roller security may be compromised: Billing Elements Network Cloud Security Elements Infrastructure Elements FIGURE 9.10 Evolution of the perimeter (gray line represents the perimeter). Network Security The SDN controller is hacked via a vulnerability in the Open Source code, for example, the hacker exploits a vulnerability in the Open Source code and infects the SDN controller with malware, then the compromised SDN controller VM can be quickly detected, iso- lated, shutdown, quarantined, and replaced by another instance of a secured SDN control- ler VM while the operations team quickly work on resolving the threat (e.g., apply security patches to fix the Open Source code vulnerability). The SDN controller is hacked via a vulnerability in the Open Source code, for example, the hacker exploits a vulnerability in the Open Source code and gains access to the SDN controller, then. There are several security best practices to consider to mitigate this risk. A role-based-access control function can limit the hacker to performing least-privileged activities (e.g., will not disrupt service) while we quickly work on resolving the threat. Security scans of network elements (i.e., SDN controller software) can be conducted to detect known vulnerabilities. A zero-day (unknown) vulnerability can be mitigated by quickly applying security patches. The following paradigms are important architecture considerations: 1. Software-defined configurability of VM FW rules will help SDN controller security: SDN controller can dynamically modify the FW rules. For example, the SDN con- troller can dynamically modify the security gateway rules in response to a security incident. In this case, the SDN controller will modify the FW rules to dynamically block malicious traffic or a DDoS attack preventing service disruption. This provides a real-time mechanism to respond to security threats leveraging the SDN controller. 2. The network cloud shared infrastructure benefits from this security architecture: Using rigorous tools and processes, the n