A method comprising: at a management entity: discovering multiple security devices connected to a network; receiving from the multiple security devices over the network corresponding native security policies each based on a native policy model associated with the corresponding security device, each security device configured to control access to a resource according to the corresponding native security policy, wherein each native security policy includes native security rules, and each native security rule includes native rule parameters expressed according to the corresponding native policy model and the native rule parameters are configured to cause an identified security device to perform an access control operation for a type of access based on a protocol, a source address associated with the access control operation, and a destination address associated with the network access; and normalizing the received native security policies across the multiple security devices based on a generic policy model, to produce at least one normalized security policy that is based on the generic policy model and representative of the native security polices, the normalizing including, for each received native security policy: mapping the native rule parameters to corresponding generic rule components of the generic policy model, the mapping including: providing for each native policy model, a policy model bridge that describes native policies in terms of general policies, the policy model bridge enumerating policies supported by the policy model bridge, wherein the policy model bridge comprises a rule mapper object that expresses native policy rules into generic policy rules; and mapping by the rule mapper object, for each native security policy, the source address to a {principal} component, the access control operation to an {action} component, the destination address to a {resource} component, the protocol to a {context} component, and the type of access attempted to a {result} component to form a generic security rule in the form: if {principal} tries to perform an {action} on {resource} within {context} then {result} wherein the native security rule further specifies a time frame over which the security device is to apply the access control operation for the type of access, and the mapping further includes mapping the time frame to the {context} rule component and wherein the native security rule further specifies a uniform resource locator, URL, to identify an entity specific to the security device, and the mapping further includes mapping the URL to the {resource} rule component. discovering multiple security devices connected to a network; receiving from the multiple security devices over the network corresponding native security policies each based on a native policy model associated with the corresponding security device, each security device configured to control access to a resource according to the corresponding native security policy, wherein each native security policy includes native security rules, and each native security rule includes native rule parameters expressed according to the corresponding native policy model and the native rule parameters are configured to cause an identified security device to perform an access control operation for a type of access based on a protocol, a source address associated with the access control operation, and a destination address associated with the network access; and normalizing the received native security policies across the multiple security devices based on a generic policy model, to produce at least one normalized security policy that is based on the generic policy model and representative of the native security polices, the normalizing including, for each received native security policy: mapping the native rule parameters to corresponding generic rule components of the generic policy model, the mapping including: providing for each native policy model, a policy model bridge that describes native policies in terms of general policies, the policy model bridge enumerating policies supported by the policy model bridge, wherein the policy model bridge comprises a rule mapper object that expresses native policy rules into generic policy rules; and mapping by the rule mapper object, for each native security policy, the source address to a {principal} component, the access control operation to an {action} component, the destination address to a {resource} component, the protocol to a {context} component, and the type of access attempted to a {result} component to form a generic security rule in the form: if {principal} tries to perform an {action} on {resource} within {context} then {result} providing for each native policy model, a policy model bridge that describes native policies in terms of general policies, the policy model bridge enumerating policies supported by the policy model bridge, wherein the policy model bridge comprises a rule mapper object that expresses native policy rules into generic policy rules; and mapping by the rule mapper object, for each native security policy, the source address to a {principal} component, the access control operation to an {action} component, the destination address to a {resource} component, the protocol to a {context} component, and the type of access attempted to a {result} component to form a generic security rule in the form: if {principal} tries to perform an {action} on {resource} within {context} then {result}