A security policy configuration method implemented by a network traffic control device, comprising: identifying a source, a destination, and an application type of an input data stream, wherein the source indicates a user who sends the data stream or a user address from which the data stream is sent, the destination of the data stream indicates a user address, a server address, or a public network address at which the data stream is received, and the application type indicates which type of application whose data is comprised in the data stream; if the data stream does not match an existing policy, matching the data stream with a permit any policy that allows access of all users; executing, based on a predetermined enterprise organizational structure, first upward tracing processing to obtain a first source upward tracing point and a first destination upward tracing point when the data stream matches the permit any policy, wherein the first source upward tracing point is a department to which the user indicated by the source belongs when the source indicates a user, the first source upward tracing point is a first network segment to which the user address indicated by the source of the data stream belongs when the source indicates a user address from which the data stream is sent, the first network segment comprises multiple IP (Internet Protocol) addresses, and the first destination upward tracing point is set to any address when the destination indicates a public network address, the first destination upward tracing point is set to a server when the destination indicates a server address; the first destination upward tracing point is a second network segment to which the user address at which the data stream is received belongs when the destination indicates a user address at which the data stream is received, the second network segment comprises multiple IP addresses; and generating a first security policy, wherein a source in a match condition of the first security policy is configured to the first source upward tracing point, a destination in the match condition of the first security policy is configured to the first destination upward tracing point, and an application in the match condition of the first security policy is configured to the application type of the data stream, the first security policy is used to match with a subsequent data stream. identifying a source, a destination, and an application type of an input data stream, wherein the source indicates a user who sends the data stream or a user address from which the data stream is sent, the destination of the data stream indicates a user address, a server address, or a public network address at which the data stream is received, and the application type indicates which type of application whose data is comprised in the data stream; if the data stream does not match an existing policy, matching the data stream with a permit any policy that allows access of all users; executing, based on a predetermined enterprise organizational structure, first upward tracing processing to obtain a first source upward tracing point and a first destination upward tracing point when the data stream matches the permit any policy, wherein the first source upward tracing point is a department to which the user indicated by the source belongs when the source indicates a user, the first source upward tracing point is a first network segment to which the user address indicated by the source of the data stream belongs when the source indicates a user address from which the data stream is sent, the first network segment comprises multiple IP (Internet Protocol) addresses, and the first destination upward tracing point is set to any address when the destination indicates a public network address, the first destination upward tracing point is set to a server when the destination indicates a server address; the first destination upward tracing point is a second network segment to which the user address at which the data stream is received belongs when the destination indicates a user address at which the data stream is received, the second network segment comprises multiple IP addresses; and generating a first security policy, wherein a source in a match condition of the first security policy is configured to the first source upward tracing point, a destination in the match condition of the first security policy is configured to the first destination upward tracing point, and an application in the match condition of the first security policy is configured to the application type of the data stream, the first security policy is used to match with a subsequent data stream.