Configuring a device security policy