Software defined networking (SDN) is a technology that allows network administrators to treat the functionality and implementation details of a network as separate and distinct functions. Learn how SDN is changing networking and the security implications of this change.
- [Narrator] Software-Defined Networking, or SDN, is a technology that allows network administrators to treat functionality and implementation details of network as separate and distinct functions. In a traditional approach to networking, an organization network infrastructure is full of routers and switches that provide both the physical connections that make up the network and the logical capability to determine network routes, port assignments, and other characteristics.
When a network administrator wants to reconfigure the network, he or she logs into router, or switch and use a series of commands to alter the configuration. While this may be done manually, or using network managing software changes to the network require configuration changes to routers and switches. This approach combines two different functions of the network. The control plane of the network is responsible for the routing and switching decisions that determine how data flows around a network.
The control plane might reroute packets when a device fails or when a network segment becomes congested. The control plane determines how network devices interact with each other. The data plane of a network consists of the mechanics of actually moving packets around. The data plane carries out the instructions of the control plane. Software defined networks separate the control plane and the data plane from each other. Instead of each router and switch making independent decisions about how to route packets, these decisions come from and SDN controller.
The SDN controller is where network administrators, and algorithms make decisions about network routing, and then the controller reaches out to each device on the network, and programs it to carry out those instructions properly. The SDN controller implements the control plane of the network while the routers and switches accept instructions from that control plane to carry out the data plane function. The major benefit that SDN brings is that it makes the network programmable.
Developers can write code that modifies the network as requirements change. If an application needs more bandwidth, it can reach out and reconfigure the network to provide that bandwidth, and then it can release it when that bandwidth is no longer needed. Network administrators don't need to lift a finger because the control plane is separated from the data plane. From a security perspective, SDN does provide some benefits. First, it allows very granular configuration of the network.
In many organizations network administrators typically balk at routing VLANs across networks of different buildings, because of the difficulty of configuring those VLANs. However, with SDN this becomes quite easy, and allows the use of strong network segmentation practices. Second, SDN allows security folks to respond more quickly to network security issues. For example, if the network comes under a denial of service attack from a misconfigured host, security tools can automatically reach out and disable the network switch port belonging to that host, and place the host in a quarantine zone where it has very limited network access.
However, SDN also comes with security concerns. Because SDN makes the network programmable, it increases the complexity of the network, and requires the use of strong access controls. After all, you wouldn't want a malicious individual gaining access to your network control plane, and using SDN to conduct eavesdropping, or impersonation attacks.
Learn about communication and networking best practices, including TCP/IP networking, network security devices, and secure network design and management. Instructor and cybersecurity expert Mike Chapple also includes coverage of converged protocols, network encryption, and wireless networking. You can find Mike's companion study books for this series at the Sybex test prep site and review the complete CISSP Body of Knowledge at https://www.isc2.org/cissp-domains/default.aspx.
- IP addressing
- Switches and routers
- Content distribution networks
- Designing secure networks
- Specialized networking
- Managing secure networks
- Working with virtualized networks like SDNs
- Detecting and preventing network attaches
- Transport encryption
- Wireless networking
- Host security