1. A method, comprising: running a first virtual policy enforcement point appliance using a hypervisor; running a first operating system using the first virtual policy enforcement point appliance, the first operating system including a firewall; and running a first application and a first policy enforcement point using the first operating system, the first virtual policy enforcement point appliance restricts all application layer communication to and from the first application to pass through the first policy enforcement point, the first policy enforcement point controls all application layer communication to and from the first application based on a set of policy constraints.