Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there a domain specific language popular for defining security policies that are applicable across systems, domains or enterprises ?

Edit: Typically to express security policies at network level for firewalls etc

share|improve this question
My guess is that industry standards would take precedence, but I think you need to expand and clarify this question so we can better assist you. –  Eric G Sep 6 '12 at 15:42
So... geeky question - do you mean "subject domain" or "network domain"? –  bethlakshmi Sep 6 '12 at 16:02
add comment

3 Answers

I've used XML policies mostly. But that's the world of web services --- I don't have an analogue in any other technology space, though. Options include:

  • XACML - access control policy
  • Web Services Policy language - specs out WS-Policy and WS-PolicyAttachment - used for setting policies on how web services must be secured.

I'm fairly sure there are others in the web service space - but don't have links readily on hand.

In the lower layers - like lower layer firewalls - I don't have ready analogues. I'm not such an expert in this space, but it seems like communication of policy implementation is vendor-dependant.

Appliciablity, so far as I can tell - is more about organizational boundaries and real world authority than technology options. One of the nicer things about the web policies is that they can be varied across groups - so my high end server can have a tighter policy than a low-end server offering a similar service.

share|improve this answer
add comment

Although I'm not sure what domain specific language would mean in this case I think that what you want is Security Content Automation Protocol SCAP with languages OVAL and OCIL being components of it (XML based). But perhaps you would want to adopt SCAP as a whole instead taking parts of it.

share|improve this answer
add comment

I think COBIT might have you covered.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.