1. A method of linking a security policy stored in a policy database and which is specific to an application in an application layer with a corresponding new process launched in a user mode of a lower layer in a security system for an operating system running on a device, an architecture of the operating system comprising a kernel operable in a kernel mode of the lower layer and a middleware layer between the lower layer associated with the kernel and the higher application layer comprising the applications, the method comprising: monitoring a specialization process, executed in the user mode of the lower layer by the operating system, of the corresponding new process as it specializes as its intended application, the specialization process executed by the operating system comprising identifying the application in the application layer to which the new process corresponds and loading the application-specific code for that application into the process for execution; extracting application identification data from the specialization process that is indicative of the application or type of application the new process is specializing as; and creating a link between the new process and a security policy from the policy database based on the application identification data.