An architect is explaining software-defined networking (SDN) in a cloud provider's infrastructure, where a central controller programs the forwarding behavior of many switches. What is the most important security implication of separating the control plane from the data plane in this way?
Select an answer to reveal the explanation.
Short Explanation
Think of the SDN controller as air traffic control for the whole network: if someone takes over the tower, every plane goes where they say. Centralizing the brains makes management easier, but it puts a giant bullseye on the controller. You've got to lock down who can reach it and how it talks to the switches.
Full Explanation
Software-defined networking moves forwarding decisions out of individual devices into a logically centralized controller that programs the data plane through southbound interfaces and exposes northbound APIs to orchestration tools. The security consequence is concentration of control: whoever can manipulate the controller or its communications can redirect, mirror or drop traffic across the entire fabric. The controller therefore needs strong authentication and authorization on its APIs, isolation on a protected management network, hardening, redundancy, and authenticated, encrypted channels to the switches so rogue devices or attackers cannot inject flow rules. Saying forwarding devices need no access controls is wrong; switches still require protection against unauthorized management access and against accepting instructions from an illegitimate controller. SDN does not encrypt tenant traffic by itself; programming flows determines paths, not confidentiality, which needs mechanisms such as TLS or IPsec. Centralized path control actually makes segmentation easier to implement, and isolation between tenants remains essential rather than becoming unnecessary. Exam caveat: separating the control plane improves agility and consistency, but it does not reduce the need for defense in depth. Operational check: confirm controller APIs require mutual authentication and that controller access is logged and restricted to management networks.