Policy Definition and Enforcement
Policy anatomy
A policy is an ordered rule list. Rule types include access, SQL, session, object, exception, and snoop. Actions include allow, deny, log, alert, block, and terminate. Access rules govern connections; SQL rules inspect statements; session rules cover session attributes; exception rules carve out known-good traffic.
Enforcement
Policies are installed on collectors and distributed from the CM to managed units. Blocking requires S-TAP enforcement capability; a sniffer-only deployment can log and alert but cannot block at the database. Use simulation or log-only first, then tighten.
Worked example
Requirement: application accounts may read the customers table; a reporting account must never see card data; all DDL is logged. First allow the application group on customers. Second deny SELECT on card tables to the reporting group. Third log all DDL. Order specific allows and denies before broad rules, because the first matching rule wins. Install the policy to the collector and verify in the policy audit trail that each rule fired as expected.
Traps
Rule order; installing the policy only on the CM; expecting block from a sniffer; a broad allow early in the list masking later denies; exception rules that are too wide and silently disable controls.