Abstract: A method and apparatus for improving security for a workstation accessing network resources through a web browser interface. A three step procedure is provided on the workstation for testing the origin and filetype extensions of command files, retrieved by a web browser, to determine whether they may be executed on the workstation. Step one of the invention consists of creating a non-standard command filetype extension on the workstation to be protected. This is followed by step two which isolates specific network or system resources for all approved command files. Finally, step three protects the command file contents and sub-directory locations on the protected workstation. The invention grants execute permission for an application file command files only when all three conditions of the above steps are met.