Advancing Network Security with Network Programmability
Modern attacks exploit distributed, dynamic network behavior, and traditional middlebox-based defenses add latency and leave blind spots, especially as IoT devices and programmable infrastructure proliferate. The opportunity for DevOps and platform teams is that both the host and the network are now programmable, so security can be built, tested, and deployed like software.
This talk shows how three capabilities enable security services that fixed-function tools cannot offer. In-kernel processing (eBPF/XDP) inspects and filters packets on the host before they reach the OS protocol stack. In-network computing (programmable switches, P4) enforces security inside the network fabric. SmartNICs/DPUs offload security with built-in crypto and hardware accelerators. Using lateral movement detection as a running example, we discuss the practical challenges of building these systems, along with mitigations. We conclude with how these layers can be combined into cooperative enforcement points or a defense-in-depth architecture.
Modern attacks exploit distributed, dynamic network behavior, and traditional middlebox-based defenses add latency and leave blind spots, especially as IoT devices and programmable infrastructure proliferate. The opportunity for DevOps and platform teams is that both the host and the network are now programmable, so security can be built, tested, and deployed like software.
This talk shows how three capabilities enable security services that fixed-function tools cannot offer. In-kernel processing (eBPF/XDP) inspects and filters packets on the host before they reach the OS protocol stack. In-network computing (programmable switches, P4) enforces security inside the network fabric. SmartNICs/DPUs offload security with built-in crypto and hardware accelerators. Using lateral movement detection as a running example, we discuss the practical challenges of building these systems, along with mitigations. We conclude with how these layers can be combined into cooperative enforcement points or a defense-in-depth architecture.
Bio: Dr. Israat Haque is a Professor in the Faculty of Computer Science at Dalhousie University and the Director of the Programmable and Intelligent Networking (PINet) Lab. Her work applies network programmability, system-level monitoring, and data-driven techniques to strengthen the security, sustainability, and performance of IoT, 6G, and AI systems, particularly in complex and dynamic environments. Dr. Haque has been recognized for both technical leadership and impact. She was named an ACM/IEEE N2Women Rising Star (2021) and received Digital Nova Scotia’s Thinking Forward Award (2022) for developing highly skilled technology and security talent. In 2024, she received the Alumni Award from the University of Alberta. Dr. Haque has also been named among the 100 Brilliant and Inspiring Women in 6G 2026. She is an active contributor to the IEEE and ACM research communities and has served as an editor for IEEE Transactions on Vehicular Technology and IEEE Communications Magazine.