& cplSiteName &

OpenDaylight Establishes Security Team

Mitch Wagner
12/19/2014
50%
50%

The OpenDaylight Project Technical Steering Committee has set up an official security response team following disclosure of a serious vulnerability in the open source SDN controller that went unaddressed four months after it was initially disclosed.

The committee also approved Helium-SR1.1 (Service Release 1.1), which incorporates previously released patches for the security problem, according to an email from Colin Dixon, chair of the OpenDaylight Technical Steering Committee, who posted to the group's mailing list.

The organization "established an official security response team charged with developing more formal internal processes for dealing with security," Dixon stated in his email.

The "Netdump" security flaw was discovered in August by Gregory Pickett, part of the managed security services group for Hellfire Security. The vulnerability allows remote attackers to take control of an OpenDaylight SDN network. Pickett says he tried unsuccessfully for months to get the OpenDaylight Project to pay attention. They finally did, and patched it, this week. (See OpenDaylight Patches 'Serious Vulnerability' – After Four Months.)

Despite the delay, Pickett credits the OpenDaylight project for behaving responsibly. "It was just a break-down in communication," he says in an email to Light Reading. "As soon as they became aware of the issue, they [the developers] moved on it. And they are working on a process to make sure that it doesn't happen again. So, yes, I would say very responsible."

Two of the companies who use OpenDaylight code in their software say it's not a problem for their customers.

"Brocade Vyatta Controller customers have been alerted to the vulnerability and an emergency patch is being delivered shortly," stated Brocade Communications Systems Inc. (Nasdaq: BRCD) distinguished engineer Tom Nadeau in an email to Light Reading. (See Brocade Debuts OpenDaylight SDN Controller.)


Want to know more about SDN? Visit Light Reading's SDN Technology content channel.


ConteXtream audits its software and closes security holes "before they are closed in the open source distribution. This is where a carrier-grade vendor comes in," says co-founder Sharon Barkai in an email to Light Reading. Also, ConteXtream federates OpenDaylight, "which means if the customer wants to use more experimentally controlled code for specific entities, it does not jeopardize the entire distributed system." (See ConteXtream Launches OpenDaylight-Based SDN Fabric for NFV.)

Pickett also discovered separate security vulnerabilities in the Big Switch Networks -sponsored Floodlight open source controller. But Floodlight has no security by design, says a Big Switch spokeswoman. The security is added when the open source project gets converted to product.

"Floodlight is not meant to be used outside of a testbed, which is one reason why no security features are implemented. [Big Switch] is very transparent about this, why it is set up this way, and how it's a differentiation around its commercial product," the spokeswoman said. "Floodlight was built to do what it does -- security was always something that users could choose to add on as part of their configuration. By contrast, Big Switch Network's commercial products have authenticated REST APIs and in-depth Role-Based Access Control (RBAC) features to provide enterprise-level security." (See Big Switch Intros Flagship Big Cloud Fabric – At Last.)

For a directory of SDN controllers, including those based on OpenDaylight code, see Who Does What: SDN Controllers.

— Mitch Wagner, Circle me on Google+ Follow me on TwitterVisit my LinkedIn profileFollow me on Facebook, West Coast Bureau Chief, Light Reading. Got a tip about SDN or NFV? Send it to wagner@lightreading.com.

(2)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Susan Fourtané
50%
50%
Susan Fourtané,
User Rank: Blogger
12/22/2014 | 12:57:07 AM
Re: security teams at more open source projects...
mhh, How right you are. Open source can be a great thing but it also requires a lot of responsibility in security terms. As you point out, this year has been awful in the security department. The only option is to improve security from every possible angle. -Susan
mhhf1ve
50%
50%
mhhf1ve,
User Rank: Light Sabre
12/19/2014 | 5:00:39 PM
security teams at more open source projects...
This year has seen an awful lot of security vulnerablities found in open source code... so I wonder if more open source projects are going to start taking security more seriously. It's hard to get volunteer programmers to really cover all the bases sometimes, but security might be getting more important as folks see how widespread open source code is... and are surprised by where the flaws end up.
Featured Video
From The Founder
John Chambers is still as passionate about business and innovation as he ever was at Cisco, finds Steve Saunders.
Flash Poll
Upcoming Live Events
June 26, 2018, Nice, France
September 12, 2018, Los Angeles, CA
September 24-26, 2018, Westin Westminster, Denver
October 9, 2018, The Westin Times Square, New York
October 23, 2018, Georgia World Congress Centre, Atlanta, GA
November 7-8, 2018, London, United Kingdom
November 8, 2018, The Montcalm by Marble Arch, London
November 15, 2018, The Westin Times Square, New York
December 4-6, 2018, Lisbon, Portugal
All Upcoming Live Events
Hot Topics
5G & Industrial Automation: Creating the Factory of the Future
Gabriel Brown, Principal Analyst, Heavy Reading, 6/11/2018
Comcast's Bid for Content, Growth & Whatever Comes Next
Phil Harvey, US News Editor, 6/13/2018
Ciena CTO Says No to Skynet, Advocates Adaptive Networks
Kelsey Kusterer Ziser, Editor, 6/14/2018
Source Packet Routing Gets Real in 2018
Sterling Perrin, Principal Analyst, Heavy Reading, 6/15/2018
Animals with Phones
Live Digital Audio

A CSP's digital transformation involves so much more than technology. Crucial – and often most challenging – is the cultural transformation that goes along with it. As Sigma's Chief Technology Officer, Catherine Michel has extensive experience with technology as she leads the company's entire product portfolio and strategy. But she's also no stranger to merging technology and culture, having taken a company — Tribold — from inception to acquisition (by Sigma in 2013), and she continues to advise service providers on how to drive their own transformations. This impressive female leader and vocal advocate for other women in the industry will join Women in Comms for a live radio show to discuss all things digital transformation, including the cultural transformation that goes along with it.

Like Us on Facebook
Twitter Feed