About the Policy Model
Manage your security policies by using either adaptive or static policy. Choosing how to implement security policy is possible because of the Illumio policy model.
The Illumio security policy for securing resources differs from traditional network security policies. Traditional security policies use network constructs such as VLANs, zones, and IP addresses to tie security to the underlying network infrastructure.
In contrast, Illumio security policy uses a multidimensional label system to sort and describe the function of resources. By describing resources functionally, policy statements are clear and unambiguous. Illumio users assign labels to their resources to identify their applications, environments, and regions. Users specify labels with cloud tag to label mapping. See Cloud Tag to Label Mapping.
Together, labeling resources and creating the corresponding rules define the security policies for resources. Illumio converts these label-based security policies into the appropriate protection for the resources.
Security policy guidelines
These guidelines are recommendations on how to create your security policy in Illumio Segmentation for the Cloud.
Keep these recommendations in mind when you create your security policy:
Refine your initial policy to strengthen it by narrowing overly broad access.
Use provisioning to enact your policy.
Understanding rules
Rules are an integral component of Illumio security policy. Create the rules using labels, IP lists, and applications that identify aspects of your cloud environment. See Overview of Policy Attributes.
Illumio's allowlist model for security policy uses rules to define the allowed communication for two or more resources. For example, if you have two resources that comprise a simple application — a web server and a database server — to allow these two resources to communicate, you must write a rule that describes this relationship.
Types of policy
Illumio Segmentation for the Cloud provides two types of policies — Organization and Application. For instructions on creating rules for policies, see the pop-ups in the GUI. For guidelines specific to each type, see the following topics:
Overview of policy attributes
Illumio Segmentation for the Cloud uses the following policy attributes that help you write your security policy: