A computer device, comprising: an execution environment arranged to execute a user process according to a user security context which defines access privileges of the user process, the user security context being derived from a user's account for the computer device; a security unit arranged to selectively control access by the user process to a plurality of resources (115, 125) available in the execution environment according to the user security context, wherein the user process is arranged to request access to a desired resource of the plurality of resources (115, 125) by making a system call to the security unit; and characterised in that the computer device further comprises a proxy resource access unit which includes: a proxy hook module embedded within the user process, wherein the proxy hook module is arranged to intercept the system call made by the user process to request access to the desired resource and to generate and send a proxy resource access request in response thereto; and a proxy service module arranged to execute in a privileged security context different from the user security context of the user process, wherein the proxy service module is arranged to receive and validate the proxy resource access request from the proxy hook module and, if validated, to obtain from the security unit a resource handle that permits access to the desired resource and to return the resource handle to the user process via the proxy hook module thereby permitting access by the user process to the desired resource by presenting the resource handle to the security unit, wherein the security unit when presented with an existing, open object handle permits access to the resource without further security checks made when access is requested using a name of the resource, provided that the requested access does not exceed the level of access appropriate to the handle. an execution environment arranged to execute a user process according to a user security context which defines access privileges of the user process, the user security context being derived from a user's account for the computer device; a security unit arranged to selectively control access by the user process to a plurality of resources (115, 125) available in the execution environment according to the user security context, wherein the user process is arranged to request access to a desired resource of the plurality of resources (115, 125) by making a system call to the security unit; and characterised in that the computer device further comprises a proxy resource access unit which includes: a proxy hook module embedded within the user process, wherein the proxy hook module is arranged to intercept the system call made by the user process to request access to the desired resource and to generate and send a proxy resource access request in response thereto; and a proxy service module arranged to execute in a privileged security context different from the user security context of the user process, wherein the proxy service module is arranged to receive and validate the proxy resource access request from the proxy hook module and, if validated, to obtain from the security unit a resource handle that permits access to the desired resource and to return the resource handle to the user process via the proxy hook module thereby permitting access by the user process to the desired resource by presenting the resource handle to the security unit, wherein the security unit when presented with an existing, open object handle permits access to the resource without further security checks made when access is requested using a name of the resource, provided that the requested access does not exceed the level of access appropriate to the handle. a proxy hook module embedded within the user process, wherein the proxy hook module is arranged to intercept the system call made by the user process to request access to the desired resource and to generate and send a proxy resource access request in response thereto; and a proxy service module arranged to execute in a privileged security context different from the user security context of the user process, wherein the proxy service module is arranged to receive and validate the proxy resource access request from the proxy hook module and, if validated, to obtain from the security unit a resource handle that permits access to the desired resource and to return the resource handle to the user process via the proxy hook module thereby permitting access by the user process to the desired resource by presenting the resource handle to the security unit, wherein the security unit when presented with an existing, open object handle permits access to the resource without further security checks made when access is requested using a name of the resource, provided that the requested access does not exceed the level of access appropriate to the handle.