Is there a domain specific language for security policies

Question

Is there a domain specific language popular for defining security policies that are applicable across systems, domains or enterprises ?

Edit: Typically to express security policies at network level for firewalls etc

Answer 1

I've used XML policies mostly. But that's the world of web services --- I don't have an analogue in any other technology space, though. Options include:

• XACML - access control policy
• Web Services Policy language - specs out WS-Policy and WS-PolicyAttachment - used for setting policies on how web services must be secured.

I'm fairly sure there are others in the web service space - but don't have links readily on hand.

In the lower layers - like lower layer firewalls - I don't have ready analogues. I'm not such an expert in this space, but it seems like communication of policy implementation is vendor-dependant.

Appliciablity, so far as I can tell - is more about organizational boundaries and real world authority than technology options. One of the nicer things about the web policies is that they can be varied across groups - so my high end server can have a tighter policy than a low-end server offering a similar service.

Answer 2

Although I'm not sure what domain specific language would mean in this case I think that what you want is Security Content Automation Protocol SCAP with languages OVAL and OCIL being components of it (XML based). But perhaps you would want to adopt SCAP as a whole instead taking parts of it.

Answer 3

I think COBIT might have you covered.