Management of security policies across multiple security products

1. A method performed at a management entity, comprising:

discovering multiple security devices connected to a network, each security device to control access to resources according to a corresponding native security policy that is based on a corresponding native policy model associated with the corresponding security device;

importing the native security policies from the corresponding security devices over the network, each native security policy including a set of native security rules, each native security rule including native rule parameters to permit or deny access to a resource based on a network protocol and at least one of a source address or a destination address;

classifying the imported native security policies into identical, similar, and unique security policy classifications having identical, similar, and unique security rules, respectively, based on commonality between the native rule parameters of the native security rules included in the native security policies across the security devices;

normalizing the classified imported native security policies across the security devices based on a generic policy model, by mapping the native rule parameters in the native security rules of each security policy to corresponding components {a principal or actor}, {action}, {a resource}, {a context}, and {perform a result} of a generic rule: “if {a principal or actor} tries to perform an {action) on {a resource} within {a context} then {perform a result}, to produce normalized security policies; and

processing security events received from the security devices using the normalized security policies.

2. The method of claim 1 , wherein the processing includes:

receiving commands to change one or more normalized security policies across the security devices.

3. The method of claim 2 , wherein the processing further includes:

reporting the received security events.

4. The method of claim 1 , wherein the multiple security devices include at least two of a Web Security Appliance (WSA), an Application Security Appliance (ASA), and a Next Generation firewall (NGF).

5. The method of claim 1 , further comprising:

prior to the discovering, receiving names and addresses of the multiple security devices.

6. The method of claim 1 , wherein:

for each native security rule the set of rule parameters further includes the source and destination addresses, and a device port.

7. An apparatus comprising:

a network interface unit to connect with a network; and

a processor coupled to the network interface unit to:

discover multiple security devices connected to the network, each security device to control access to resources according to a corresponding native security policy that is based on a corresponding native policy model associated with the corresponding security device, each native security policy including a set of native security rules, each native security rule including native rule parameters to permit or deny access to a resource based on a network protocol and at least one of a source address or a destination address;

import the native security policies from the corresponding security devices over the network;

classify the imported native security policies into identical, similar, and unique security policy classifications having identical, similar, and unique security rules, respectively, based on commonality between the native rule parameters of the native security rules included in the native security policies across the security devices;

normalize the classified imported native security policies across the security devices based on a generic policy model, by mapping the native rule parameters in the native security rules of each security policy to corresponding components {a principal or actor}, {action}, {a resource}, {a context}, and {perform a result} of a generic rule: “if {a principal or actor} tries to perform an {action) on {a resource} within {a context} then {perform a result}, to produce normalized security policies; and

process security events received from the security devices using the normalized security policies.

8. The apparatus of claim 7 , wherein the processor processes by:

receiving commands to change one or more normalized security policies across the security devices.

9. The apparatus of claim 8 , wherein the processor further processes by:

reporting the received security events.

10. The apparatus of claim 7 , wherein the multiple security devices include at least two of a Web Security Appliance (WSA), an Application Security Appliance (ASA), and a Next Generation firewall (NGF).

11. The apparatus of claim 7 , wherein the processor further:

prior to the discover operation, receive names and addresses of the multiple security devices.

12. The apparatus of claim 7 , wherein:

for each native security rule the set of rule parameters further includes the source and destination addresses, and a device port.

13. A non-transitory tangible computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:

discover multiple security devices connected to the network, each security device to control access to resources according to a corresponding native security policy that is based on a corresponding native policy model associated with the corresponding security device, each native security policy including a set of native security rules, each native security rule including native rule parameters to permit or deny access to a resource based on a network protocol and at least one of a source address or a destination address;

import the native security policies from the corresponding security devices over the network;

classify the imported native security policies into identical, similar, and unique security policy classifications having identical, similar, and unique security rules, respectively, based on commonality between the native rule parameters of the native security rules included in the native security policies across the security devices;

normalize the classified imported native security policies across the security devices based on a generic policy model, by mapping the native rule parameters in the native security rules of each security policy to corresponding components {a principal or actor}, {action}, {a resource}, {a context}, and {perform a result} of a generic rule: “if {a principal or actor} tries to perform an {action) on {a resource} within {a context} then {perform a result}, to produce normalized security policies; and

process security events received from the security devices using the normalized security policies.

14. The non-transitory tangible computer readable storage media of claim 13 , wherein the instructions to cause the processor to process include instructions to cause the processor to:

receive commands to change one or more normalized security policies across the security devices.

15. The non-transitory tangible computer readable storage media of claim 14 , wherein the instructions to cause the processor to process include further instructions to cause the processor to:

report the received security events.

16. The non-transitory tangible computer readable storage media of claim 13 , wherein the multiple security devices include at least two of a Web Security Appliance (WSA), an Application Security Appliance (ASA), and a Next Generation firewall (NGF).

17. The non-transitory tangible computer readable storage media of claim 13 , further comprising:

instructions to cause the processor to, prior to the discovering, receive names and addresses of the multiple security devices.

18. The non-transitory tangible computer readable storage media of claim 13 , wherein:

for each native security rule the set of rule parameters further includes the source and destination addresses, and a device port.