 attackers and defend- ers. Protections are put in place by defenders, and attackers look for ways to break through those protections. Both sides continually refine their approach. The attackers look for holes in the system, including unpatched bugs that open gaps in defenses, design flaws in the architecture of a particular system, and gaps where designed protections have not been properly implemented. Defenders work to patch security bugs whenever they are discovered, keep their protections up to date, monitor their systems looking for evidence of compromise, and design in multiple layers of security SO that if there is a problem in one layer, it does not open up the whole system. At any time, previously unknown bugs ("zero day bugs") can be found in existing systems, and sometimes are found first by the attackers. So defenders need to establish multiple layers of defenses. Active security, which tracks and logs issues, can provide data that helps identify the problems in case of an attack. The cloud-based architecture allows us to insert active security in places where it would not be feasible in a traditional network. Given the capabilities of the cloud, additional security features can be inserted in real time if suspicious activity is detected to help determine whether it is an attack or just an unexpected change in load. If an attacker successfully breaks into a system, one of the first things they do is cover their tracks. They erase log entries and modify configurations to hide their presence. There are counter measures for this-changes to security parameters are logged and all Network Security log entries are typically sent to a remote logging server SO they cannot be erased if the system is compromised. By service chaining security components into the OAM path of a virtual network element, we isolate the security system from the network element itself. The service-chained security component runs in a separate VM, SO even if the network elements were completely compromised the attacker would not be able