Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Openflow/SDN networks give a remote controller the ability to manage the behavior of network devices i.e. configurations. They can forward instruction sets to dynamically change network configuration.

My concern is that if I opted to deploy an openflow compliant switch than what are the security risks involved.

share|improve this question
up vote 3 down vote accepted

Openflow and SDN is in no way different from other control mechanisms for network equipment. It's up to the administrator of a network how he decides to secure the equipment. The connection between the Openflow capable switch and the controller can run over TLS, and can even be authenticated by SSL certificates. Thats gives you the same level of security as you have with e.g. key based SSH connections. From this perspective the level of security is comparable.

But keep in mind that if the trust relationship between the controller and the switch is established, the control capabilities the controller has will be much broader and more granular than a manual or automatic configuration of existing switch features can be. Therefore there is some room for bugs and failures in your SDN application.

share|improve this answer
What i am getting is that i had to painstakingly dig through logs to find the one or two inputs that lead my controller software to break. What are the best testing practices for controller i.e. traffic simulator etc. – Ali Ahmad Dec 21 '12 at 4:54
Ali, its the same as with all software systems. SDN is a concept, OPenFlow a API you use to develop your network functionality. What you describe is common practice in software development. The developers can make a good or bad job in writing maintainable software. OpenFlow by its own does not help you much here. – Holger Winkelmann Dec 21 '12 at 10:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.