ion Identity 9.5.2.4 Resource Identity 9.5.3 ASTRA 9.5.3.1 ASTRA Overview 9.5.3.2 ASTRA System Overview 9.5.3.3 ASTRA Defense in Depth 9.5.3.4 Network Perimeter (Classic Network Protection) 9.6 Topics for Further Study Acknowledgments References INTRODUCTION To meet changing network demand driven by massive increase in data traffic, service providers need to transform their infrastructure into a software-enabled architecture. This relies on two enabling technologies: software defined networking (SDN) and network functions virtualization (NFV). These technologies will not only evolve the network to be more dynamic but also enable it to be more secure. Security is built into the design of the SDN and NFV architecture day one. SDN and NFV deliver new security capabilities that make it easier to maximize responsiveness during a cyberattack and minimize service interruption to the customers. SDN enables the network to expand to handle addi- tional traffic during an attack. The network is protected through virtualized on-demand defenses that provide security software as-a-service, built within a distributed cloud environment, integrated within the cloud provisioning process. Building the Network of the Future Trust No trust Subject Object Trust Limited trust No trust Operation Group Nothing is perfect Trust level No trust Limited trust FIGURE 9.1 Initial enterprise perimeter state. The above represents a major transformation to the traditional security architecture [1]. The tra- ditional security approach was based on firewalls (FWs) protecting trusted entities inside the enter- prise from untrusted access by outside entities via the public Internet. The intent of the perimeter view is to ensure that enterprise assets located inside the FWs are completely safe from untrusted access. Figure 9.1 shows a graphical representation of the trusted level typically associated with the perimeter approach. This perimeter network model has been a pillar of protection design for security architects for nearly three decades. However