Reliable selection of security countermeasures

A computer system for determining a manner in which to re-code an electronic resource, the system comprising:

• one or more computers including one or more memories;
• a request manager stored in the one or more memories in the one or more computers to receive requests for electronic resources from computing devices that are separate from the one or more computers and to obtain the electronic resources responsive to the requests;
• a security token manager stored in the one or more memories in the one or more computers to identify security tokens in the requests from the computing devices and to determine, based on values of the security tokens, the identities of particular entities who submitted the requests;
• a security policy manager stored in the one or more memories in the one or more computers to:
• (i) identify corresponding security policies for the particular entities whose identities were determined by the security token manager, the security policies indicating whether security countermeasures are to be applied to electronic resources served to respective ones of the particular entities, and if so, which of a plurality of available security countermeasures are to be applied, wherein the security countermeasures are operable to interfere with an ability of malware to interact with served electronic resources to which the security countermeasures have been applied when the served electronic resources are executed on the computing devices, and
• (ii) select, based on the identified security policies, respective sets of security countermeasures that are to be applied to the electronic resources that are to be served in response to the requests, including from among one or more first choices that result in applying no security countermeasures and one or more second choices that result in applying various versions of one or more particular security countermeasures to the electronic resources;
• a re-coding engine on the one or more computers to re-code the electronic resources requested by the computing devices using the one or more particular security countermeasures selected by the security policy manager when the security policy manager has chosen to apply the one or more particular security countermeasures;
• and
• a network interface on the one or more computers to serve the re-coded electronic resources to the computing devices.

One or more computer-readable devices having instructions stored thereon that, when executed by one or more processors, cause performance of operations for determining a manner in which to re-code an electronic resource, the operations comprising:

• receiving a request from a computing device for the electronic resource;
• identifying a security token received from the computing device along with the request;
• identifying, based on a value of the security token that identifies a particular entity that submitted the request, a security policy assigned to the particular entity that submitted the request;
• selecting, based on the identified security policy assigned to the particular entity that submitted the request, a set of security countermeasures to apply to the electronic resource to be served in response to the request, the security countermeasures operating to interfere with an ability of malware to interact with the served electronic resource when the served electronic resource is on the computing device, wherein selecting the set of security countermeasures comprises selecting from among multiple different choices that include a first choice to apply no security countermeasures and a second choice to apply one or more particular security countermeasures;
• in response to selecting the second choice to apply the one or more particular security countermeasures, re-coding first portions of the electronic resource that are to be executed on the computing device using the one or more particular security countermeasures;
• and
• serving a re-coded electronic resource having the re-coded first portions and other portions to the computing device in satisfaction of the request.