lusion Communicating to the VNF owner the results of each control measurement including instructions on remediation requirements in order to obtain approval for distribution Both the upstream and downstream automation is performed by the ASTRA Security Certification Engine. This functionality acts as a standalone application controller, which oversees security aspect of the VNF onboarding, certification, and distribution processes. 9.5 SECURITY PLATFORMS As mentioned earlier, security of AT&T's cloud-based architecture is based on a multilayered defense strategy and includes three critical platforms: (1) identity and access management, (2) secu- rity analytics, and (3) ASTRA. It starts with a comprehensive identity and access management (IAM) approach. This approach goes beyond traditional methods such as self-created passwords. Strong multifactor protection includes user credentials, biometrics information, and a user's mobile device provide an effortless way to protect hardware, systems, and applications. ASTRA is a granular security policy engine, which can create "rings" of protection at the cloud perimeter, tenants, and workload levels. These rings act as a micro-perimeter for every asset that needs to be protected. Security policies created for one asset can automatically apply to new instance of that asset. ASTRA enables customized protection for the cloud versus having a one-size-fits all approach to security. Leveraging ASTRA, it is possible to shrink-wrap security around each object in the cloud. Security analytics is the practice of looking for abnormal behaviors or malicious activities on the network. The security analytics platform detects malicious activities and leverages ASTRA to automate the mitigation strategy. The security analytics platform uses event data from ASTRA and ONAP Data Collection Engine to quickly detect and characterize many types of attacks providing valuable information to mitigate attacks early on. A team of analyst leverage big data techniques to alert on anomalies. Automated 