grade implementation. The benefits derived from SDN and NFV deployment can be divided into three categories: design enhancements, performance improvements, and real-time capabilities. Figure 9.3 expands on the benefits in each of these categories and are described in greater detail. 9.2.1 DESIGN ENHANCEMENTS SDN and NFV provide flexibility and capabilities that enable security to be designed into the solu- tion rather than being an add-on once the network and the rest of the infrastructure is architected, defined, and designed. Incorporating security capabilities as part of the design process allows for the security solution to be optimized. This will result in the security functions being deployed locations and manners that will provide optimal security coverage while controlling costs better. NFV will enable the security components to be deployed in smaller less-expensive units in the loca- tions where needed, while SDN adds to the flexibility as to where and how these capabilities can be deployed. SDN and NFV allows for the security controls to be customized to the particular flows, enabling particular traffic to flow through a single security device or multiple security devices, depending the security risks that need to be addressed. This is shown in Figure 9.4. This is referred to as a "Defense in Depth Architecture." As an example, if there is risk of sensitive information being leaked, then the traffic can be directed to flow through a data leak protection (DLP) control as well as a FW. In Figure 9.4, Vendor 1 Security Tool could be the FW, Vendor 2 Security Tool could be the intrusion detection system (IDS), and Vendor 3 Security Tool could be the DLP protection. If this risk is not present, then the DLP control can be bypassed and just the FW and IDS controls are experienced. This use of the service-chaining ability provides greater efficiency both in optimizing the amount of DLP controls needed in the infrastructure, as well as the benefit of the nonsensitive information flowing more efficiently through