A communication network is operated by logically dividing the communication network into a plurality of zones. Policies are specified that define allowable communications between elements in different ones of the plurality of zones. Communications are blocked between elements in different ones of the plurality of zones that violate at least one of the policies.