nd FWs from the physical to virtual world. In some areas, new entrants in the field are being disruptors and are redefining how security functionality can be architected and implemented. Some of the virtual substitutes are not as powerful or robust as the appliances they are replacing, although this is rapidly improving in some areas. The current evolution of the security framework for AIC is being optimized to support vir- tual environments. This evolution will enable secure tool use and management from within a DMZ (a subnetwork that contains services or applications that can be provided to an untrusted network in a secure manner), enhancing the separation between the cloud and the support networks. As mentioned above, perimeter-based components will still play a role even as vir- tualized security components replace physical components and ASTRA expands its role in providing enhanced tenant-based security functionality. For example, the southbound (SB) FW, which protects AIC from internal networks (and vice versa) is a candidate for migration to the cloud. On the other hand, the northbound (NB) FW, which protects AIC from the internet, will provide perimeter and cloud-based capabilities. Due to the amount of traffic and location, the NB FW is a candidate to remain at the perimeter where it will provide basic protection for all environments behind it as well as a centralized choke point that can be used to throttle traf- fic. It will also be available on a tenant-by-tenant basis, to provide more granular and flexible capabilities. The East-West (OpenStack tenant to tenant communication) FW capabilities will be provided by vFWs and managed by ASTRA. A similar analysis is done for each component of the security architecture. The introduction of SDN into the environment will be a significant driver for changes in the AIC security framework. It will drive the migration away from some current functionality, as well as enable additional capabilities such as service chaining. Additional security functions will be virt