Abstract: Described is a method, apparatus, and computer program product for security management in a node of a data processing network comprising a plurality of nodes, wherein each node maintains topology data representing the network. The method comprises evaluating an event received by the node from a neighboring node in the network to determine if the event satisfies a predetermined security test. If the event fails the security test, an entry associated with the neighboring node is modified in the topology data maintained by the node, and an alarm notification indicative of the security failure is sent to other nodes of the network.