1. A security policy configuration method implemented by a network traffic control device, comprising: identifying a source, a destination, and an application type of a data stream that is an input to the network traffic control device, wherein the source indicates a user who sends the data stream or a user address from which the data stream is sent, the destination of the data stream indicates a user address, a server address, or a public network address at which the data stream is received, and the application type indicates which type of application whose data is comprised in the data stream; executing, based on a predetermined enterprise organizational structure, first upward tracing processing to obtain a first source upward tracing point and a first destination upward tracing point, wherein the first source upward tracing point is a department to which the user indicated by the source of the data stream belongs, or a network segment to which the user address indicated by the source of the data stream belongs, and the first destination upward tracing point is a network segment to which the user address indicated by the destination of the data stream belongs, a server corresponding to the server address indicated by the destination of the data stream, or any address corresponding to the public network address indicated by the destination of the data stream; and generating a first security policy, wherein a source in a match condition of the first security policy is configured to the first source upward tracing point, a destination in the match condition of the first security policy is configured to the first destination upward tracing point, and an application in the match condition of the first security policy is configured to the application type of the data stream.