Explanation
you may optionally specify one or more security lists for the subnet to use (up to five). If you don't specify any, the subnet uses the cloud network's default security list. You can change which security list the subnet uses at any time.
https://docs.cloud.oracle.com/iaas/Content/Network/Tasks/managingVCNs.htm