Security Policy

What Is a Security Policy？

A security policy consists of rules designed to safeguard a network. Administrators can configure these policies within a system to manage network access behavior, shield a particular network from threats originating from an "untrusted" network, and facilitate legitimate communication between two networks. Serving as a device's core security function, a security policy scrutinizes data flows traversing the device. It allows legitimate traffic following the policy while blocking unauthorized traffic, thereby enforcing network security through access control.

What Is a Good Security Policy?

Services require faster network connections, while the rise in active cybercrime has transformed into service threats. Developing and planning high-quality security policies not only helps to balance performance and security but also streamlines future management and maintenance.

Establishing a Standard Security Policy Management Process

The security policy management process is a component of the information security policy aimed at ensuring that technology serves the service. With the security policy list of devices growing increasingly large and management becoming more complex, organizations need to establish a process for reviewing and testing all policy applications. Consider the following aspects:

• The service party applicant initiates a request to add a security policy. The business director assesses the necessity of the security policy and submits it to the security team.

• The security team assesses the risks linked to the application submitted by the service party and defines the specific security policy implementation solution.

• The security policy is implemented and validated to ensure it fulfills the requirements.

• All security policies must be documented. The security team can then review the records to comprehend the objectives of each security policy and establish a correlation between the security policy and the application process.

Adhering to Appropriate Security Policy Planning Principles

• Segment the network into security zones.

• Follow the principle of least privilege.

• Policy sequence is crucial. Prioritize commonly used and precise policies.

• Identify and manage both inbound and outbound traffic.

• Regularly audit and refine security policies.

How to Create a Security Policy?

To create a security policy, you need to define match conditions and actions. When a device receives a packet, it checks the packet attributes against the match conditions in the security policy. If all conditions are met, the packet is considered a match, and the device processes it and any subsequent bidirectional traffic according to the defined action. Therefore, it's important to set the right match conditions and actions when creating a security policy.

Match Conditions

The match conditions in a security policy describe the characteristics of traffic used to filter it. These conditions include:

• Who: identifies the user sending the traffic.

• Where: specifies the traffic source and destination, including the security zone, IP address, region, and VLAN.

• What: indicates the service, application, or URL category being accessed.

• When: specifies the time segment.

Match conditions in a security policy are optional and can be chosen based on the network scenario. More specific match conditions will accurately filter traffic. You can use the source/destination IP address, source/destination port number, and protocol as the match condition, or utilize application and user identification capabilities for more precise and convenient security policy configuration.

Action

A security policy defines two fundamental actions — permit and deny — that control the passage of traffic.

Match conditions, such as users, time segments, terminals, applications, addresses, and services, along with various profiles required for content security checks, are represented as objects on a device. These objects can be created and referenced in multiple security policies.

Configuration File

If the matched security policy's action is permitted, you can utilize the configuration file to conduct additional content security checks on the traffic.

Content security check functions encompass antivirus, file blocking, IPS, content filtering, application behavior control, URL filtering, mail filtering, APT defense, and DNS filtering. Each content security check has unique application scenarios and actions. The device's traffic processing is contingent upon the outcomes of all content security checks.

Feedback Packet

If the matched security policy's action is denied, you have the option to send feedback packets to the server or client to promptly terminate the session, thereby reducing system resource consumption.