A software defined security system comprising: a security control device configured to declare security services offered by the security control device; one or more assets, wherein the one or more assets include one of a server, a VPN client and server, an external computing device, and a mobile computing device; and a security controller that communicates with the security control device and the one or more assets, the security controller including a processing engine configured to: register the security control device by creating a physical-logical attribute mapping for the security control device, and generating a security service description associated with the security control device, wherein the security service description describes a security capacity of the security control device as one or more of the declared security services offered by the security control device; register the one or more assets by creating a physical-logical attribute mapping for each of the one or more assets, and generating security service requirements for each of the one or more assets; and generate a security service binding based on a request for service, the security service requirements and the security service description, the processing engine being operable to translate the security service binding into a set of security control commands and communicate the security control commands to the security control device. a security control device configured to declare security services offered by the security control device; one or more assets, wherein the one or more assets include one of a server, a VPN client and server, an external computing device, and a mobile computing device; and a security controller that communicates with the security control device and the one or more assets, the security controller including a processing engine configured to: register the security control device by creating a physical-logical attribute mapping for the security control device, and generating a security service description associated with the security control device, wherein the security service description describes a security capacity of the security control device as one or more of the declared security services offered by the security control device; register the one or more assets by creating a physical-logical attribute mapping for each of the one or more assets, and generating security service requirements for each of the one or more assets; and generate a security service binding based on a request for service, the security service requirements and the security service description, the processing engine being operable to translate the security service binding into a set of security control commands and communicate the security control commands to the security control device. register the security control device by creating a physical-logical attribute mapping for the security control device, and generating a security service description associated with the security control device, wherein the security service description describes a security capacity of the security control device as one or more of the declared security services offered by the security control device; register the one or more assets by creating a physical-logical attribute mapping for each of the one or more assets, and generating security service requirements for each of the one or more assets; and generate a security service binding based on a request for service, the security service requirements and the security service description, the processing engine being operable to translate the security service binding into a set of security control commands and communicate the security control commands to the security control device.