1. A method comprising: getting a security policy for a data network, the security policy allowing and/or prohibiting communications between a plurality of network assets and indicating groupings of the plurality of network assets using a common security characteristic corresponding to the respective grouping; initiating compilation of the security policy to produce a rule set, the rule set blocking communication between specific ones of the plurality of network assets using at least one of a source address, source port, destination address, destination port, and an application protocol associated with the communication; providing the rule set to at least one enforcement point; receiving at least one of analytics and a log corresponding to communications in the data network, the at least one of analytics and a log produced by a logging module; calculating a risk score corresponding to the plurality of network asset, the risk score being a measurement of relative security corresponding to the plurality of network asset; initiating a re-compiling of the security policy to produce an updated rule set using the calculated risk score; and disseminating the updated rule set to the at least one enforcement point.