1. A method for protecting a virtual machine network, the method comprising: storing an application whitelist in memory, wherein the application whitelist includes application to user associations and the application whitelist is immutable by a guest virtual machine; receiving a request to execute an application on the guest virtual machine, the request comprising an application identifier associated with the application and a user identifier associated with a user requesting execution of the application; comparing the application identifier and the user identifier of the request with the application whitelist; and generating an execution decision, wherein the execution decision indicates whether the requested application can execute on the guest virtual machine.