Threat isolation using a plurality of containers

A host computer system configured to connect to a network, wherein the host computer system comprising:

• a memory;
• and
• a processor configured to:
• implement an operating system that enables operation of a workspace, the workspace configured to enable operation of a first set of one or more applications or processes via a first memory space;
• implement a plurality of isolated computing environments, the plurality of isolated computing environments comprising a first isolated computing environment that is configured to enable operation of a second set of one or more applications or processes via a second memory space, and a second isolated computing environment that is configured to enable operation of a third set of one or more applications or processes via a third memory space;
• isolate the first isolated computing environment from at least the workspace and from the second isolated computing environment using a first firewall associated with the first isolated computing environment;
• isolate the second isolated computing environment from at least the workspace and from the first isolated computing environment using a second firewall associated with the second isolated computing environment;
• and
• isolate the workspace from at least one network destination using a host-based firewall, the host-based firewall is configured to block a data communication sent to the workspace from the at least one network destination.

A method of configuring a host computer system to connect to a network, wherein the method comprising:

• implementing an operating system that enables operation of a workspace via the host computer system, the workspace configured to enable operation of a first set of one or more applications or processes via a first memory space;
• implementing a plurality of isolated computing environments via the host computer system, the plurality of isolated computing environments comprising a first isolated computing environment that is configured to enable operation of a second set of one or more applications or processes via a second memory space, and a second isolated computing environment that is configured to enable operation of a third set of one or more applications or processes via a third memory space;
• isolating the plurality of isolated computing environment from the workspace using an isolation firewall;
• isolating the first isolated computing environment from the second isolated computing environment using the isolation firewall;
• and
• isolating the workspace from at least one network destination using a host-based firewall, the host-based firewall is configured to block a data communication sent to the workspace from the at least one network destination.