders within the common folders of the first security zone;
• monitor the first and second security zones instantiated on the virtually air-gapped endpoint to intercept at least one file system operation to access files on the first security zone;
• determine if the detected file system operation triggers a display of a file system dialog window of the second security zone;
• and
• when the file system dialog window of the second security zone is determined to be triggered,
• prevent the display of a file system dialog window in the first security zone;
• and
• display the file system dialog window of the second security zone in the second security zone so as to display at least one of the name mirrored folders and files of the first security zone.