A method performed by one or more data processing apparatus, the method comprising: maintaining (405, 605) one or more application profiles, each application profile associated with one or more network activities in a network and corresponding to an application (122a, 122b) configured to execute on one or more devices (120a, 120b, 122c) in the network, wherein the network comprises a private network; detecting (410, 610) one or more network activities in the network associated with a device, the one or more activities directed outside the network to a public network; determining (415, 615) that an application corresponding to a predetermined application profile is executing on the device based at least in part on the one or more detected network activities associated with the device directed outside the network substantially match network activities associated with the predetermined application profile; upon the determination, associating the device with a restricted network profile configured to deny access by the device to one or more first resources within the network, and allow access by the device to one or more second resources within the network; and denying access by the device to the one or more first resources within the network, and allowing access by the device to the one or more second resources within the network in accordance with the restricted network profile. maintaining (405, 605) one or more application profiles, each application profile associated with one or more network activities in a network and corresponding to an application (122a, 122b) configured to execute on one or more devices (120a, 120b, 122c) in the network, wherein the network comprises a private network; detecting (410, 610) one or more network activities in the network associated with a device, the one or more activities directed outside the network to a public network; determining (415, 615) that an application corresponding to a predetermined application profile is executing on the device based at least in part on the one or more detected network activities associated with the device directed outside the network substantially match network activities associated with the predetermined application profile; upon the determination, associating the device with a restricted network profile configured to deny access by the device to one or more first resources within the network, and allow access by the device to one or more second resources within the network; and denying access by the device to the one or more first resources within the network, and allowing access by the device to the one or more second resources within the network in accordance with the restricted network profile. associating the device with a restricted network profile configured to deny access by the device to one or more first resources within the network, and allow access by the device to one or more second resources within the network; and deny access by the device to one or more first resources within the network, and allow access by the device to one or more second resources within the network; and denying access by the device to the one or more first resources within the network, and allowing access by the device to the one or more second resources within the network in accordance with the restricted network profile.