& cplSiteName &

OpenDaylight Establishes Security Team

Mitch Wagner
12/19/2014
50%
50%

The OpenDaylight Project Technical Steering Committee has set up an official security response team following disclosure of a serious vulnerability in the open source SDN controller that went unaddressed four months after it was initially disclosed.

The committee also approved Helium-SR1.1 (Service Release 1.1), which incorporates previously released patches for the security problem, according to an email from Colin Dixon, chair of the OpenDaylight Technical Steering Committee, who posted to the group's mailing list.

The organization "established an official security response team charged with developing more formal internal processes for dealing with security," Dixon stated in his email.

The "Netdump" security flaw was discovered in August by Gregory Pickett, part of the managed security services group for Hellfire Security. The vulnerability allows remote attackers to take control of an OpenDaylight SDN network. Pickett says he tried unsuccessfully for months to get the OpenDaylight Project to pay attention. They finally did, and patched it, this week. (See OpenDaylight Patches 'Serious Vulnerability' – After Four Months.)

Despite the delay, Pickett credits the OpenDaylight project for behaving responsibly. "It was just a break-down in communication," he says in an email to Light Reading. "As soon as they became aware of the issue, they [the developers] moved on it. And they are working on a process to make sure that it doesn't happen again. So, yes, I would say very responsible."

Two of the companies who use OpenDaylight code in their software say it's not a problem for their customers.

"Brocade Vyatta Controller customers have been alerted to the vulnerability and an emergency patch is being delivered shortly," stated Brocade Communications Systems Inc. (Nasdaq: BRCD) distinguished engineer Tom Nadeau in an email to Light Reading. (See Brocade Debuts OpenDaylight SDN Controller.)


Want to know more about SDN? Visit Light Reading's SDN Technology content channel.


ConteXtream audits its software and closes security holes "before they are closed in the open source distribution. This is where a carrier-grade vendor comes in," says co-founder Sharon Barkai in an email to Light Reading. Also, ConteXtream federates OpenDaylight, "which means if the customer wants to use more experimentally controlled code for specific entities, it does not jeopardize the entire distributed system." (See ConteXtream Launches OpenDaylight-Based SDN Fabric for NFV.)

Pickett also discovered separate security vulnerabilities in the Big Switch Networks -sponsored Floodlight open source controller. But Floodlight has no security by design, says a Big Switch spokeswoman. The security is added when the open source project gets converted to product.

"Floodlight is not meant to be used outside of a testbed, which is one reason why no security features are implemented. [Big Switch] is very transparent about this, why it is set up this way, and how it's a differentiation around its commercial product," the spokeswoman said. "Floodlight was built to do what it does -- security was always something that users could choose to add on as part of their configuration. By contrast, Big Switch Network's commercial products have authenticated REST APIs and in-depth Role-Based Access Control (RBAC) features to provide enterprise-level security." (See Big Switch Intros Flagship Big Cloud Fabric – At Last.)

For a directory of SDN controllers, including those based on OpenDaylight code, see Who Does What: SDN Controllers.

— Mitch Wagner, Circle me on Google+ Follow me on TwitterVisit my LinkedIn profileFollow me on Facebook, West Coast Bureau Chief, Light Reading. Got a tip about SDN or NFV? Send it to wagner@lightreading.com.

(2)  | 
Comment  | 
Print  | 
Threaded  |  Newest First  |  Oldest First        ADD A COMMENT
mhhf1ve
50%
50%
mhhf1ve,
User Rank: Light Sabre
12/19/2014 | 5:00:39 PM
security teams at more open source projects...
This year has seen an awful lot of security vulnerablities found in open source code... so I wonder if more open source projects are going to start taking security more seriously. It's hard to get volunteer programmers to really cover all the bases sometimes, but security might be getting more important as folks see how widespread open source code is... and are surprised by where the flaws end up.
Susan Fourtané
50%
50%
Susan Fourtané,
User Rank: Blogger
12/22/2014 | 12:57:07 AM
Re: security teams at more open source projects...
mhh, How right you are. Open source can be a great thing but it also requires a lot of responsibility in security terms. As you point out, this year has been awful in the security department. The only option is to improve security from every possible angle. -Susan
From The Founder
Cisco's Conrad Clemson, recently promoted to head up the company's Service Provider Apps & Platforms developments, talks to Light Reading's Founder and CEO Steve Saunders about how he's bringing cloud video, mobile and virtualization together to empower network operators.
Flash Poll
Live Streaming Video
Charting the CSP's Future
Six different communications service providers join to debate their visions of the future CSP, following a landmark presentation from AT&T on its massive virtualization efforts and a look back on where the telecom industry has been and where it's going from two industry veterans.
LRTV Huawei Video Resource Center
Huawei at CeBIT 2017: Day 3

3|22|17   |     |   (0) comments


Light Reading reports from CeBIT 2017 in Germany, where Huawei is exhibiting on the application of technologies and key business verticals such as transportation, smart city, manufacturing, media and finance.
LRTV Documentaries
No Regrets: Cox's Finkelstein on Fiber & More

3|22|17   |     |   (0) comments


At the Cable Next-Gen Technologies & Strategies event in Denver, Cox's Jeff Finkelstein examines the cable capex conundrum.
LRTV Documentaries
Cable Next-Gen: The 'Mile High' View From Denver

3|22|17   |   11:56   |   (0) comments


Alan Breznick kicks off the Cable Next-Gen Technologies & Strategies event in Denver, casting his thousand-yard stare over cable's current competitive landscape.
LRTV Huawei Video Resource Center
Huawei at CeBIT 2017: Day 2

3|21|17   |   2:27   |   (0) comments


Light Reading reports from CeBIT 2017 in Germany, where Huawei is exhibiting digital transformation solutions around IoT, smart data centers, OpenCloud ecosystem and its newly announced storage-as-a-service solution.
LRTV Custom TV
Driving Better Mobile Customer Experience While Transforming the Mobile Network

3|21|17   |   7:47   |   (0) comments


The Citrix NetScaler mobile gateway is an intelligent traffic management solution which can markedly improve the customer experience provided by mobile operators, even when traffic is encrypted. Critical network services can be consolidated and virtualized using NetScaler. Because of the unique architecture, NetScaler can be deployed on any hypervisor, on a ...
LRTV Custom TV
Mastercard: What's Next for Mobile Payments?

3|21|17   |   7:49   |   (0) comments


2017 marks the fifth consecutive year for Mastercard at Mobile World Congress and it was a great time to reflect on the amazing advances the payments industry has made as well as discuss "What's Next' in the digital commerce future. We spoke to James Anderson, executive vice president of digital payments at MasterCard, about digital wallets to tokenization to ...
LRTV Custom TV
Mastercard: 2 Billion Adults 'Trapped' in Cash Economy

3|21|17   |   03:51   |   (0) comments


Despite advances made in the last several years, two billion adults around the world are trapped in a cash economy and lack what we take for granted -- a safe way to receive, save and use money. Shamina Singh, executive vice president of sustainability and president of the Mastercard Center for Inclusive Growth, chats about how Mastercard is developing new ways to ...
LRTV Custom TV
Mastercard: Payment From Every Device

3|21|17   |   5:55   |   (0) comments


A world where everything and everyone is connected creates new points of interaction for commerce. These digital experiences cannot be developed in isolation and instead require an ecosystem to drive mass consumer and enterprise adoption and create better consumer engagement. Predicting when that growth will happen is difficult, but always keeping the end user in ...
LRTV Interviews
InterDigital's Role in the 5G, IoT Era

3|21|17   |   05:47   |   (0) comments


Alan Carlton, managing director and VP for Europe at InterDigital, talks about the company's role in 5G projects in Europe and the prospects for the company in the IoT market.
LRTV Interviews
Lessons Learned From Digital Transformation

3|21|17   |   05:51   |   (0) comments


Ravi Palepu, global head of Telco Solutions at Virtusa, talks about some key takeaways from telco digital transformation experiences during the past couple of years.
Women in Comms Introduction Videos
NetNumber's CMO Shares Her Diversity Do's

3|21|17   |   3:19   |   (2) comments


The telecom industry is transforming the world, and diversity plays a critical role in driving the innovation behind it. NetNumber CMO Kim Gibbons shares why diversity and being authentic is a do amidst all the don'ts women in comms often hear.
LRTV Custom TV
Software-Driven Architecture for 5G & IOT

3|20|17   |   1:56   |   (0) comments


We present Heavy Reading's Jim Hodges's report from Mobile World Congress -- where operators and vendors are working to bring a variety of technologies together to make virtualization a reality in the era of 5G and IoT.
Upcoming Live Events
May 15-17, 2017, Austin Convention Center, Austin, TX
May 15, 2017, Austin Convention Center - Austin, TX
June 6, 2017, The Joule Hotel, Dallas, TX
All Upcoming Live Events
Infographics
With the mobile ecosystem becoming increasingly vulnerable to security threats, AdaptiveMobile has laid out some of the key considerations for the wireless community.
Hot Topics
High-Band 5G: Let's Address the Range Question, Shall We?
Dan Jones, Mobile Editor, 3/21/2017
Eurobites: Italy First Pasta the Post for 5G
Paul Rainford, Assistant Editor, Europe, 3/17/2017
5G Faces a Marathon, Not a Sprint
Iain Morris, News Editor, 3/17/2017
Eurobites: A1, Nokia Turn It Up to 11
Paul Rainford, Assistant Editor, Europe, 3/22/2017
Russia's MTS: There Is No 5G Business Case
Iain Morris, News Editor, 3/21/2017
Like Us on Facebook
Twitter Feed
BETWEEN THE CEOs - Executive Interviews
TEOCO Founder and CEO Atul Jain talks to Light Reading Founder and CEO Steve Saunders about the challenges around cost control and service monetization in the mobile and IoT sectors.
At MWC 2017, Qualcomm's CTO Matt Grob talks to Light Reading's CEO and Founder Steve Saunders about the progress being made in the development of the technologies and standards that will underpin 5G.
Animals with Phones
Neither Do We Click Here
Is that a prerequisite?
Live Digital Audio

Playing it safe can only get you so far. Sometimes the biggest bets have the biggest payouts, and that is true in your career as well. For this radio show, Caroline Chan, general manager of the 5G Infrastructure Division of the Network Platform Group at Intel, will share her own personal story of how she successfully took big bets to build a successful career, as well as offer advice on how you can do the same. We’ll cover everything from how to overcome fear and manage risk, how to be prepared for where technology is going in the future and how to structure your career in a way to ensure you keep progressing. Chan, a seasoned telecom veteran and effective risk taker herself, will also leave plenty of time to answer all your questions live on the air.