t on the operation and per- formance of the application, the inventory is automatically updated to reflect the changes. The incident response process is also improved in a number of ways. Assuming just one or a sub- set of the instances of the virtual function is impacted or involved in an incident, taking it down will not cause the entire function to be taken off-line thereby reducing the impact. In all cases, whether it is one or many instances of the VNF that is impacted, adding instances of the VNF and routing to the new instances is simplified with SDN. Being able to instantiate new instances of the VNF allows for freezing and grabbing a snapshot of the impacted VNF, which will provide better information for the forensics operation. 9.2.3 REAL-TIME CAPABILITIES As has been described earlier, SDN enables the swift response to a security incident. In the realm of security, this includes possibly adding additional instances of capacity, or routing traffic through additional or different security controls. A prime example of real-time capabilities would be the resolution of DDoS attacks. There are services and capabilities to mitigate DDoS attacks today. However, there is often a delay in activat- ing the control due to the risk associated with dropping valid or desired traffic. SDN and NFV, as depicted in Figure 9.5, offers the ability to scale out the impacted constrained resource to provide better performance until the traffic and the impact of other controls can be evaluated. When, for Orchestrator instantiates new VM to scale-out VM function to sustain the higher traffic load Botnet attacks application VM1 under DDoS attack Orchestration Controller Security Function Security Function Security Function Vendor 1 Vendor 2 Vendor eNodeB eNodeB eNodeB Mobile Devices Hypervisor (Smartphones, M2M, loT) FIGURE 9.5 DDoS attack resilience. Building the Network of the Future example, a botnet attacks an application, the instance of the application is overwhelmed. However, when the overload condition is observed, the o