A method of protecting resources in a computer system against tampering by a user process, the method comprising: providing a plurality of resources (115, 125) of the computer system; controlling access to the resources of the computer system using an access control list; creating a protection group as a local security group; adding a deny access control entry to the access control list thereby restricting access to the certain of the resources by members of the protection group; characterised by: identifying key resources which are associated with a security application in the computer system and, in response, including the deny access control entry in the access control list of the key resources; providing the user process initially in an unprivileged user-level security context as defined by an initial access token; performing a process elevation, by the security application, to selectively grant a privileged user security context as an elevation of the privilege level of the user process, wherein the user process in the privileged user security context has an access token denoting access rights capable of accessing the key resources according to the access control list; intercepting the user process; creating a revised access token by revising the initial access token of the user process to include the protection group, thereby identifying the user process as a member of the protection group; applying the revised access token to the user process; executing the user process using the revised access token; and in response to the user process requesting access to any of the one or more key resources of the security application, matching the protection group in the revised access token of the user process against the deny access control entry in the access control list of the key resources, thereby restricting access by the user process to the key resources. providing a plurality of resources (115, 125) of the computer system; controlling access to the resources of the computer system using an access control list; creating a protection group as a local security group; adding a deny access control entry to the access control list thereby restricting access to the certain of the resources by members of the protection group; identifying key resources which are associated with a security application in the computer system and, in response, including the deny access control entry in the access control list of the key resources; providing the user process initially in an unprivileged user-level security context as defined by an initial access token; performing a process elevation, by the security application, to selectively grant a privileged user security context as an elevation of the privilege level of the user process, wherein the user process in the privileged user security context has an access token denoting access rights capable of accessing the key resources according to the access control list; intercepting the user process; creating a revised access token by revising the initial access token of the user process to include the protection group, thereby identifying the user process as a member of the protection group; applying the revised access token to the user process; executing the user process using the revised access token; and in response to the user process requesting access to any of the one or more key resources of the security application, matching the protection group in the revised access token of the user process against the deny access control entry in the access control list of the key resources, thereby restricting access by the user process to the key resources.