1. A method of managing a security policy, said method comprising: a computer receiving a first specification set, a second specification set and a third specification set, wherein said first specification set maps each service of a first set of services to a corresponding service of a second set of services based on each service of said first set of services requiring communication with said corresponding service of said second set of services, wherein said first and second set of services are included in a plurality of services, wherein said second specification set maps each service of said plurality of services to one or more corresponding devices of a plurality of devices, and wherein said third specification set maps each device of said plurality of devices to one or more network addresses; said computer combining said received first, second and third specification sets by mapping said first, second and third specification sets to a plurality of packet filtering rule statements; and a processor of said computer generating said security policy as a plurality of packet filtering rules based on said combined first, second and third specification sets and said plurality of packet filtering rule statements, wherein each packet filtering rule of said plurality of packet filtering rules specifies a corresponding source network address or range of source network addresses, a corresponding destination network address or range of destination network addresses, a corresponding port or range of ports, a corresponding protocol and a corresponding action.