Is there a domain specific language popular for defining security policies that are applicable across systems, domains or enterprises ?

Edit: Typically to express security policies at network level for firewalls etc

  • 1
    My guess is that industry standards would take precedence, but I think you need to expand and clarify this question so we can better assist you.
    – Eric G
    Sep 6, 2012 at 15:42
  • So... geeky question - do you mean "subject domain" or "network domain"? Sep 6, 2012 at 16:02

5 Answers 5


I've used XML policies mostly. But that's the world of web services --- I don't have an analogue in any other technology space, though. Options include:

  • XACML - access control policy
  • Web Services Policy language - specs out WS-Policy and WS-PolicyAttachment - used for setting policies on how web services must be secured.

I'm fairly sure there are others in the web service space - but don't have links readily on hand.

In the lower layers - like lower layer firewalls - I don't have ready analogues. I'm not such an expert in this space, but it seems like communication of policy implementation is vendor-dependant.

Appliciablity, so far as I can tell - is more about organizational boundaries and real world authority than technology options. One of the nicer things about the web policies is that they can be varied across groups - so my high end server can have a tighter policy than a low-end server offering a similar service.


Although I'm not sure what domain specific language would mean in this case I think that what you want is Security Content Automation Protocol SCAP with languages OVAL and OCIL being components of it (XML based). But perhaps you would want to adopt SCAP as a whole instead taking parts of it.


I think COBIT might have you covered.


The de factor policy language for access control (aka authorization) is XACML, the eXtensible Access Control Markup Language.

Once upon a time there was an alternative from Microsoft Research called SecPal. It never picked up and XACML was preferred instead.

MS Windows Server 2012 (Server 8) also has its own policy language called SDDL but it is specific to that server and its filesystem.

In both XACML and SDDL, the building blocks of the policies are attributes (or claims) which describe the user, the resource, the action, and possibly the context.

In principle, XACML can be applied to anything (applications, APIs, databases, networks...) since it is first and foremost:

  1. an abstract architecture which defines a policy decision point (the component deciding whether access is to be granted) and a policy enforcement point (the component protecting your app, db, network...)
  2. a policy language which defines a clear syntax to define negative and positive rules based on attributes.
  3. a request/response scheme which defines the structure of authorization requests are and responses.

There are open-source and vendor solutions that implement XACML and provide authorization for different layers (Cisco for instance is researching using XACML for network access control; Axiomatics provides XACML for applications and databases...)

XACML is defined by OASIS (organization for the advancement of structured information standards). You can find more information here.


Content-Security-Policy is also a domain specific language to tell the browser from which origins which kind of content is acceptable (mainly script, but also css, images...). This is maybe not what you intended, but it describes a policy at the network level and could actually be used within deep inspection firewalls to enforce the policy for dumb browsers like MSIE which do not understand it yet (fully).

Maybe you also get from this example that there will be no universal policy, because the topic and the capabilities of the security enforcing devices differ vastly. While for some simply blocking of port 80 (http) is enough, others like to filter by URL or web application and still others want to make sure that malware is found with a specific acceptance of false positives and that XSS or CSRF attacks are mitigated or that it will prevent data leakage (whatever this exactly means for a specific company). Most of this stuff simpler firewalls cannot do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .