A method for protecting resources from unauthorized access, comprising: - dividing applications (101a, 101b) into at least two groups and determining safety policies for each group, wherein a security policy is established for applications working at least partly with confidential data, while no such restrictions are placed on the rest of the applications; - providing a library of handler functions that controls access of one or more applications working at least partly with confidential data to protected resources on a computer device; - associating the security policy with the library of handler functions, wherein the security policy specifies access rules for accessing protected resources by the applications working at least partly with confidential data; - modifying the one or more applications working at least partly with confidential data to access the library of handler functions instead of corresponding application program interface functions of the computer device by replacing one or more classes or methods of the one or more applications that perform function calls to the protected resources with one or more function calls to corresponding handler functions contained in the library; - placing the modified applications into one or more containers (301, 301a, 301b, 401) that are configured to isolate the modified applications from an execution environment of the computer device, and configuring the security policies for each container (301, 301a, 301b, 401), wherein a plurality of modified applications covered by the same security policy are placed in a same container and the library of handler functions associated with the security policy is located in the same container; - receiving by a handler function of the library of handler functions in the container an API function call from a modified application; - determining by the handler function in the container whether the received API function call complies with the access rules; - when the API function call complies with the access rules, performing by the handler function in the container the API function call from the modified application to the protected resources; and - when the API function call violates the access rules, blocking by the handler function in the container the API function call. - dividing applications (101a, 101b) into at least two groups and determining safety policies for each group, wherein a security policy is established for applications working at least partly with confidential data, while no such restrictions are placed on the rest of the applications; - providing a library of handler functions that controls access of one or more applications working at least partly with confidential data to protected resources on a computer device; - associating the security policy with the library of handler functions, wherein the security policy specifies access rules for accessing protected resources by the applications working at least partly with confidential data; - modifying the one or more applications working at least partly with confidential data to access the library of handler functions instead of corresponding application program interface functions of the computer device by replacing one or more classes or methods of the one or more applications that perform function calls to the protected resources with one or more function calls to corresponding handler functions contained in the library; - placing the modified applications into one or more containers (301, 301a, 301b, 401) that are configured to isolate the modified applications from an execution environment of the computer device, and configuring the security policies for each container (301, 301a, 301b, 401), wherein a plurality of modified applications covered by the same security policy are placed in a same container and the library of handler functions associated with the security policy is located in the same container; - receiving by a handler function of the library of handler functions in the container an API function call from a modified application; - determining by the handler function in the container whether the received API function call complies with the access rules; - when the API function call complies with the access rules, performing by the handler function in the container the API function call from the modified application to the protected resources; and - when the API function call violates the access rules, blocking by the handler function in the container the API function call.