Computer security management, such as in a virtual machine or hardened operating system

A method in a computer system for protecting an operating system against damage caused by undesirable process actions, the method comprising:

• pausing a kernel running on the operating system, wherein the operating system is at least partially isolated from core aspects of the computer system's infrastructure;
• checking the kernel to determine whether there is evidence of an undesirable process action, wherein the checking is performed, at least in part, by a supervisory process that is separate from the at least partially isolated operating system;
• and
• where there is evidence of an undesirable process action in the at least partially isolated operating system, taking steps to contain the undesirable process action.

A computer system for securing access to privileged operations associated with core components of the computer system, the system comprising:

• a processor;
• a primary memory storage in communication with the processor;
• a secondary storage device;
• an operating system;
• and
• a host system, wherein the host system includes:
• one or more virtual machines, wherein each of the one or more virtual machines is isolated from the core components of the computer system such that harmful processes cannot directly access the core components when running in an environment associated with the virtual machine, and wherein each one of the one or more virtual machines includes an instance of a virtual operating system, access to a virtual memory, and at least one virtual driver;
• and
• at least one supervisory process used to monitor the one or more virtual machines in combination with a security application, wherein the monitoring includes the possible detection of a harmful process, and wherein the at least one supervisory process and the security application are isolated from the virtual machine.