1. A method comprising: at a management entity to communicate with security devices over a network: displaying a visualization of a network environment including network icons representing respective network zones at corresponding locations, and device icons representing one or more actors and one or more resources in corresponding ones of the visualized network domains, and one or more network security devices; receiving user input in the form of a line drawn between a first icon representing an actor in a first visualized network zone and a second icon representing a resource in a second visualized network zone, the line intersecting a third icon representing a network security device between the actor and the resource, wherein the line represents: whether to allow or block abilities between the actor and the resource; whether traffic between the actor and the resource is to be monitored; or whether access between the actor and the resource is permitted; interpreting the line as a definition of a security policy that controls access between the actor and the resource and, based on the interpreting, generating one or more security rules for configuring the network security device to control the access according to the security policy, each security rule including rule parameters to control the access based on a network protocol and at least one of a source address and a destination address; and delivering the one or more security rules to the security device to implement the security policy.