The Relationship Between Policies, Modules, and Rules

Policies, modules, and rules within CSA are the mechanisms that enforce your written security policy. At the lowest level of this three-component hierarchy, rules are the individual components that enforce specific system interaction. After several associated rules are created, they are typically combined into a rule module. Rule modules are collections of rules grouped together to serve a specific purpose. These rule modules are then grouped with other rule modules to form a policy.

For example, you may build a policy to protect a specific folder and files on remote systems from being modified or deleted. This policy might include three rule modules, each associated with rules protecting the resources but specific to three different operating systems. This means that you have Solaris file protection rules grouped into a Solaris file protection module that rolls up into the overall global file protection policy. The other rule modules in this policy are also specific to the operating system that their included rules protect. Finally, after the policy has been created, you can apply it to the groups as necessary and thereby distribute it to the groups included host systems throughout your architecture.