dentity, and access management platforms, will bring a security framework and implementation that is superior in many ways to the current environment. 9.4.3 NETWORK AND APPLICATION SECURITY In the cloud-based architecture, network elements (routers, FWs, network address translations [NATs], etc.) are tenants in the cloud rather than physical network elements. This means that com- munications among network elements and communications for management of network elements are part of the cloud, SO the network elements are orchestrated and SDN is used to manage both customer data connections and management connections. Cloud and SDN features such as service chaining can thus be used both to provide new customer services and to manage the virtual network elements that provide customer services. In a classical network with physical network elements, care is taken to "harden" the network element itself, setting up barriers SO that outsiders cannot compromise the network element and use it as a platform to attack the network infrastructure. Vendors provide features (access control lists, controls on management ports) to aid in this and service providers manage the services available on routers and turn off features that are not necessary for operation of their network. The virtual net- work elements used in the cloud-based architecture provide these features as well, and they continue to be used to protect the virtual network elements. But the cloud-based architecture offers additional opportunities for security. For example, just as a vFW can be service chained into the customer data path to provide addi- tional protection for the customer, service-chaining technology can be used to insert a FW into the operations, administration, and management (OAM) path for a virtual network element. This pro- vides additional capabilities for detection and prevention of attacks and has the added benefit that the FW is a separate element from the network element. Cybersecurity, including network security, is a continuing battle between