A system (100, 300, 800) for generating a network security rule, the system comprising: one or more processors; and one or more memory devices that store program code configured to be executed by the one or more processors, the program code comprising: an allowed connections determiner that includes: a security rule determiner configured to determine security rules across a network that includes a plurality of resources (114A-114N, 118A-118N), and a topology map generato-r configured to generate a map of permitted connections between resources over the network; a network traffic data collector configured to gather network traffic data that corresponds to data traffic between the resources (114A-114N, 118A-118N) over the permitted connections; and a rule generator configured to generate an enhanced security rule for a permitted connection indicated in the map based on the security rules and the network traffic data, the enhanced security rule configured to reduce data traffic over the permitted connection; characterized in that the rule generator is further configured to: determine that the network traffic data indicates data traffic over the permitted connection does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic; and generate the enhanced security rule in response to the determination that the network traffic data indicates data traffic does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic. one or more processors; and one or more memory devices that store program code configured to be executed by the one or more processors, the program code comprising: an allowed connections determiner that includes: a security rule determiner configured to determine security rules across a network that includes a plurality of resources (114A-114N, 118A-118N), and a topology map generato-r configured to generate a map of permitted connections between resources over the network; a network traffic data collector configured to gather network traffic data that corresponds to data traffic between the resources (114A-114N, 118A-118N) over the permitted connections; and a rule generator configured to generate an enhanced security rule for a permitted connection indicated in the map based on the security rules and the network traffic data, the enhanced security rule configured to reduce data traffic over the permitted connection; characterized in that the rule generator is further configured to: determine that the network traffic data indicates data traffic over the permitted connection does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic; and generate the enhanced security rule in response to the determination that the network traffic data indicates data traffic does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic. an allowed connections determiner that includes: a security rule determiner configured to determine security rules across a network that includes a plurality of resources (114A-114N, 118A-118N), and a topology map generato-r configured to generate a map of permitted connections between resources over the network; a security rule determiner configured to determine security rules across a network that includes a plurality of resources (114A-114N, 118A-118N), and a topology map generato-r configured to generate a map of permitted connections between resources over the network; a network traffic data collector configured to gather network traffic data that corresponds to data traffic between the resources (114A-114N, 118A-118N) over the permitted connections; and a rule generator configured to generate an enhanced security rule for a permitted connection indicated in the map based on the security rules and the network traffic data, the enhanced security rule configured to reduce data traffic over the permitted connection; characterized in that the rule generator is further configured to: determine that the network traffic data indicates data traffic over the permitted connection does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic; and generate the enhanced security rule in response to the determination that the network traffic data indicates data traffic does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic. determine that the network traffic data indicates data traffic over the permitted connection does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic; and generate the enhanced security rule in response to the determination that the network traffic data indicates data traffic does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic.