Skip to main content

Managing Policies

The Corsha mIDP provides three types of policies for controlling machine-to-machine communications:

  1. Connection Rules: Define which machines can communicate with each other2.
  2. Protocol Enforcement Rules: Broad policies that block or allow specific protocols/ports across all machines
  3. Scheduled Access Policies: Time-based access controls for temporary or scheduled communications

These policy types work together to enforce zero-trust security for machine communications.

Policy Types​

Connection Rules​

Connection rules define allowed communications between specific machines. These are the primary policy mechanism for controlling machine-to-machine access.

Key capabilities:

  • Machine-to-machine rules
  • Directional (source → destination) enforcement
  • Protocol and port specific restrictions

When to use: Defining specific allowed communications between known machines.

Protocol Enforcement Rules​

Protocol enforcement rules provide broad controls that apply across all machines, blocking or allowing specific protocols and ports regardless of machine identity.

Key capabilities:

  • Block/allow specific protocols (TCP, UDP, etc.)
  • Block/allow specific ports or port ranges
  • Deep protocol inspection for industrial protocols (OPC UA, Modbus TCP, EtherNet/IP, BACnet/IP)
  • Global application across all machines
  • Always override connection rules when conflicts occur

When to use: Enforcing organization-wide security policies, blocking dangerous protocols globally, or allowing essential services in Block by Default environments.

Important: Protocol enforcement rules always take precedence over connection rules.

Scheduled Access Policies​

Scheduled access policies enable time-based access controls for machine groups. These policies allow or deny traffic from specific machine groups during defined time windows on specific days of the week.

Key capabilities:

  • Weekly recurring schedules
  • Start and end time windows
  • Allow or Deny actions
  • Machine group targeting
  • Temporary access for maintenance windows

When to use: Providing time-limited access for maintenance, restricting communications to business hours, or implementing temporary access for contractors.

Policy Type Comparison​

FeatureConnection RulesProtocol EnforcementScheduled Access
ScopeSpecific machinesAll machinesMachine groups
GranularityFine-grainedBroadGroup-level
DirectionalitySource → DestinationBidirectionalSource-based
Protocol FilteringRequiredRequiredNot applicable
Time-BasedNoNoYes
PrecedenceLowestHighestMedium
Use CaseSpecific allowed communicationsGlobal protocol policiesTemporary/scheduled access
Enforcement Mode ImpactYes (Allow/Block filtering)Yes (Allow/Block filtering)No

Policy Precedence and Interaction​

Understanding how policies interact is critical for effective access control:

Evaluation Order​

When a connection is attempted, the Corsha Gatekeeper evaluates policies in this order:

  1. Baseline enforcement mode - Determines the default action (allow all, block all, or Observe-Only)
  2. Protocol enforcement rules - Global port and protocol-based rules
  3. Scheduled access policies - Time-based group access controls
  4. Connection rules - Specific machine-to-machine permissions

Key Precedence Rules​

Scheduled access policies control group-level access:

  • If a scheduled policy denies access for a machine group during specific hours, connections from that group are blocked during those times
  • Connection rules are still evaluated, but the scheduled policy acts as an additional filter

Enforcement mode affects rule filtering:

  • In Allow by Default mode: Only Block rules are enforced (for both protocol enforcement and connection rules)
  • In Block by Default mode: Only Allow rules are enforced (for both protocol enforcement and connection rules)
  • See Deployment Lifecycle for details on enforcement modes

Choosing the Right Policy Type​

Use this decision matrix to determine which policy type to use:

ScenarioRecommended Policy TypeRationale
Allow Machine A to communicate with Machine BConnection RuleSpecific machine-to-machine communication
Block all Telnet traffic across the networkProtocol EnforcementGlobal security policy for dangerous protocol
Allow OPC UA traffic in zero-trust environmentProtocol EnforcementEssential protocol needed globally
Temporary access for contractor group during business hoursScheduled AccessTime-limited, group-based access
Block FTP between two specific machinesConnection RuleTargeted restriction between known machines
Allow maintenance team access only on weekendsScheduled AccessRecurring time-based access

Policy Enforcement​

Policies are enforced locally by Gatekeepers deployed in your infrastructure. The mIDP continuously synchronizes policies to all Gatekeepers, ensuring consistent enforcement across your environment.

Enforcement Modes​

Gatekeepers can operate in different enforcement modes:

  • Observe-Only: Log all traffic, enforce no policies (discovery phase)
  • Allow by Default: Only enforce Block rules, permit everything else
  • Block by Default: Only enforce Allow rules, block everything else (zero-trust)

See the Gatekeeper documentation for details on enforcement modes.

Policy Management Best Practices​

  1. Start with Observe-Only: Deploy Gatekeepers in Observe-Only mode to discover existing connections before creating policies
  2. Use Connection Canvas: Visualize connections before creating blocking rules to avoid disrupting legitimate traffic
  3. Organize with Groups: Create machine groups before connection rules for more maintainable policies
  4. Progressive Hardening: Transition through enforcement modes gradually: Observe-Only → Allow by Default → Block by Default
  5. Protocol Rules Sparingly: Use protocol enforcement for broad policies, not machine-specific restrictions
  6. Document Policies: Add descriptions to rules explaining their purpose and business justification
  7. Test Before Blocking: Verify connection rules in Allow by Default mode before switching to Block by Default
  8. Monitor After Changes: Watch Connection Canvas and logs after policy updates

Getting Started​

Choose the policy type you need to configure: