The security model of mobile and desktop OS are very different and so you typically have very different levels of control.
Typically, on a desktop OS, you would restrict access based on the security principal associated with the security context (this typically means: the user and the user's session) while on a Mobile OS, you restrict the programs themselves.
This means that it's typically hard to prevent some specific program running under windows to do things that are allowed for your user account: if you have the right to write to a file, any program you run from your user session will have that same capability. (This is not completely true since things process integrity level can restrict access further but it's close enough for this answer).
Using a modern version of Windows, you can control the following (non-exhaustive list):
- Per user access securable resources (files, folders, registry and a slew of other more specialized objects).
- Per process and per user access to IP network resources based on IP address, IP protocol, TCP/UDP port number (and a few other things like ICMP message type).
- In addition to all this, you can (somewhat) restrict which which user can run what program both by restricting ACLs to the program's executables and through AppLocker.
(limiting access to CPU resources is possible but delicate. you usually need third party software to do so if adjusting the process priority isn't enough for your need).
There are several mechanism that can improve on that but they all have various requirements and capabilities so which one you might decide to investigate will depends on your exact requirements. Some can be combined together to better tailor the solution to your needs:
- Running a program in a VM will isolate it from the host OS almost completely. It is, however, quite resource intensive and could be complex to implement.
- Running the program in a sandbox can provide some limited isolation from your "main" OS session as well, although far less than using a full VM.
- Adding a proxy or firewall to your network stack and forcing all access through it will provide you with the ability to limit what network resources you can access. Tailoring that access control by process is, however, delicate: under windows you can create firewall rules per process but it is basically limited to filtering IP protocols and TCP/UDP port number. Some firewall/proxy are able to perform much more complex filtering but they typically work at a global level and cannot easily be adjusted based on the process itself.
