A NEW BREED

networkage
Hardening
software-defined
Software-defined networking is empowering businesses to scale and adapt
like never before, but it’s still early days, and protecting these networks
remains a top issue. So just how mature is the security around SDN?
O
ver the past few
years, innovations
in software-defined
networking (SDN) have
helped IT tackle barriers that inhibit
agility, automation and scale, helping
their businesses to flourish. But if
there’s one thing we’ve learnt, it’s that
convenience usually comes at a price
– are network managers rushing into
the brave new world of SDN while
forgetting that its underlying security
remains essentially unproven?
Some of the world’s biggest
universities, like Stanford and
Berkeley, use software-defined
networks to collaborate on opensource
research data, and Google
revealed a few years ago how it is
using its own software-defined
network to power its data centre
WAN, and cost-effectively handle its
vast traffic loads. Similarly, hyperscale
companies like Microsoft have had to
write their own SDN solutions, such as
for their Azure cloud, when the
flexibility and speed required to fuel
their explosive growth just didn’t
exist in traditional networking
approaches.
But SDN marks a huge change in the
security model. As with any new
technology, there are numerous
‘SDN allows security
services and policies to be
controlled, automated
and provisioned to every
device on the network
from a single point’
>> John Vestberg, Clavister
security weaknesses both present and
yet to be discovered, primarily due to
being relatively untested. And just like
virtualisation made servers instantly
both more and less secure – more
because of the abstraction layer, less
because you no longer need physical
access – we see this pattern repeating
with SDN. While a physical network
changes at the speed of the human
managing it, the software-defined
version can change at the speed of a
machine.
And although we’re yet to see any
major SDN security breaches hit the
headlines, the vulnerabilities are
starting to become apparent. Multivendor
SDN project OpenDaylight
learnt this the hard way last August
when it was forced to patch a
serious vulnerability that took until
December to fix.
Openflow weaknesses can emerge
from the separation of the control
plane (the high-level management of
network devices) and the data plane
(the actual hardware itself) that
defines SDN.
As Scott Pendlebury, lead cyber
threat intelligence analyst at Fujitsu,
explains, it’s the communication
between these layers where the
security concerns arise.
‘The layers communicate with
each other through API calls that,
depending on which layer the attacker
decides to target, can present a
number of options,’ says Pendlebury.
‘For example, an attacker could spoof
the API calls made at the controller
layer heading to the network
September 15 information-age.com
33