From Static Networks to

Software-defined Networking
An Evolution in Process

The networking industry is gradually transforming The Challenge

itself from a hardware-centric approach to a
Do you have The advent of new technologies, e.g., mobile
something software-defined platform. Although the concept of
software-defined networking (SDN) is still considered devices, server and content virtualization, and cloud
to say about
new and acceptance of it is at a very nascent stage, services, are among the key forces driving the
this article? networking industry today. These new technologies
Visit the Journal the life cycle and evolution of the personal computer
indicate the benefits of such an architectural model have forced the networking industry to take a
pages of the ISACA
web site (www.isaca. and suggest the unstoppable direction in which the fresh look at the traditional network architectures
org/journal),find the networking industry will eventually go. currently in use. Many typical networks are
article and click on hierarchical in nature, built with layers of ethernet
the Comments link to SDN is largely considered to be at the conceptual switches arranged in a tree-like structure. The key
share your thoughts. stage. The implementation of SDN is dependent characteristic for traditional networks is that each
on the network strategy adopted by enterprises. device has a local control plane and a local data
SDN refers to all of the protocols and technologies plane. Each device also has its own management
that work in synchrony to create a global view of planes, e.g., connecting to the device through Telnet,
the network and provide a centralized, intelligence- a simple, early network protocol that allows users on
based network service, delivery and control. one computer to log into another computer that is
on the same network.
The Open Networking Foundation (ONF) is the
organization that leads the effort of the promotion The process of establishing the network topology
and adoption of SDN. It does this through open using a control plane that runs locally is complex. This
standards development. ONF mentions SDN complexity results from no single device knowing the
as an emerging network architecture in which entire network. To manage each device, each device
network control is made directly programmable must be connected to its data plane individually to
and is decoupled from the forwarding plane.1 This make configuration changes or updates, which is not
migration of control, from tightly bound in individual an intelligent approach. The control plane is where
network devices to accessible computing devices, the forwarding and routing decisions are made,
enables the underlying infrastructure to be separated while the data plane is where the commands of the
for applications and network services, which control plane are executed. This traditional design
allows administrators to manipulate networkwide did meet the needs of a time when client-server
traffic flow to meet the changing needs of today’s computing was dominant. However, such a basic
business-driven networks. architecture is not well equipped to meet the dynamic
computing and storage needs of today’s enterprise
data centers and evolving technical landscapes due
to changing business needs. Drawbacks of traditional
Nikesh Dubey, CISA, CISM, CRISC, CCISO, CISSP networks include their static nature in contrast to the
Is a cybersecurity specialist and governance, risk management and dynamic nature of today’s server requirements. The
compliance (GRC) expert. He has a wide range of consulting experience complexities of today’s networks make it difficult for
in the fields of IS audit, information security and GRC. Working on IT to apply a consistent set of access. Hence, the
different continents has given him an opportunity to look closely at the traditional policies leave organizations vulnerable to
core issues, drivers, expectations and challenges of various enterprises. security breaches and regulatory or noncompliance
His previous ISACA® Journal article, “Corporate Responsibility—
issues. Furthermore, networks must also grow to meet
Retaining Top Management Commitment,” discussed an innovative way
to retain and improve management commitment levels, which is essential the needs of hundreds or thousands of newly added
for the success of any program. He is currently associated with AGC devices with different performance and service needs.
Networks and can be reached at [email protected] or The inability to scale up to meet these demands is a
[email protected]. major limitation of traditional static networks. It is also
understood that the lack of a standard in this area and

1 ISACA JOURNAL VOL 4

 feature
feature

open interfaces often limit the capability of network log into every device for intervention and manage the
operators to customize the network to their specific out-of-box capabilities driven by hardware appliances,
individual environments because they are hindered by which require configuration changes, making it tedious
the vendors’ control of the equipment. and resource intensive.

The Genesis of SDN Figure 1—Legacy/Traditional Networks

These disconnects between the increasing network
industry requirements to support business and Data Plane
the existing static nature of traditional network
capabilities have given birth to the concept of SDN.
The basis of SDN is the concept of virtualization,
which, in its most simplistic form, allows software Control Plane
to run separately from the underlying hardware.
Virtualization has made cloud computing a reality
today. There are several benefits of virtualization.
OSPF, BGP, STP, ARP
Virtualization allows data centers to quickly and
dynamically provision IT resources exactly where they
are needed. However, to keep up with the speed and Control Plane
complexity of split-second processing, there is a need
for the network to also adapt, becoming more flexible
and automatically responsive. The idea of virtualization Data Plane
can be applied to the network as well, separating the
function of traffic control from the underlying network
hardware plane into a centralized network-based
intelligence control entity resulting in SDN. Thus, SDN Source: Nikesh Dubey. Reprinted with permission.

is the natural next step in the evolutionary process

of network architecture used today. The networking However, the growing number of technologies
industry will gradually see a major shift in paradigm using virtualization, cloud and mobility create more
from a static, hardware-centric model to an evolving, challenging and demanding environments; networks
software-defined model. must appropriately support and adapt to these
environments and manage their demanding requests
A New Approach to Building in real time. SDN does this by introducing an
Networks abstraction layer that logically separates the control
and data planes, centralizing the network intelligence
Most networks deployed in today’s environments layer. It also abstracts the underlying network
require a great deal of manual administration. This is infrastructure from applications with the objective
because traditional networks had the device-driven of dynamically responding to changing network
control plane interacting with the device-driven data demands using controllable packet/flow processing
plane (see figure 1), using protocols such as Open protocols. This helps the SDN architecture provide
Shortest Path First (OSPF), Border Gateway Protocol networks with the advantages of visualization, traffic
(BGP), Address Resolution Protocol (ARP) and engineering and network virtualization.
Spanning Tree Protocol (STP), and this was a limitation
both from a technical and management perspective. There are several approaches to implementing
The limitation arises because to configure and manage SDN, but this article focuses on the most common
such traditional networks, the administrator needs to components and concepts.

ISACA JOURNAL VOL 4 2

 Figure 2—Basic SDN Architecture Open SDN
In Open SDN, the goal is to separate the control
Traffic Network layer and data layer, creating a common language
Engineering Virtualization Virtualization
for programing network switches. The most common
example of open SDN is OpenFlow, created by the
ONF. SDN actually started with OpenFlow, which is
Northbound
Southbound a vendor-neutral communications interface defined
Protocol
Control Plane Protocol in between the control and forwarding planes.
OpenFlow internally provides an application program
interface (API) or open interface to networking
Data Plane Data Plane devices. It does not matter which operating system
or vendor the networking device is using. With
OpenFlow, there is an open interface to managing
Source: Nikesh Dubey. Reprinted with permission. the device.

Basic SDN Architecture Typically, open-source tools are always a risk as they
could be vulnerable. Lack of secure coding practices
At a basic level, SDN architecture consists of
by novice and enthusiastic developers may allow
three layers: the application layer; the control
vulnerabilities to creep into their code that may be
layer or SDN controller; and the data, physical or
exploited in the future. Organizations are weary of
infrastructural layer (figure 2). At the top is the
security issues when it comes to open-source tools.
application layer, which includes applications that
Opening the software’s programmable interface to
deliver services, e.g., switch/network virtualization,
anyone who wants to come in and code makes the
firewalls and flow balancers. These are abstracted
code vulnerable, devoid of quality coding practices
from the bottom layer, which is the underlying data
and open to manipulations in the future. OpenFlow
or physical network layer.
protocol is considered limited with insufficient
functionality and scaling problems. Figure 3 is the
In the middle is the control layer or SDN controller,
architecture of Open SDN.
the most important aspect of the SDN architecture.
This layer removes the control plane from the
physical plane and runs it as software while being
SDN Using APIs
integrated with the physical and virtual devices on APIs are an alternate way to provide the
the network, facilitating optimal network service abstraction necessary for SDN and provide a highly
management. programmable infrastructure. Programmable APIs
provide a channel by which instructions can be sent
Figure 3—Open SDN
to a device to program it. Programmers can read API
Traffic Network documentation to understand the device and code
Engineering
Traffic Virtualization
Network Virtualization the appropriate commands into their applications.
Engineering Virtualization Virtualization As SDN has evolved, APIs are considered
northbound or southbound, depending on the
location where they function in the architecture
Controller Openflow (figure 4). APIs that reside on a controller and
Controller Openflow
Protocol are used by applications to send instructions to
Protocol
(Southbound)
(Southbound) the controller are called northbound because the
communication takes place north of the controller.
Network
Network Network
Network Examples of northbound APIs are RESTful and Java
Devices
Devices Devices
Devices APIs.2 These APIs allow the developer to manipulate
flow tables and flow entries on networking devices
(e.g., routers and switches) without talking to them
Source: Nikesh Dubey. Reprinted with permission.

3 ISACA JOURNAL VOL 4

directly. The application developer is abstracted In SDN, using overlay nodes in the overlay network
from the hardware and does not need to know the can be thought to be connected by virtual or logical
details and specific requirements of the switches, links, each of which represents a path of its own
routers and other network devices. so that there is an overlay of the virtual network
and the existing physical one. This is the most
Southbound APIs reside on network devices, such popular model as it supports agility, which is key to
as switches. These are used by the SDN controller networking solutions. In SDN overlay, the overlay
to provision the network, with the communication implementation is built over the existing architecture
taking place south of the controller. OpenFlow is a to leverage a physical network that already exists.
prominent southbound protocol. Another example of This suits organizations as they do not have to do
a southbound protocol is the Network Configuration anything other than add the new network over the
Protocol (NETCONF). existing one. The overlay is created using virtual
switches inside hypervisors. A hypervisor or virtual
SDN Using Overlay machine monitor (VMM) is a piece of computer
software, firmware or hardware that creates and runs
The advent of virtualization allowed for the possibility virtual machines. A host machine is a computer on
of the network overlay architectures to be created. which a hypervisor is running one or more virtual
Overlay networks run as separate virtual networks machines. Each virtual machine is called a guest
on top of the physical network infrastructure. When machine. The controller communicates with the
the concept of SDN was envisioned, the platform hypervisor’s virtual switches. These set up tunnels
for leveraging the network overlay architecture that make use of the underlying physical network,
already existed. but do not need to actually configure the hardware

Figure 4—API-based SDN

Application Layer

Applications Applications

E.g., RESTful API E.g., Java API

Northbound Protocol API

Controller Layer

Network Services And

Operating System

Control to Data Plane Interface (E.g., Open Flow)

Infrastructure Layer
Network
Devices

Network Network
Devices Devices

Source: Nikesh Dubey. Reprinted with permission.

ISACA JOURNAL VOL 4 4

 Figure 5—Network Overlay SDN

Application Application
1 2

Open/Northbound Interfaces

Centralized Control
(Configure Policies
and Monitor)

Plane
SDN Controller SDN Controller
Management Control Management Control

Forwarding Forwarding
Element Element

Traditional IP
Ethernet
Forwarding Forwarding
Element Element

(Execute
Actions)

Plane
Data
vSwitch vSwitch

Hosts
VM1 VM3 VM2 VM4

Source: Nikesh Dubey. Reprinted with permission.

to send traffic to its destination. If agility is the innovation. But why should organizations consider
key objective for the proposed network SDN, especially if it is still in the development stage
architecture, then overlay is a good choice and has not been widely adapted? The SDN model
to implement. has the potential to make significant improvements
to service request response times, security,
Virtualization technologies, e.g., Generic Network reliability and scalability. It could also reduce costs
Virtualization Encapsulation (Geneve), Virtual by automating many processes that are currently
Extensible LAN (VXLAN), Stateless Transport done manually, which are resource intensive, slow
Tunneling (STT) and Network Virtualization Using and costly due to the use of restrictive commodity
Generic Routing Encapsulation (NVGRE), provide hardware. SDN offers a more efficient and flexible
this solution by using network encapsulation. Big network that increases the speed of service delivery.
Switch Networks’ Big Virtual Switch offers SDN It delivers cost savings on hardware and also offers
overlay application using OpenFlow. Figure 5 the ability to test new protocols in hindsight.
depicts a network overlay SDN architecture.3
SDN Limitations and Challenges
Advantages of SDN
Before looking at the limitations of SDN, it is
There are numerous advantages of SDN. SDN important to understand the principal concept
increases network flexibility through holistic that drives SDN—virtualization. Virtualization adds
management of the network and enables rapid overhead and network latency, which is an issue

5 ISACA JOURNAL VOL 4

for any operations that require fast response times from US $1 billion in 2014 to US $8 billion in
from time-sensitive systems (e.g., financial systems 2018 (figure 6).5 The SDN market includes
or stock-related applications). It is also important network infrastructure, network virtualization,
Enjoying
to note that networking is static and not getting professional services, and network services
this article?
faster. Moreover, dependency on the Internet to do and applications.
business is expanding traffic by a huge percentage, • Learn more about,
hence the demand to maintain or reduce existing Conclusion discuss and
response times would be a considerable challenge.4 collaborate on
The need for faster speeds and the fundamental Computers have evolved from a hardware-driven network security
limitations of visualization, such as overhead architecture to a software-defined module. In the in the Knowledge
and latency, may place limits on what SDN can 1970s and 1980s, the IT industry was primarily Center.
practically achieve. driven by hardware-centric devices that were www.isaca.org/topic-
limited in speed, size and network latency. The network-security
The adaptation of SDN will also be slow. This is advancement in technology and its evolutionary
because networks are considered the backbone of process eventually guided it to a software-centric
any infrastructure, and changing it is not easy. Unlike architecture, dramatically increasing speed and
the adaptation of virtualization, which was more of reducing size and cost, resulting in higher efficiency.
an end-user change, SDN requires fundamental The networking industry is undergoing the same
detailed planning as it impacts everything being transformations. The foundation of SDN is the
serviced on the network. The centralized SDN concept of virtualization that has benefitted the IT
controller also makes it vulnerable to become a industry in various ways. In principal, SDN promises
single point of attack and failure. to deliver a network that is enabled with network
technology innovation and versatility while reducing
Will SDN Really Catch On? complexity and administrative overhead and cost.
It is important to identify the key pain points,
Although SDN promises to deliver benefits for the drivers and use cases that SDN could address
networking industry, the big questions are if anyone in an organization. If agility is the main priority,
is using the concept productively and whether it will then organizations should deploy an SDN overlay
be the future direction of the network industry. There solution. However, if there is a need to foster
is an estimated rise in the SDN market worldwide support for innovation in all three planes, then an

Figure 6—SDN Growth

2020

2018

2016

2014

2012

2010

2008
0.96 8
BILLION (USD)

Source: Nikesh Dubey. Reprinted with permission.

ISACA JOURNAL VOL 4 6

 OpenFlow-based architecture takes precedence. Endnotes
If the focus is on programming APIs to better meet 1 Open Networking Foundation, Software-Defined
the specific needs of an organization through their Networking: The New Norm for Networks,
applications, an API-based SDN is suitable. 13 April 2012, https://www.opennetworking.org/
In general, SDN offers agility by allowing external images/stories/downloads/sdn-resources/white-
control and automation of the network, making papers/wp-sdn-newnorm.pdf
it directly programmable. It offers management 2 Bombal, David; “SDN and OpenFlow Overview—
benefits by improving operational efficiencies Open, API and Overlay based SDN,” YouTube
by making network intelligence centralized in video, 28 October 2014, https://www.youtube.
software-based controllers that maintain a full view com/watch?v=l-DcbQhFAQs
of the network. Besides lowering the capital and 3 Marschke, D.; “Is SDN Read for Prime Time
operational costs, it is also important to note that or Junk Time?,” APAC CIO Outlook, www.
SDN represents an entirely new way to manage apacciooutlook.com/ciospeaks/is-sdn-read-for-
network connectivity—one that is defined not by the prime-time-or-junk-time-nwid-658.html
vendors and equipment makers, but by those who 4 O’Reilly, J.; “SDN Limitations,” Information Week,
use the network for their own business needs. SDN 17 October 2014, www.networkcomputing.com/
is intelligent and flexible enough to prioritize traffic; networking/sdn-limitations/241820465
direct network resources to where they are needed 5 Statica, “Software-defined Networking Market
most; and adapt, change and evolve over time to Size Worldwide in 2014 and 2018 (in Billion U.S.
meet the business needs of today and address the Dollars),” www.statista.com/statistics/468636/
challenges of the future. global-sdn-market-size/

7 ISACA JOURNAL VOL 4