Abstract: A security management approach that combines network security management with application layer or software service security to address the threat of internal network security attacks. The invention is directed to a method for enhancing network security on a computer network. Data access privileges relating to users and services are interpreted, network access rules are determined based on the interpreted privileges, and network message traffic is monitored and filtered based on the determined network access rules. The interpreting, determining, monitoring, and filtering are performed at a network layer responsible for controlling how a network device gains access to the network, such as the Media Access Control (MAC) layer.

Abstract: A security management approach that combines network security management with application layer or software service security to address the threat of internal network security attacks. The invention is directed to a method for enhancing network security on a computer network. Data access privileges relating to users and services are interpreted, network access rules are determined based on the interpreted privileges, and network message traffic is monitored and filtered based on the determined network access rules. The interpreting, determining, monitoring, and filtering are performed at a network layer responsible for controlling how a network device gains access to the network, such as the Media Access Control (MAC) layer.