How Does SDN Secure the Modern Data Center?

TL;DR

Software-defined networking can improve data center security by giving administrators programmable, more centralized control, while using network-wide visibility and enforcement to detect and defend against attacks. It also helps applications interact directly with infrastructure, reduces operational costs, supports scalable service deployment, and addresses an environment where users, devices, connections, applications, data centers, and clouds interact in increasingly varied combinations.

Transcript

What if the next big thing isn't a thing at all? It's lots of things all waking up. Becoming part of the global phenomenon we call the Internet of Everything. Trees will talk to networks, will talk to scientists about climate change. Cars will talk to road sensors, will talk to stoplights about traffic efficiency. The ambulance will talk to patient... Read More

Key Insights

• The Internet of Everything is a network of networks in which billions or even trillions of connected devices can communicate, gain context awareness, and use greater processing capability. These connections create new opportunities, but they also expand the risks confronting networks and data centers.
• The any-to-any problem is the challenge of protecting any user on any device, using any connection, to reach any application hosted in any data center or cloud. Users may access business applications without passing directly through a network controlled by their organization.
• Security and compliance requirements remain necessary even as the underlying environment changes. Security professionals must provide appropriate transaction inspection and protection against adversaries regardless of where users connect, which devices they use, or where the applications and data reside.
• Software-defined networking is the abstraction of management, control, and data-plane layers so resources previously controlled within individual networking devices can be allocated dynamically. This abstraction introduces programmable interfaces and more centralized traffic control without requiring direct administration of every device.
• The management plane sets policy, the control plane decides where traffic should go, and the data plane acts on policy settings and traffic-management decisions. SDN separates and abstracts these functions at both the individual device level and the broader network level.
• SDN extends the cloud operating model by lowering operational costs, speeding the scalable deployment of applications and network services, and enabling cloud bursting for flexible compute on demand. It addresses network bottlenecks that can prevent organizations from obtaining the expected value of cloud infrastructure.
• Applications can interact directly with network infrastructure through expanded APIs. They can query the network for user identity or location, manage quality of service, and support targeted content delivery at the level of an individual user or device.
• Network-wide visibility and enforcement are central security benefits of SDN. By drawing on the network’s capabilities at scale, security systems can gain new ways to detect attacks and apply defenses across distributed infrastructure rather than relying only on controls attached to individual devices.

Questions & Answers

Q: What is software-defined networking?

Software-defined networking is an architectural approach that abstracts the management, control, and data planes of networking devices. This abstraction lets administrators allocate resources dynamically and control traffic through expanded programmable interfaces. Instead of requiring direct access to every switch or router, administrators can exercise more centralized control across distributed network functions and infrastructure layers.

Q: How can SDN improve data center security?

SDN can improve data center security by using network capabilities for high-scale visibility and enforcement. These capabilities provide new ways to detect attacks and defend applications, users, and data across distributed infrastructure. Programmable control also helps security teams apply policies as traffic and applications move among networks, data centers, and clouds, where traditional boundaries may not apply.

Q: What is the any-to-any security problem?

The any-to-any problem describes an environment where any user can use any device and connection to reach any application running in any data center or cloud. Users may access applications without passing through the organization’s controlled network. Security teams must still inspect transactions and protect against threats, even though the locations, devices, connections, and hosting environments continually vary.

Q: How do the management, control, and data planes differ?

The management plane is where policy is set within a networking device. The control plane makes decisions about where network traffic should be sent. The data plane acts on both the configured policies and the traffic-management decisions. SDN abstracts these three layers so their resources and functions can be managed dynamically across individual devices and the wider network.

Q: Why are organizations adopting software-defined networking?

Organizations are embracing SDN because it can lower operational costs and make application and network-service deployment faster and more scalable. It also supports cloud bursting, which provides flexible compute on demand. The network can otherwise become a bottleneck that limits cloud benefits, so SDN helps organizations obtain more value from cloud-oriented infrastructure and operating models.

Q: How can applications interact with an SDN-enabled network?

Applications can use programmable interfaces to interact directly with underlying network infrastructure. They may query the network for information about a user’s location or identity, manage quality of service, and support content delivery targeted to a specific user or device. This interaction allows applications to obtain value directly from capabilities and information available within the network.

Q: Does adopting SDN require replacing the entire network?

SDN adoption is presented as an evolution rather than a mandatory replacement of the entire network architecture. Organizations do not necessarily need a forklift upgrade to gain its benefits. For most existing devices discussed in the keynote, a simple operating-system upgrade can enable SDN capabilities, making the transition part of the continuing evolution toward programmable networks.

Q: How do cloud growth and connected devices affect security?

Cloud applications, mobile devices, and connected objects increase the number and variety of interactions that security teams must protect. Applications are developed in and for the cloud, while users and business units increasingly select cloud services themselves. Connected things add capability, context awareness, and processing power, creating valuable opportunities while also introducing risks across networks and data centers.

Summary & Key Takeaways

• Rapid growth in mobile devices, cloud applications, and connected objects is changing networks, data centers, jobs, and security requirements. The Internet of Everything connects networks containing potentially billions or trillions of devices, creating useful capabilities alongside substantial risks. Security professionals must protect transactions even when users bypass the organization’s controlled network.

• Software-defined networking abstracts the management, control, and data planes that traditionally operate within individual switches and routers. Expanded APIs give network administrators programmable, more centralized control over traffic and distributed functions. This architecture also promotes convergence between network architecture and data center infrastructure, allowing applications to operate more seamlessly across different clouds.

• SDN can lower operational costs, accelerate scalable deployment of applications and network services, and support flexible compute on demand through cloud bursting. Applications can query networks for user location or identity, manage quality of service, and deliver targeted content. For security, network visibility and enforcement provide stronger mechanisms for detecting and defending against attacks.