Security policy optimization

This help contains the following topics:

·     Introduction

¡     About policy optimization

¡     Operating mechanism

¡     Optimization methods

¡     Application scenarios

·     Restrictions and guidelines

·     Perform policy optimization

¡     Prerequisites

¡     Automatic batch optimization

¡     Manual policy optimization

Introduction

About policy optimization

This feature enables the system to discover potential risks in security policies configured with application filtering criteria and enables users to optimize content security settings to lower the risks.

You can use this feature to optimize the existing security policies or to analyze application security risks to provide reference for precise security policy configuration. To analyze application risks for future reference, configure a security policy with loose filtering criteria and then perform policy optimization.

Operating mechanism

Policy optimization operates as follows:

1.     Identifies application information in the permitted traffic.

2.     Compares the configured content security settings with the recommended settings in the application signature database. The database contains information about the recommended content security settings for each application.

3.     Evaluates the security condition of the security policies based on the comparison result.

The feature scores the overall security condition and provides detailed security risk analysis for each security policy configured with application filtering criteria. Table 1 shows the information on the Policy Optimization page.

Table 1 Policy Optimization page information

Optimization methods

This feature provides the following optimization methods:

·     Automatic batch optimization—Enables the system to optimize content security settings for all the security policies with security risks as recommended in the application signature database.

·     Manual optimization—Enables users to optimize content security settings for a security policy as needed.

Table 2 shows the security risks and the corresponding content security measures.

Table 2 Security risks and the corresponding content security measures

Application scenarios

This feature is applicable to the following scenarios:

·     Optimize a less specific security policy configured (for example, a security policy with a large IP address or service range) when you do not know which applications exist in the network.  You can configure a more specific security policy after this feature identifies applications and risks.

·     Optimize a specific security policy.

Restrictions and guidelines

·     This feature analyzes security risks only in packets permitted by security policies.

·     When a large number of security policies exist, policy optimization might consume a lot of CPU resources. Please use this feature when the network is not busy.

·     You cannot add new security policies during automatic batch optimization.

·     Automatic batch optimization stops if a master/backup switchover or memory threshold alert occurs during the optimization process. Policies that have been optimized will not be restored. To restart the optimization, click the Auto batch optimization button after the master/backup switchover finishes or the memory usage drops below the threshold.

Perform policy optimization

Prerequisites

Before you perform policy optimization, make sure statistics collection is enabled and security policies configured with application filtering criteria exist.

Automatic batch optimization

1.     Click Policies > Security Policies > Policy Optimization.

2.     Click Auto batch optimization to start an automatic batch optimization.

Manual policy optimization

1.     Click Policies > Security Policies > Policy Optimization.

2.     Click the button in the Action field for the security policy to be modified.

3.     In the window that opens, change content security settings as needed.

Table 3 Manual policy optimization configuration items

4.     Click OK.