Enterprise networking has become considerably more complicated over the past decade. Applications run across multiple public clouds, traditional data centers still support critical workloads and edge environments are expanding as organizations push computing and services closer to users and devices. Meanwhile, security teams are expected to maintain consistent visibility, access controls and threat detection across the entire environment.
Distributed cloud networking (DCN) is emerging as one approach to addressing this networking complexity. It promises to simplify connectivity across increasingly fragmented environments, but it also introduces important security considerations. For CISOs, the question becomes whether the organization can maintain effective security controls as connectivity becomes more distributed, dynamic and software-defined — and what role DCN might play.
What is DCN?
DCN is an architectural approach that connects applications, workloads, users and services across multiple cloud providers, private data centers and edge locations through a common networking fabric. Rather than managing each environment as an isolated network, DCN provides centralized orchestration and policy management across distributed infrastructure. The concept builds on technologies such as software-defined networking, cloud-native routing, overlays and network automation. Depending on the implementation, DCN platforms can provide connectivity, segmentation, traffic engineering, encryption and integrated security services across otherwise disconnected environments.
Organizations increasingly operate in hybrid and multi-cloud environments, often through acquisitions, geographic expansion, regulatory requirements or application modernization. Applications also rely on services distributed across environments, creating more east-west and cloud-to-cloud traffic that traditional network architectures weren't designed to accommodate efficiently. DCN aims to reduce that complexity by providing a more consistent way to establish and manage connectivity without requiring every cloud, data center or edge location to operate independently.
It's important to recognize that DCN is an architectural category, not a single standardized technology. Capabilities vary considerably among vendors, particularly around security enforcement, visibility and integration with existing infrastructure.
Is DCN the new SASE, SSE or SD-WAN?
Not exactly. Although these technologies overlap, they address different aspects of enterprise connectivity and security.
- SD-WAN primarily focuses on connecting branch offices, remote locations and enterprise networks using software-defined traffic routing and centralized management. It optimizes connectivity across available network paths and can incorporate security capabilities.
- Secure Access Service Edge (SASE) combines networking and cloud-delivered security services to provide secure connectivity for users, branches and applications. Its emphasis is on converging network access and security enforcement, particularly for distributed workforces.
- Security Service Edge (SSE) is the security component of SASE, typically including secure web gateways, zero-trust network access, cloud access security brokers and related data protection capabilities.
- DCN, by comparison, focuses more directly on connectivity between distributed workloads, applications, clouds and infrastructure environments. Its primary concern is establishing and managing a consistent networking fabric across these locations.
These approaches are complementary rather than mutually exclusive. An enterprise might use SD-WAN to connect branches, SSE to enforce user access policies and DCN to establish secure connectivity between applications running in AWS, Azure and private data centers. These product and service categories are converging to some extent, with more providers offering all these capabilities in a single product suite.
As an emerging category, DCN shouldn't automatically be viewed as a replacement for existing security infrastructure. Some DCN offerings include advanced segmentation, encryption and inspection capabilities, while others primarily provide connectivity and orchestration. CISOs must understand exactly where security enforcement occurs, and which controls remain dependent on other platforms.
What does DCN change for security?
DCN can simplify networking operations, but it also changes where security decisions are made, how policies are enforced and what attackers might target.
Security policy becomes more distributed
Traditional enterprise networks often rely on centralized security enforcement points, including perimeter firewalls, internal segmentation controls and dedicated inspection infrastructure. In distributed environments, traffic can flow directly between cloud workloads, regions and edge locations without traversing those traditional controls.
This creates a need for consistent security policies across different enforcement technologies. CISOs should prioritize identity-aware segmentation, standardized access rules and automated policy distribution rather than relying on network location or IP addresses alone.
The network control plane becomes a high-value target
Centralized orchestration is one of DCN's biggest operational advantages, but it also creates a potentially significant attack surface. A compromised controller, administrative identity or automation credential could enable attackers to modify routes, disable segmentation, establish unauthorized connectivity or redirect sensitive traffic.
Treat the DCN control plane as critical infrastructure. Strong authentication, privileged access management, separation of duties, API security and continuous monitoring are essential. Administrative actions should also be logged and independently auditable. If a third party — as a SaaS — hosts the DCN control plane, security teams should also appropriately vet the security and resilience controls in place within the provider environment.
East-west traffic becomes harder to inspect
As applications communicate across clouds and distributed infrastructure, security teams might lose visibility into traffic that bypasses existing inspection points. Encryption further complicates detection, particularly when traffic moves through overlays, private connectivity or cloud-native networking services.
DCN architecture should support appropriate traffic inspection, network telemetry and integration with existing network detection and response, cloud detection and response and SIEM platforms. Not every flow requires full packet inspection, but security teams need sufficient visibility to identify suspicious communications and lateral movement.
Segmentation becomes both more important and more complicated
Distributed networking can make application connectivity easier, but easier connectivity can also expand an attacker's potential blast radius. Segmentation policies should follow workloads across environments and account for application identity, business function, sensitivity and trust boundaries.
CISOs shouldn't assume that a unified network fabric automatically provides zero trust. Connectivity and authorization are separate decisions, and both require explicit controls.
Automation increases the consequences of mistakes
DCN platforms frequently rely on infrastructure as code, APIs and automated provisioning. These capabilities accelerate deployment but can also propagate misconfigurations across multiple environments.
Security teams need policy validation, configuration testing, change approval and rollback capabilities built into networking automation workflows. A single incorrect policy shouldn't be capable of exposing sensitive workloads across the enterprise.
What should CISOs focus on?
Approach DCN adoption as a security architecture initiative, not simply a networking modernization project. Four priorities deserve particular attention:
- Establish clear ownership between networking and security. Define responsibility for connectivity, segmentation, policy approval, incident response and platform administration. Shared infrastructure requires shared governance, but accountability can't be ambiguous.
- Protect the DCN control plane. Apply privileged access controls, phishing-resistant MFA, administrative isolation, API credential management and comprehensive audit logging. Treat controllers and orchestration platforms as high-value assets.
- Standardize security policy and inspection. Establish consistent segmentation principles, encryption requirements and inspection standards across cloud and on-premises environments. Validate that enforcement remains effective as workloads move or scale.
- Ensure the SOC has adequate telemetry. Integrate network flows, policy changes, administrative activity and security events into existing detection and response workflows. Test whether analysts can reconstruct suspicious activity across multiple clouds and network domains. Consider tabletop exercises or other stress tests to help ensure the SOC has the right level of visibility and access to detect and respond to potential DCN-related incidents.
Ultimately, DCN represents another step toward more dynamic, software-defined enterprise infrastructure. It can reduce operational complexity and improve application connectivity, but it doesn't eliminate the need for fundamental security controls. For CISOs, the goal should be to take advantage of DCN's flexibility without sacrificing visibility, policy consistency or control over the infrastructure connecting the organization's most critical systems.
Dave Shackleford is founder and principal consultant at Voodoo Security, as well as a SANS analyst, instructor and course author, and GIAC technical director.
