Network security policies can be divided into two categories:
Internal threat prevention
External threat prevention
External threat prevention policies implement what is generally understood to be the responsibility of a firewall, which is to block connection requests from outside the network and only allow incoming traffic if it is in response to a request that originated from within the network. Some networks, such as those that include a Web server, need to allow incoming connection requests but only to a specific device or section of the network. In these instances, it is better to conceptually divide the network into zones of trust. Each zone is given a trust rating and then treated as a separate network for the purposes of network security policy management. This alters the definition of which traffic is external and which is internal.