Method and system for management of security rule set

A system capable of automated managing a security rule-set, the system comprising:

• a. an interface operable to obtain data characterizing a connectivity request;
• b. an interface operable to obtain data characterizing an amended rule-set, the amended rule-set being derivative of an initial rule-set amended to fit the connectivity request;
• c. means for automated verifying each possible combinations of values in the connectivity request against the initial rule-set and the amended rule-set;
• d. means for calculating one or more values selected from a group comprising values characterizing relative amount of extra allowed traffic and values characterizing relative amount of dissatisfied requested traffic;
• e. means for automated comparing the calculated values and/or derivatives thereof with a predefined threshold;
• and
• f. means for automated classifying the amended rule-set as applicable for implementation if the results of the automated comparing match a predefined verification criterion.

A method of automated managing one or more security rule-sets, the method comprising:

• a. obtaining data characterizing a connectivity request and data characterizing one or more rules in an amended rule-set, the one or more rules in the amended rule-set being derivatives of corresponding one or more rules in an initial rule-set amended to fit the connectivity request;
• b. automated verifying each possible combination of values in the connectivity request against the one or more rules in the amended rule-set and against the corresponding one or more rules in the initial rule-set;
• c. calculating one or more values selected from a group comprising values characterizing relative amount of extra allowed traffic and values characterizing relative amount of dissatisfied requested traffic;
• d. comparing the calculated values and/or derivatives thereof with a predefined threshold;
• and
• e. automated classifying the one or more rules in the amended rule-set as non-applicable for implementation if the results of the automated comparing do not match a predefined verification criterion.