A computer program product, comprising a computer-readable, tangible storage device having a computer-readable program code stored in the computer-readable storage device, said computer-readable program code containing instructions that are carried out by a central processing unit (CPU) of a computer system to implement a method of managing a security policy, said method comprising:
- said computer system receiving specification sets consisting of first, second, and third specification sets, said first specification set specifying service flows as a first mapping of each service of a first set of services to a corresponding service of a second set of services based on each service of said first set of services requiring communication with said corresponding service of said second set of services, wherein said first and second sets of services are included in a plurality of services, said second specification set specifying a second mapping of each service of said plurality services to one or more corresponding devices of a plurality of devices, and said third specification set specifying a third mapping of each device of said plurality of devices to one or more network addresses;
- said computer system combining said received first, second and third specification sets by mapping said first, second and third specification sets to a plurality of packet filtering rule statements;
- said CPU of said computer system generating said security policy as a plurality of packet filtering rules based on said combined first, second and third specification sets and said plurality of packet filtering rule statements, wherein each packet filtering rule of said plurality of packet filtering rules specifies a corresponding source network address or range of source network addresses, a corresponding destination network address or range of destination network addresses, a corresponding port or range of ports, a corresponding protocol and a corresponding action;
- based on a determination of an addition of a new service flow to said service flows, a determination that said first specification set is affected by said addition of said new service flow, and a determination that said second and third specification sets are unaffected by said addition of said new service flow, said computer receiving a modification of said first specification set which includes a mapping of a first service to a second service, but no modification of said second and third specification sets, so that an error included in said modification of said first specification set is not cascaded into said second specification set or said third specification set;
- subsequent to a correction of said error and based on said first specification set being modified but said second and third specification sets being not modified, said computer modifying at least one packet filtering rule, but not all packet filtering rules, included in said plurality of packet filtering rules, which leaves at least one other packet filtering rule of said plurality of packet filtering rules unchanged;
- said computer generating a delta set that indicates said modified at least one packet filtering rule, wherein said delta set does not indicate said at least one other packet filtering rule left unchanged by said modifying said at least one packet filtering rule;
- said computer outputting said delta set to a computer file so that said computer file includes said modified at least one packet filtering rule and so that said computer file does not include said at least one other packet filtering rule left unchanged by said modifying said at least one packet filtering rule;
- and
- said computer incrementally updating said security policy by sending said computer file to a packet filtering device so that said packet filtering device receives said modified at least one packet filtering rule but not said at least one other packet filtering rule left unchanged.