 to disable or modify the security check in the security component. This provides an additional layer in the defense of the network. Figure 9.9 shows a security function being service chained into the OAM path of a VNF. Various VNFs can be service chained into the management paths. FWs, intrusion detection and intrusion prevention systems, debugging tools, log analysis tools, and many other can all be used. The following basic principles leveraged in the design of MPLS VPN network also apply to cloud- based architecture [2]. Separation. SDN and cloud-based architecture allow computing resources as well as networking resources to be efficiently and securely shared across many customers. Those same technologies are used to separate management functions in the cloud architecture. The principle of least privi- lege states that users, be they customers or network managers, should only be given access to the resources they need to do their jobs. Cloud architecture allows us to set up separate management domains using the same technology used to set up different environments for different customers. For example, management of the hypervisors and other resources that create the cloud environment itself, is separate from the management of the VNF tenants that customers see. Automation. ONAP orchestrates resources, allowing networking and computing resources to be adjusted as needed when the load changes. It also makes sure that all the necessary security func- tions are included; the security rules are stored as part of the description of a given VNF, SO when a new copy of the VNF is instantiated, the appropriate security features are automatically included. Monitoring. Physical and virtual elements are monitored and additional capacity can be added as needed to meet observed load. If a potential security issue is seen, automation can service chain additional security tools to investigate the situation. A copy of a misbehaving VNF can be sent for forensic evaluation and a new, clean copy started fresh. Control. Operationa