với mục đích thay đổi hành vi tự động trên bất kỳ hoạt động đáng pháp kết hợp tường lửa với bộ cảm biến IDS có thể đạt được mức độ bảo mật bổ sung. Các bức tường lửa thực thi chính sách trong khi các biện pháp IDS các cuộc tấn công nhằm vào các bức tường lửa | Enterprise Security Architecture 355 Vendor-specific policy directives are difficult to manage. Applications that switch from one vendor to another must migrate components to new platforms with different features yet maintain the same security configuration. Solutions using multiple vendors might have interoperability issues. Vendors might not be compliant with corporate guidelines for product categories and industry standards. Vendors normally provide a custom interface to their product that allows the definition of users objects and access control rules. It can be as simple as editing a default configuration file in an editor or as complex as using a custom GUI that accesses multiple directories or other subordinate hosts. GUIs cause problems for security management. Each vendor has his or her own rule definition syntax and file format. Rules have to be entered strictly through the GUI and the ordering of rules cannot be changed easily. Using the tool requires training and each new vendor product adds to the administrator s confusion with juggling multiple incompatible tools on the screen. Manual administration switching from screen to screen holds a tremendous potential for error. Enterprise security architecture requires automation which requires scripted configuration to all security components that permit bulk uploads of configuration information from text files or swaps of paranoid configurations for standard ones in the event of an intrusion. Configuration files should be in plain text with well-defined syntax that can be parsed and loaded into an object model of the product. It should be possible to add comments to the configuration to make the human-readable rules more understandable and it should be possible to transform a single generic policy into specific configurations for an entire family of appliances in a reasonably mechanical form. Similarly there has to be a mechanism to extract the vendor product configuration and examine it for completeness .
