, the overall enterprise trust in this setup has continually degraded as a results of connectivity decisions and evolving threats. As enterprise users began to covet access to emerging resources on the Internet and as email began to establish itself as the preferred medium of business communication, the enterprise was forced to allow connectivity through the trusted perim- eter. This was done by creating FW rules allowing bidirectional connectivity to support the desired services as highlighted in Figure 9.2. This resulted in less-trusted external websites and email senders from untrusted external networks gaining access. As the Internet became more complex and varied, many new external connections began to appear. The perimeter architecture is no longer an effective security control resulting in critical infrastructure services being more vulnerable to cyberattacks. This chapter will outline the security advantages of a software-enabled network including design enhancements such as security features embedded at design time, performance improvements such as reduced incident response cycle time, and real-time security capabilities such as resilience against a distributed denial of service (DDoS) attack. SDN and NFV introduce new attack vectors. A com- prehensive security architecture will be required to mitigate the new attack vectors while realizing the security advantage of a software-driven network. This chapter will also outline the evolution of the security architecture from a traditional perimeter based model to a software-enabled dynamic security model. Limited trust No trust Web, email Trust level No trust Limited trust FIGURE 9.2 Perimeter model challenged with nontraditional access. Network Security 9.2 SECURITY ADVANTAGES OF SDN AND NFV The industry transformation to SDN- and NFV-enabled ecosystem will provide several security advantages to service and cloud providers. Industry and standards organizations and security ven- dors are driving the realization of these security benefits for scalable carrier-