Building Internet Firewalls, 2nd Edition

Chapter 25. Security Policies

The word “policy” makes many people flinch because it suggests impenetrable documents put together by unknowledgeable committees, which are then promptly ignored by everyone involved (except when they make a good excuse or weapon). That’s not the kind of policy we’re discussing in this chapter.

The policy we’re talking about here is like a nation’s foreign policy. It might be discussed in documents — of varying amounts of legibility — but its primary purpose is to establish a direction, a theory of what you’re trying to achieve. People sometimes confuse the words “policy”, “strategy”, and “tactics”. A policy is what determines what wars you’re going to fight and why. A strategy is the plan for carrying out the war. A tactic is a method for carrying out a strategy. Presidents determine policy; generals determine strategies; and anybody down to a foot soldier might determine a tactic.

Most of this book is about tactics. The tactics involved in building a firewall, the nitty-gritty details of what needs to be done here, are complex and intricate. However, no matter how good your tactics are, if your strategy and policy are bad, you can’t succeed. In the 1800s, an American named William Walker set out to conquer Nicaragua for the United States. His strategy and tactics were, if not impeccable, certainly successful: he conquered Nicaragua. Unfortunately, there was a fatal flaw in his plan. The United States did not at the time want Nicaragua, and when he ...