Dividing a data processing device into separate security domains

A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations for use of a computer device in two or more data security domains, the operations comprising:

• associating a first computer data processing device application with a first domain that is defined according to an external policy;
• bounding a first loader application to the first computer data processing device application, wherein the first loader application is configured to intercept and mediate requests between the first computer data processing device application and an operating system according to specifications of the external policy of the first domain without modifying the first computer data processing device application and without requiring operating system privileges, and the first loader application is located logically between the first computer data processing device application and the operating system;
• associating a first virtual private network (“VPN”) client application with the first domain;
• binding a second loader application to the first VPN client application, wherein the second loader application is configured to moderate activity of the VPN client application according to specifications of the external policy of the first domain;
• and
• in response to network data packets being in accordance with specifications of policies of the first domain at a first domain import-export policy enforcement point between first computer data processing device application and the first VPN client application, exchanging the network data packets from the first computer data processing device application to the first VPN client application.