Method and system for management of security rule set

1. A method of automated managing an ordered set of security rules implemented at one or more security gateways, the method comprising:

a. obtaining data characterizing a connectivity request which may become allowable only upon changes of an initial rule-set, thus giving rise to an unfitting connectivity request;

b. automated searching for a rule within said ordered set of security rules, said rule best matching to be amended in order to facilitate allowance of the unfitting connectivity request, wherein best matching is defined in accordance with one or more predefined criteria;

c. automated generating amendment of the best matching rule, said amendment capable to facilitate allowance of the unfitting connectivity request; and

d. automated implementing the generated amendment at one or more relevant security gateways among said one or more security gateways, thus giving rise to an amended rule-set.

2. The method of claim 1 wherein at least one predefined criterion is related to extra allowed traffic resulting from the amendment.

3. The method of claim 1 wherein at least one predefined criterion is related to requested traffic restricted after amendment by one or more rules above the amended rule.

4. The method of claim 1 wherein at least one predefined criterion characterizes a relation between allowed traffic in the amended rule- set and traffic allowed in the initial rule-set.

5. The method of claim 1 wherein at least one predefined criterion characterizes a relation between entire added traffic and traffic which needs to be added in accordance with the unfitting connectivity request.

6. The method of claim 1 wherein at least one predefined criterion characterizes a relation between requested traffic rejected resulting from amendment and requested traffic allowed resulting from amendment.

7. The method of claim 1 wherein at least one predefined criterion characterizes a relation between requested traffic rejected resulting from amendment and entire requested traffic.

8. The method of claim 1 wherein at least one predefined criterion is selected from a group comprising:

a. criterion characterizing a relation between allowed traffic in the amended rule-set and traffic allowed in the initial rule-set;

b. criterion characterizing a relation between entire added traffic and traffic which needs to be added in accordance with the unfitting connectivity request;

c. criterion characterizing a relation between requested traffic rejected resulting from amendment and requested traffic allowed resulting from amendment;

d. criterion characterizing a relation between requested traffic rejected resulting from amendment and entire requested traffic;

and wherein the rule is considered as best matching if it fits at least one of said criteria and/or combination thereof.

9. The method of claim 8 further comprising automated searching for a plurality of rules enabling a predefined range of at least one of said criteria, and selecting the best matching rule among them.

10. The method of claim 8 further comprising automated searching, for each said criterion, at least one rule enabling the minimal value of respective criterion, and selecting the best matching rules among them.

11. The method of claim 1 wherein searching for the best matching rule comprises selecting a plurality of rules matching certain predefined conditions, and enabling a user to select the best matching rule among said plurality of rules.

12. The method of claim 1 further comprising presenting the generated amendment to a user for approval prior to implementing said amendment.

13. The method of claim 1 further comprising validating the generated amendment prior to implementing.

14. The method of claim 1 further comprising:

a. obtaining a plurality of unfitting connectivity requests,

b. generating respective amendments to each request among said plurality of unfitting connectivity requests,

c. queuing the generated amendments; and

d. implementing the generated amendments during a certain service window.

15. The method of claim 1 wherein implementing the generated amendment further comprises:

a. analyzing routing tables of the security gateways;

b. generating ranking the security gateways in accordance with their relevance to the unfitting connectivity request,

c. selecting one or more security gateways with the highest ranking; and

d. implementing the configuration change at the selected security gateways.

16. A computer program embodied on a non-transitory computer readable medium comprising computer program code means for performing all the steps of claim 1 when said program is run on a computer.

17. A system capable of automated managing an ordered set of security rules implemented at one or more security gateways, the system comprising:

a. means for obtaining data characterizing a connectivity request which may become allowable only upon changes of an initial rule-set, thus giving rise to an unfitting connectivity request;

b. means for automated searching for a rule within said ordered set of security rules, said rule best matching to be amended in order to facilitate allowance of the unfitting connectivity request, wherein best matching is defined in accordance with one or more predefined criteria;

c. means for automated generating amendment of the best matching rule, said amendment capable to facilitate allowance of the unfitting connectivity request; and

d. means for automated implementing the generated amendment at one or more relevant security gateways among said one or more security gateways, thus giving rise to an amended rule-set.

18. The system of claim 17 wherein at least one predefined criterion is related to extra allowed traffic resulting from the amendment.

19. The system of claim 17 wherein at least one predefined criterion is related to requested traffic restricted after amendment because of shadowing by one or more rules above the amended rule.

20. The system of claim 17 wherein at least one predefined criterion is selected from a group comprising:

a. criterion characterizing a relation between allowed traffic in the amended rule-set and traffic allowed in the initial rule-set;

b. criterion characterizing a relation between entire added traffic and traffic which needs to be added in accordance with the unfitting connectivity request;

c. criterion characterizing a relation between requested traffic rejected resulting from amendment and requested traffic allowed resulting from amendment;

d. criterion characterizing a relation between requested traffic rejected resulting grom amendment and entire requested traffic;

wherein the rule is considered as best matching if it fits at least one of said criteria and/or combination thereof.

21. The system of claim 20 further comprising automated searching for a plurality of rules enabling a predefined range of at least one of said criteria, and selecting the best matching rule among them.

22. The system of claim 20 further comprising automated searching, for each said criterion, at least one rule enabling the minimal value of respective criterion, and selecting the best matching rule among them.

23. The system of claim 17 further comprising means for selecting a plurality of rules matching certain predefined conditions, means for enabling a user to select the best matching rule among said plurality of rules.

24. The system of claim 17 further comprising means for presenting the generated amendment to a user for approval prior to implementing said amendment.