A machine-implemented method for securing a data processing system , the method comprising: storing, by at least one of hardware and firmware in the data processing system, in one or more buried memory zones that are not intelligibly accessible to user software , to operating system software or to master or supplemental processors , metadata identifying one or more first other parts of a system memory of the data processing system where the identified one or more first other parts are thereby mapped as being protected regions and where the stored metadata defines at least one of access constraints for those identified one or more first other parts, corresponding operational constraints and/or operational requirements that respectively constrain the operations performed by or on the data of the identified first other parts; during execution of at least one of user software and operating system software in the data processing system , enforcing , by the at least one of hardware and firmware of the data processing system, the operational constraints and/or operational requirements as mapped by the metadata to their corresponding first other parts of the system memory; and obtaining from an application defining file for a first application, corresponding first metadata defining extents of one or more first protection regions 'PR's" whether provided as fragments or as wholes, where the PR's are to be constituted by corresponding first allocated virtual areas of the system memory, the first allocated virtual areas being ones allocated to the first application for containing at least one of first informational data items and first executable code belonging to the first application. storing, by at least one of hardware and firmware in the data processing system, in one or more buried memory zones that are not intelligibly accessible to user software , to operating system software or to master or supplemental processors , metadata identifying one or more first other parts of a system memory of the data processing system where the identified one or more first other parts are thereby mapped as being protected regions and where the stored metadata defines at least one of access constraints for those identified one or more first other parts, corresponding operational constraints and/or operational requirements that respectively constrain the operations performed by or on the data of the identified first other parts; during execution of at least one of user software and operating system software in the data processing system , enforcing , by the at least one of hardware and firmware of the data processing system, the operational constraints and/or operational requirements as mapped by the metadata to their corresponding first other parts of the system memory; and obtaining from an application defining file for a first application, corresponding first metadata defining extents of one or more first protection regions 'PR's" whether provided as fragments or as wholes, where the PR's are to be constituted by corresponding first allocated virtual areas of the system memory, the first allocated virtual areas being ones allocated to the first application for containing at least one of first informational data items and first executable code belonging to the first application. <EOS>