Secure invocation of network security entities

A network device for secure deployment of security entities, comprising:

• a network entity having an interface to a security manager for identifying a plurality of computing entities adapted for invocation on a network entity in an interconnected network, each network entity adapted to launch and execute at least one network conversant app, the security manager further operable to:
• identify a manner of execution of each of the computing entities, the manner of execution defining supporting resources employed in the execution;
• and
• identify, based on the manner of execution, a security entity corresponding to each identified computing entity, the security entity operable to identify data associated with the computing entity;
• the network entity responsive to the security manager to deploy the identified security entity, the security entity responsive to a security agent previously deployed on the network entity;
• the network entity configured for enforcing a network policy by:
• receiving, at a security manager in communication with each of the security entities, an indication of security entity operation;
• evaluating the identified data upon ingress or egress to determine a security event;
• and
• communicating with the security manager to provide consistent continued instantiation of the security entity.

A computer program product on a non-transitory computer readable storage medium having instructions that, when executed by a processor, perform a method for enforcing network security, the method comprising:

• identifying a plurality of computing entities adapted for invocation on a network entity in an interconnected network, each network entity adapted to launch and execute at least one network conversant app;
• identifying a manner of execution of each of the computing entities, the manner of execution defining supporting resources employed in the execution;
• identifying, based on the manner of execution, a security entity corresponding to each identified computing entity, the security entity operable to identify data associated with the computing entity;
• deploying the identified security entity on a network entity, the security entity responsive to a security agent previously deployed on the network entity;
• receiving, at a security manager in communication with each of the security entities, an indication of security entity operation;
• and
• evaluating the identified data upon ingress or egress to determine a security event;
• and
• communicating with the security manager to provide consistent continued instantiation of the security entity.