Use of an application controller to monitor and control software file and application environments

A computer program product for operating an application controller on an endpoint in an enterprise network, the computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of:

• receiving a file at an endpoint from a network;
• determining that a reputation of the file is untrusted based on metadata for the file indicating that a source of the file is the network;
• selecting a software application to open the file based on the metadata for the file;
• opening the file with the software application, wherein the software application uses an application controller to open the file with limited access to one or more resources based on the reputation of the file being untrusted due to the source of the file in the metadata;
• managing use of the file by the software application;
• receiving a reputation update to the reputation of the file;
• and
• escalating the software application to an insecure configuration by granting the software application access to additional resources based on the reputation update.

An endpoint comprising:

• a memory storing computer executable instructions that, when executed, provide an application controller for managing applications executing on the endpoint;
• and
• one or more processors configured by the computer executable instructions to operate the application controller by performing the steps of:
• in response to a selection of a file, determining at least one access and security parameter for the file;
• selecting a software application on the endpoint suitable for opening the file based on a security configuration according to the at least one access and security parameter, wherein the software application limits access by the file to resources of the endpoint when the file has an untrusted reputation due to a source of the file more than the software application limits access to resources for one or more other files with a good reputation;
• launching the selected software application to open the file and access the file in accordance with the security configuration;
• controlling a use of the file by the software application in a test mode to require that the use of the file is in accord with the at least one access and security parameter for the file;
• receiving an update to a reputation of the file;
• and
• in response to the update, permitting a user to escalate the use of the file by the software application from the test mode to an insecure mode by providing the software application with access to additional resources of the endpoint based on the reputation of the file.