1. One or more non-transitory machine readable media that includes code for execution and when executed by one or more processors is operable to perform operations comprising: intercepting, on a computing device, a network access attempt associated with a process executing on the computing device; determining a plurality of software program files mapped to the process, wherein at least one software program file of the plurality of software program files is an executable file and at least one other software program file of the plurality of software program files is a library module loaded by the process; determining trust statuses of at least the executable file and the library module; determining whether the network access attempt is permitted based, at least in part, on the trust statuses of the executable file and the library module; and performing an action if the network access attempt is not permitted, wherein if one of the software program files is determined to have an untrusted status, the network access attempt is permitted if a destination address of the network access attempt is contained in a set of allowed destination addresses indicated by a network access policy associated with the one of the software program files.