1. Apparatus for securing data comprising: a computing device having stored thereon instructions that upon execution cause: a secure environment definer to be configured to define a secure environment within an existing user environment, said definer configured to define a boundary about said environment across which data cannot pass and a channel out of said secure environment, the secure environment definer further being configured to define a filter associated with said channel out of said secure environment, said filter being definable to control passage of data out of said secure environment; and an environment selector configured to detect an attempt to perform an operation on a data unit, to classify a type of the data unit, and to select a selected processing environment among a plurality of processing environments that includes the secure environment based on the classification, and to restrict the performance of the operation to the selected processing environment according to a predefined policy.