Policies, inheritance, and overrides

Policies in Deep Security are intended to be created in a hierarchical structure. As an administrator, you begin with one or more base policies from which you create multiple levels of child policies that get progressively more granular in their detail. You can assign broadly applicable rules and other configuration settings at the top-level policies and then get more targeted and specific as you go down through levels of child policies, eventually arriving at rule and configuration assignments at the individual computer level.

As well as assigning more granular settings as you move down through the policy tree, you can also override settings from higher up the policy tree.

Deep Security provides a collection of policies that you can use as initial templates for the design of your own policies tailored to your environment:

In this topic:

Inheritance

Child policies inherit their settings from their parent policies. This allows you to create a policy tree that begins with a base parent policy configured with settings and rules that will apply to all computers. This parent policy can then have a set of child and further descendant policies which have progressively more specific targeted settings. Your policy trees can be built based on any kind of classification system that suits your environment. For example, the branch in the policy tree that comes with Deep Security has two child policies, one designed for a server hosting the Deep Security Manager and one designed for the Deep Security Virtual Appliance. This is a role-based tree structure. Deep Security also has three branches designed for specific operating systems, Linux, Solaris, and Windows. The windows branch has further child policies for various sub-types of Windows operating systems.

In the Windows policy editor on the Overview page, you can see that the Windows policy was created as a child of the Base policy. The policy's anti-malware setting is Inherited (Off):

This means that the setting is inherited from the parent Base policy, and that if you were to change the anti-malware setting in the Base policy from Off to On, the setting would change in the Windows policy as well. (The Windows policy setting would then read Inherited (On). The value in parentheses always shows you what the current inherited setting is.)

Overrides

This Overrides page shows you how many settings have been overridden at this policy or specific computer level. To undo the overrides at this level, click the Remove button.

In this example, the Windows Server 2008 policy is a child policy of the Windows policy. Here, the anti-malware setting is no longer inherited; it is overridden and hard-set to On.

Looking further into the Windows 2008 Server policy, we can see that intrusion prevention is also On, and looking at the intrusion prevention page we see that a set of intrusion prevention rules are assigned:

Override object properties

The intrusion prevention rules that are included in this policy are copies of the intrusion prevention rules stored by the Deep Security Manager which are available for use by any other policies. If you want to change the properties of a particular rule, you have two choices: modify the properties of the rule globally so that the changes you make apply to all instances where the rule is in use, or modify the properties locally so that the changes you make only apply locally. The default editing mode in a Computer or policy editor is local. If you click Properties on the Assigned Intrusion Prevention Rules area toolbar, any changes you make in the Properties window that appears will only apply locally. (Some properties like the rule name can't be edited locally, only globally.)

Right-clicking a rule displays a context menu which gives you the two Properties editing mode options: selecting Properties will open the local editor window and Properties (Global) will open the global editor window.

Most of the shared common objects in Deep Security can have their properties overridden at any level in the policy hierarchy right down to the individual computer level.

Override rule assignments

You can always assign additional rules at any policy or computer level. However, rules that are in effect at a particular policy or computer level because their assignment is inherited from a parent policy cannot be unassigned locally. They must be unassigned at the policy level where they were initially assigned.

If you find yourself overriding a large number of settings, you should probably consider branching your parent policy.

View the overrides on a computer or policy at a glance

You can see the number of settings that have been overridden on a policy or a computer by going to the Overrides page in the computer or policy Editor:

Overrides are displayed by protection module. You can revert system or module overrides by clicking the Remove button.