& cplSiteName &

OpenDaylight Establishes Security Team

Mitch Wagner
12/19/2014
50%
50%

The OpenDaylight Project Technical Steering Committee has set up an official security response team following disclosure of a serious vulnerability in the open source SDN controller that went unaddressed four months after it was initially disclosed.

The committee also approved Helium-SR1.1 (Service Release 1.1), which incorporates previously released patches for the security problem, according to an email from Colin Dixon, chair of the OpenDaylight Technical Steering Committee, who posted to the group's mailing list.

The organization "established an official security response team charged with developing more formal internal processes for dealing with security," Dixon stated in his email.

The "Netdump" security flaw was discovered in August by Gregory Pickett, part of the managed security services group for Hellfire Security. The vulnerability allows remote attackers to take control of an OpenDaylight SDN network. Pickett says he tried unsuccessfully for months to get the OpenDaylight Project to pay attention. They finally did, and patched it, this week. (See OpenDaylight Patches 'Serious Vulnerability' – After Four Months.)

Despite the delay, Pickett credits the OpenDaylight project for behaving responsibly. "It was just a break-down in communication," he says in an email to Light Reading. "As soon as they became aware of the issue, they [the developers] moved on it. And they are working on a process to make sure that it doesn't happen again. So, yes, I would say very responsible."

Two of the companies who use OpenDaylight code in their software say it's not a problem for their customers.

"Brocade Vyatta Controller customers have been alerted to the vulnerability and an emergency patch is being delivered shortly," stated Brocade Communications Systems Inc. (Nasdaq: BRCD) distinguished engineer Tom Nadeau in an email to Light Reading. (See Brocade Debuts OpenDaylight SDN Controller.)


Want to know more about SDN? Visit Light Reading's SDN Technology content channel.


ConteXtream audits its software and closes security holes "before they are closed in the open source distribution. This is where a carrier-grade vendor comes in," says co-founder Sharon Barkai in an email to Light Reading. Also, ConteXtream federates OpenDaylight, "which means if the customer wants to use more experimentally controlled code for specific entities, it does not jeopardize the entire distributed system." (See ConteXtream Launches OpenDaylight-Based SDN Fabric for NFV.)

Pickett also discovered separate security vulnerabilities in the Big Switch Networks -sponsored Floodlight open source controller. But Floodlight has no security by design, says a Big Switch spokeswoman. The security is added when the open source project gets converted to product.

"Floodlight is not meant to be used outside of a testbed, which is one reason why no security features are implemented. [Big Switch] is very transparent about this, why it is set up this way, and how it's a differentiation around its commercial product," the spokeswoman said. "Floodlight was built to do what it does -- security was always something that users could choose to add on as part of their configuration. By contrast, Big Switch Network's commercial products have authenticated REST APIs and in-depth Role-Based Access Control (RBAC) features to provide enterprise-level security." (See Big Switch Intros Flagship Big Cloud Fabric – At Last.)

For a directory of SDN controllers, including those based on OpenDaylight code, see Who Does What: SDN Controllers.

— Mitch Wagner, Circle me on Google+ Follow me on TwitterVisit my LinkedIn profileFollow me on Facebook, West Coast Bureau Chief, Light Reading. Got a tip about SDN or NFV? Send it to wagner@lightreading.com.

(2)  | 
Comment  | 
Print  | 
Threaded  |  Newest First  |  Oldest First        ADD A COMMENT
mhhf1ve
50%
50%
mhhf1ve,
User Rank: Light Sabre
12/19/2014 | 5:00:39 PM
security teams at more open source projects...
This year has seen an awful lot of security vulnerablities found in open source code... so I wonder if more open source projects are going to start taking security more seriously. It's hard to get volunteer programmers to really cover all the bases sometimes, but security might be getting more important as folks see how widespread open source code is... and are surprised by where the flaws end up.
Susan Fourtané
50%
50%
Susan Fourtané,
User Rank: Blogger
12/22/2014 | 12:57:07 AM
Re: security teams at more open source projects...
mhh, How right you are. Open source can be a great thing but it also requires a lot of responsibility in security terms. As you point out, this year has been awful in the security department. The only option is to improve security from every possible angle. -Susan
From The Founder
Either we perform a complete 'factory reset' on the way the telecom industry creates and deploys virtualization, or we face the consequences.
Flash Poll
Live Streaming Video
Charting the CSP's Future
Six different communications service providers join to debate their visions of the future CSP, following a landmark presentation from AT&T on its massive virtualization efforts and a look back on where the telecom industry has been and where it's going from two industry veterans.
LRTV Custom TV
Infinera Introduces Instant Network

4|20|17   |     |   (0) comments


Mike Capuano, vice president of marketing at Infinera, discusses the advancement from Instant Bandwidth to new Instant Network capabilities, which include Bandwidth License Pools, Moveable Licenses and Automated Capacity Engineering (ACE).
Women in Comms Introduction Videos
Vodafone's Eubank on Sponsors, Mentors & Moving On Up

4|19|17   |   4:25   |   (0) comments


Vodafone America's Head of Operations Kimberly Eubank breaks down the difference between a sponsor and a mentor and shares why both made a big difference in her career.
LRTV Custom TV
NYC Auto Show: Are We Smart Yet?

4|18|17   |     |   (0) comments


The auto industry is facing some big transformations as electric vehicles, autonomous technology and connected cars are seen as the future of the industry. During the much-anticipated NY international auto show, there was an emergence of new technology and mobility service on the show floor. Aside from performance, brands like Lincoln, Hyundai, Honda, Mercedes and ...
LRTV Huawei Video Resource Center
The Impact of Video

4|18|17   |     |   (0) comments


David Mercer from Strategy Analytics discusses the impact of video on current strategies.
LRTV Custom TV
Pardeep Kohli Discusses Network Transformation & the Market Opportunity for the 'New' Mavenir Systems

4|13|17   |     |   (0) comments


In a brief discussion at MWC 2017, Heavy Reading analyst Adi Kishore talks to Pardeep Kohli, CEO, Mavenir Systems about the creation of the 'new Mavenir' and some of the key challenges facing operators in today's market. A key theme of the discussion centers around operator need for software-only, virtualized solutions and how they will need to adapt to ...
Women in Comms Introduction Videos
Tech Maverick Shares Her Tips for Gender Inclusivity

4|12|17   |   7:28   |   (0) comments


Wendy Hall Bohling, a corporate escapee, author and gender exclusivity consultant, tells her story of sexism, bias and progress along the road to gender equality in the workforce.
LRTV Huawei Video Resource Center
Huawei at MWC 2017

4|11|17   |     |   (0) comments


At Mobile World Congress 2017, the biggest mobile industry gathering of the year, Huawei showcased its new innovations and solutions with the theme "Open Road," which focuses on cloud, 5G, operation transformation, videos and consumer-oriented products. Its campaign has been recognized by three awards given by GSMA.
LRTV Custom TV
China Telecom NFV Infrastructure on RSD

4|6|17   |     |   (0) comments


Lynn Comp, senior director of market development of Intel, is joined by Chong Zhang, storage engineer at Inspur and Ou Li Yan, architect for technology strategies of China Telecom on what NFV brings.
LRTV Custom TV
Nokia's IMPACT Software Demo

4|6|17   |     |   (0) comments


Khamis Abulgubein of IoT market development at Nokia demonstrates IMPACT (intelligent management platform for all connected things), a software solution with a horizontal approach to managing any device on any application.
LRTV Custom TV
Nokia Introduces Virtual Service Router for More Rapid Service

4|6|17   |     |   (0) comments


James Cumming, product line manager for virtualized service routers at Nokia, demonstrates how the virtual router based off the Nokia ecosystem changes the network function experience.
LRTV Custom TV
The Keys to SD-WAN Success

4|6|17   |     |   (0) comments


Versa Networks CEO Kelly Ahuja talks about the key requirements for service provider-managed SD-WANs.
LRTV Custom TV
Intel & Cisco on Joint 5G Solutions

4|5|17   |     |   (0) comments


Dave Ward, SVP and CTO of Cisco, is joined by Sandra Rivera, corporate VP and general manager of network platforms group of Intel, on the revolutionary 5G technology that changes networking and computing fundamentally.
Upcoming Live Events
May 15-17, 2017, Austin Convention Center, Austin, TX
May 15, 2017, Brazos Hall - Austin, TX
May 15, 2017, Austin Convention Center - Austin, TX
June 6, 2017, The Joule Hotel, Dallas, TX
All Upcoming Live Events
Infographics
With the mobile ecosystem becoming increasingly vulnerable to security threats, AdaptiveMobile has laid out some of the key considerations for the wireless community.
Hot Topics
Time for a Telecom Reboot
Steve Saunders, CEO and founder, Light Reading, 4/19/2017
Comcast Ready for Clash With Hulu
Mari Silbey, Senior Editor, Cable/Video, 4/18/2017
Unlicensed: It's What's Next for US Mobile Operators
Dan Jones, Mobile Editor, 4/19/2017
Verizon's Fiber Spend Won't End With Corning
Mari Silbey, Senior Editor, Cable/Video, 4/19/2017
Like Us on Facebook
Twitter Feed
BETWEEN THE CEOs - Executive Interviews
One of the nice bits of my job (other than the teeny tiny salary, obviously) is that I get to pick and choose who I interview for this slot on the Light Reading home ...
TEOCO Founder and CEO Atul Jain talks to Light Reading Founder and CEO Steve Saunders about the challenges around cost control and service monetization in the mobile and IoT sectors.
Animals with Phones
Now That's an Ad Campaign Click Here
Meerkats to the rescue!
Live Digital Audio

Playing it safe can only get you so far. Sometimes the biggest bets have the biggest payouts, and that is true in your career as well. For this radio show, Caroline Chan, general manager of the 5G Infrastructure Division of the Network Platform Group at Intel, will share her own personal story of how she successfully took big bets to build a successful career, as well as offer advice on how you can do the same. We’ll cover everything from how to overcome fear and manage risk, how to be prepared for where technology is going in the future and how to structure your career in a way to ensure you keep progressing. Chan, a seasoned telecom veteran and effective risk taker herself, will also leave plenty of time to answer all your questions live on the air.