Method and system for controlling access to network resources using resource groups

A method for controlling access to network resources, comprising:

• at a central configuration machine:
• defining an internal protection domain for each of a plurality of firewalls, each internal protection domain including at least one zone, each zone having at least one access-controlled network resource;
• defining at least one external protection domain for the plurality of firewalls, the external protection domain including at least one zone having at least one access-controlled network resource, wherein each of the plurality of firewalls protects the internal protection domain relative to the external protection domain and each of the internal and external protection domains comprise one or more of networks and subnetworks of machines;
• creating a plurality of resource groups, each resource group including at least one zone;
• specifying an access control rule, including a scope, for each resource group, the scope, and thus the access control rule, is capable of being interpreted by each of the plurality of firewalls differently depending on the value of the scope and network resource characteristics associated with each of the plurality of firewalls;
• configuring each firewall using the access control rules;
• and
• at each firewall:
• in response to a request to access a destination network resource received from a source network resource, determining whether to apply the access control rule specified for the resource group associated with the destination network resource based on the scope of the access control rule.