Network Security Policy Management (NSPM): Why It Still Matters and What to Look For

Network security policy management (NSPM) is the practice of governing the rules that control network access across firewalls, cloud security groups and segmentation platforms from a single layer rather than device by device. FireMon created the NSPM category in 2004 to solve firewall rule sprawl and manual compliance work. Two decades on, the problem is bigger: more vendors, more cloud, more change and more audits.

Key takeaways

• Firewalls enforce policy. NSPM governs it. Poorly defined policy produces poorly enforced security, however capable the firewall.
• Enterprise networks now span thousands of firewalls, cloud security groups and segmentation tools, which makes manual policy management unreliable.
• Frameworks including PCI DSS, NIST 800-53, DORA and NIS2 include change control, audit and rule review requirements that NSPM supports with continuous evidence.
• Automation lowers the cost and time of policy change when it covers the full workflow, from request through to rule decommissioning.
• When you evaluate NSPM platforms, prioritise multi-vendor normalisation, pre-change validation, continuous compliance evidence and governed change workflow.

Is NSPM still necessary?

Yes. As long as firewalls and cloud controls enforce access, someone has to govern what they enforce. The question usually comes up when a team is re-evaluating its tooling, for example after a vendor discontinues a product. The answer has not changed: the more devices, vendors and environments you run, the less any single console can tell you whether your policy does what you intend.

Firewalls enforce security policies

Firewall policy mistakes have caused critical failures since the earliest perimeter networks, either by allowing unwanted, malicious traffic or by blocking necessary traffic and causing business outages. That is the fundamental reason NSPM exists: firewalls enforce the security policies applied to them, and poorly defined policies result in poorly enforced security. FireMon created the NSPM category in 2004 to address this problem.

In the years since, the need for NSPM has grown as network complexity has increased. Simple firewall environments separating inside, outside and DMZ segments have evolved to segment internal networks far more granularly. "Outside" has expanded with public cloud adoption, application complexity has surged, threats have grown in volume and sophistication, and firewall technology has become more capable and more complex.

Today it is common for enterprises to manage thousands of firewalls, each with thousands of rules, tens of thousands of network objects, and complex rules and object groups that collectively represent tens of millions of unique access paths through the network. All this complexity makes effective security impossible without effective policy management.

That is why FireMon describes policy as the control plane for network security. Policy defines what network security should do. Firewalls, cloud security groups and segmentation platforms are the infrastructure that carries it out. Governing policy from a single layer gives teams one place to see, control and prove that the environment is doing what is intended.

For enterprises such as large banks that are complex, highly regulated and frequent targets of attack, an NSPM solution is a foundational element of security management. Even small errors in policies can render modern firewall technology ineffective. A minor change to an object group, for example, may seem harmless, but that object group may be used in hundreds of rules, with unintended security implications. An NSPM solution can detect and even prevent these otherwise hidden errors from exposing an organisation to attack.

As long as firewalls are necessary, effective policy management will remain essential. This is supported by the IDC InfoBrief, Firewall Policy Management: The Foundation You Can Not Ignore.

Compliance is not optional

For many years, network security compliance requirements mandated the existence of a firewall. Organisations in highly regulated industries such as financial services, healthcare and retail recognised that an effective security programme needs effective policy management, and they expanded those requirements to evaluate the effectiveness of the enforced policies.

These requirements include change management controls to ensure new changes are evaluated before implementation, audit controls to ensure all changes are documented, and ongoing rule lifecycle management to review the business need and risk acceptance for access periodically. They appear in frameworks including NIST 800-53, NIST CSF, PCI DSS 4.0, GDPR, DORA, NIS2 and more.

The existence of a firewall is not enough to establish and maintain a secure, compliant enterprise. Effective policy management is required to ensure firewalls are properly enforcing and monitoring network security best practice. Maintaining and documenting compliance with these frameworks is very time-consuming without automated tools that continuously assess and report on these complex configurations.

Continuous compliance means checking proposed changes for non-compliance before deployment and keeping audit evidence current between reviews, rather than rebuilding it for every audit. Read the case study to learn how one organisation cut compliance audit preparation time by 83%.

Network security operational costs are high

As network and security complexity has increased, so has the cost of managing these complex environments. At the same time, business and IT velocity has increased with the adoption of technologies including virtualisation, public cloud and infrastructure as code. That increased velocity has put more pressure on security to move faster.

Both challenges, operational cost and speed, can be addressed with automation. Automating network security operations goes far beyond automating the device change ("push"). Effective network security automation includes:

• Streamlining the change request process to reduce the number of change requests and improve requirements gathering.
• Automating the design process to identify what changes are required to achieve the desired outcome.
• Automating the pre-change assessment phase to ensure only appropriate, secure and compliant changes are permitted.
• Streamlining the approval process to approve or deny change requests rapidly.
• Automating the implementation of the change during defined change windows without error-prone data entry steps.
• Automating ongoing compliance reporting.
• Simplifying and automating the rule review process.
• Automating the decommissioning of rules that are no longer needed.

Most teams apply automation in stages. They start where it has earned trust, such as pre-change assessment and compliance reporting, and expand from there.

What to look for in an NSPM platform

Enterprises evaluating NSPM providers should test six capabilities. Each one maps to a problem that manual processes cannot solve at scale.

One more test: a good NSPM platform governs the firewalls and cloud controls you already run. It should not require you to replace your enforcement technology.

FireMon Security Manager is the foundation of FireMon's NSPM platform. It normalises policy from 120-plus firewall, cloud and microsegmentation platforms into a single data layer, so teams get real-time visibility, pre-change validation and continuous compliance evidence from one place. Add-on modules extend it with workflow automation, rule optimisation and risk analysis.

NSPM vs Native Firewall Management Consoles

Native consoles such as Panorama and FortiManager are strong at managing their own platforms. NSPM sits above them and governs consistency across everything they do not touch.

Summary

The network security management challenges that led FireMon to create NSPM in 2004 have grown with every new firewall, cloud account and audit. NSPM is more critical now than at any point in its history. For a short definition of the core concepts, see What Is Network Security Policy Management?