Providing a common security policy for a heterogeneous computer architecture environment

1. A method comprising:

receiving from a management console, by one or more computer processors, a configuration of a security policy of a heterogeneous computer architecture;

storing, by one or more computer processors, the security policy on a policy server of the heterogeneous computer architecture, wherein a management network communicatively connects the policy server to a plurality of hardware platforms of the heterogeneous computer architecture; and

distributing, over the management network, the security policy to a plurality of policy agents of the heterogeneous computer architecture, wherein:

the security policy includes a security policy administrator role, wherein (i) one or more subjects are associated with the security policy administrator role, and (ii) the security policy administrator role permits the one or more subjects that are associated with the security policy administrator role to manage:

one or more subjects in a plurality of security zones; and

one or more objects in the plurality of security zones;

the security policy includes a plurality of security zone administrator roles, wherein each security zone administrator role (i) is associated with a respective security zone of the plurality of security zones and (ii) permits management of one or more objects in the respective security zone;

the security policy includes a plurality of security label types, each security label type (i) being associated with at least one of the one or more subjects and at least one of the one or more objects of the plurality of security zones and (ii) identifying a respective security zone of the plurality of security zones; and

the security policy identifies a security appliance of the heterogeneous computer architecture that is associated with at least two security label types, and wherein the security policy prohibits, for each of the one or more objects in the plurality of the security zones, with an exception for the security appliance, an association with more than one of the plurality of security label types.

2. The method of claim 1 , further comprising:

receiving, by the security appliance, data from a first object of a first security zone of the plurality of security zones, wherein the first security zone is a source security zone;

determining, by the security appliance, a sensitivity of the first security zone;

identifying, by the security appliance, a second object in a second security zone of the plurality of security zones based, at least in part, on the data from the first object, wherein the second security zone is a target security zone;

determining, by the security appliance, the sensitivity of the second security zone; and

in response to determining, by the security appliance, that the sensitivity of the second security zone is higher than the sensitivity of the first security zone, permitting the first object to write information to the second object.

3. The method of claim 1 , further comprising:

receiving, by the security appliance, data from a first object of a first security zone of the plurality of security zones, wherein the first security zone is a source security zone;

determining, by the security appliance, a sensitivity of the first security zone;

identifying, by the security appliance, a second object in a second security zone of the plurality of security zones based, at least in part, on the data from the first object, wherein the second security zone is a target security zone;

determining, by the security appliance, the sensitivity of the second security zone; and

in response to determining, by the security appliance, that the sensitivity of the second security zone is lower than the sensitivity of the first security zone, permitting the first object to read information from the second object.

4. The method of claim 1 , further comprising:

receiving, by the security appliance, data from a first object of a first security zone of the plurality of security zones, wherein the first security zone is a source security zone;

identifying, by the security appliance, a second object in a second security zone of the plurality of security zones based, at least in part, on the data from the first object, wherein the second security zone is a target security zone; and

in response to determining, by the security appliance, that the first object is permitted to write to the second object based, at least in part, on a set of strictly defined rules that include one or more rules that indicate that objects of the first security zone are permitted to write to objects of the second security zone, permitting the first object to write information to the second object.

5. The method of claim 1 , further comprising:

receiving, by the security appliance, data from a first object of a first security zone of the plurality of security zones, wherein the first security zone is a source security zone;

identifying, by the security appliance, a second object in a second security zone of the plurality of security zones based, at least in part, on the data from the first object, wherein the second security zone is a target security zone; and

in response to determining, by the security appliance, that the first object is permitted to read from the second object based, at least in part, on a set of strictly defined rules that include one or more rules that indicate that objects of the first security zone are permitted to read from objects of the second security zone, permitting the first object to read information from the second object.

6. The method of claim 1 , wherein the security policy permits a subject that is associated with a respective security zone administrator role of the plurality of security zone administrator roles to create one or more secondary security zones in a security zone that is associated with the respective security zone administrator role.

7. A computer program product comprising:

a computer readable storage medium and program instructions stored on the computer readable storage medium, the program instructions comprising:

program instructions to receive, from a management console, a configuration of a security policy of a heterogeneous computer architecture;

program instructions to store the security policy on a policy server of the heterogeneous computer architecture, wherein a management network communicatively connects the policy server to a plurality of hardware platforms of the heterogeneous computer architecture; and

program instructions to distribute, over the management network, the security policy to a plurality of policy agents of the heterogeneous computer architecture, wherein:

the security policy includes a security policy administrator role, wherein (i) one or more subjects are associated with the security policy administrator role, and (ii) the security policy administrator role permits the one or more subjects that are associated with the security policy administrator role to manage:

one or more subjects in a plurality of security zones; and

one or more objects in the plurality of security zones;

the security policy includes a plurality of security zone administrator roles, wherein each security zone administrator role (i) is associated with a respective security zone of the plurality of security zones and (ii) permits management of one or more objects in the respective security zone;

the security policy includes a plurality of security label types, each security label type (i) being associated with at least one of the one or more subjects and at least one of the one or more objects of the plurality of security zones and (ii) identifying a respective security zone of the plurality of security zones; and

the security policy identifies a security appliance of the heterogeneous computer architecture that is associated with at least two security label types, and wherein the security policy prohibits, for each of the one or more objects in the plurality of the security zones, with an exception for the security appliance, an association with more than one of the plurality of security label types.

8. The computer program product of claim 7 , the program instructions further comprising:

program instructions to receive, by the security appliance, data from a first object of a first security zone of the plurality of security zones, wherein the first security zone is a source security zone;

program instructions to determine, by the security appliance, a sensitivity of the first security zone;

program instructions to identify, by the security appliance, a second object in a second security zone of the plurality of security zones based, at least in part, on the data from the first object, wherein the second security zone is a target security zone;

program instructions to determine, by the security appliance, the sensitivity of the second security zone;

program instructions to, in response to determining, by the security appliance, that the sensitivity of the second security zone is higher than the sensitivity of the first security zone, permit the first object to write information to the second object; and

program instructions to in response, to determining, by the security appliance, that the sensitivity of the second security zone is lower than the sensitivity of the first security zone, permit the first object to read information from the second object.

9. The computer program product of claim 7 , the program instructions further comprising:

program instructions to receive, by the security appliance, data from a first object of a first security zone of the plurality of security zones, wherein the first security zone is a source security zone;

program instructions to identify, by the security appliance, a second object in a second security zone of the plurality of security zones based, at least in part, on the data from the first object, wherein the second security zone is a target security zone; and

program instructions to, in response to determining, by the security appliance, that the first object is permitted to write to the second object based, at least in part, on a set of strictly defined rules that include one or more rules that indicate that objects of the first security zone are permitted to write to objects of the second security zone, permit the first object to write information to the second object; and

program instructions to, in response to determining, by the security appliance, that the first object is permitted to read from the second object based, at least in part, on a set of strictly defined rules that include one or more rules that indicate that objects of the first security zone are permitted to read from objects of the second security zone, permit the first object to read information from the second object.

10. The computer program product of claim 7 , wherein the security policy permits a subject that is associated with a respective security zone administrator role of the plurality of security zone administrator roles to create one or more secondary security zones in a security zone that is associated with the respective security zone administrator role.

11. A computer system comprising:

one or more computer processors;

one or more computer readable storage media;

program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:

program instructions to receive, from a management console, a configuration of a security policy of a heterogeneous computer architecture;

program instructions to store the security policy on a policy server of the heterogeneous computer architecture, wherein a management network communicatively connects the policy server to a plurality of hardware platforms of the heterogeneous computer architecture; and

program instructions to distribute, over the management network, the security policy to a plurality of policy agents of the heterogeneous computer architecture, wherein:

the security policy includes a security policy administrator role, wherein (i) one or more subjects are associated with the security policy administrator role, and (ii) the security policy administrator role permits the one or more subjects that are associated with the security policy administrator role to manage:

one or more subjects in a plurality of security zones; and

one or more objects in the plurality of security zones;

the security policy includes a plurality of security zone administrator roles, wherein each security zone administrator role (i) is associated with a respective security zone of the plurality of security zones and (ii) permits management of one or more objects in the respective security zone;

the security policy includes a plurality of security label types, each security label type (i) being associated with at least one of the one or more subjects and at least one of the one or more objects of the plurality of security zones and (ii) identifying a respective security zone of the plurality of security zones; and

the security policy identifies a security appliance of the heterogeneous computer architecture that is associated with at least two security label types, and wherein the security policy prohibits, for each of the one or more objects in the plurality of the security zones, with an exception for the security appliance, an association with more than one of the plurality of security label types.

12. The computer system of claim 11 , wherein the program instructions further comprise:

program instructions to receive, by the security appliance, data from a first object of a first security zone of the plurality of security zones, wherein the first security zone is a source security zone;

program instructions to determine, by the security appliance, a sensitivity of the first security zone;

program instructions to identify, by the security appliance, a second object in a second security zone of the plurality of security zones based, at least in part, on the data from the first object, wherein the second security zone is a target security zone;

program instructions to determine, by the security appliance, the sensitivity of the second security zone;

program instructions to, in response to determining, by the security appliance, that the sensitivity of the second security zone is higher than the sensitivity of the first security zone, permit the first object to write information to the second object; and

program instructions to in response, to determining, by the security appliance, that the sensitivity of the second security zone is lower than the sensitivity of the first security zone, permit the first object to read information from the second object.

13. The computer system of claim 11 , the program instructions further comprising:

program instructions to receive, by the security appliance, data from a first object of a first security zone of the plurality of security zones, wherein the first security zone is a source security zone;

program instructions to identify, by the security appliance, a second object in a second security zone of the plurality of security zones based, at least in part, on the data from the first object, wherein the second security zone is a target security zone; and

program instructions to, in response to determining, by the security appliance, that the first object is permitted to write to the second object based, at least in part, on a set of strictly defined rules that include one or more rules that indicate that objects of the first security zone are permitted to write to objects of the second security zone, permit the first object to write information to the second object; and

program instructions to, in response to determining, by the security appliance, that the first object is permitted to read from the second object based, at least in part, on a set of strictly defined rules that include one or more rules that indicate that objects of the first security zone are permitted to read from objects of the second security zone, permit the first object to read information from the second object.

14. The computer system of claim 11 , wherein the security policy permits a subject that is associated with a respective security zone administrator role of the plurality of security zone administrator roles to create one or more secondary security zones in a security zone that is associated with the respective security zone administrator role.