IPv6 security: Difficult but doable, panelists say
Connecting state and local government leaders
The need to adopt the next generation of Internet Protocols in networks has made IPv6 a hot topic for the first time at this premier security conference.
SAN FRANCISCO — The depletion of fresh IPv4 addresses over the last year has heightened interest in the secure deployment of IPv6, and a series of sessions on the next generation Internet Protocols are being offered for the first time at the RSA Conference being held this week.
“The RSA community sees an intersection between IPv6 and the security posture of the network,” said VeriSign CSO Danny McPherson, who is participating in a pair of presentations. “The timing is right. IPv6 is out there, it is enabled on devices by default and people are deploying it.”
Although it also contains other new features, Version 6 of the Internet Protocols was developed in large part to address the limited address space in IPv4. The last blocks of new IPv4 addresses were doled out to regional registries in January 2011 and future growth in the Internet increasingly will be in the IPv6 address space.
Related stories:
What did we learn from World IPv6 Day?
IPv6 networks face aggressive attacks for first time
Although there are similarities between the two versions, they are not compatible. Most networking hardware and software today support both versions but they must be managed separately, creating complications.
“You have two different virtual worlds that intersect, and trying to operate them is challenging,” said Ron Gula, CEO of Tenable Network Security.
IPv6 is not new and there is a lot of expertise available, but in many organizations it is siloed in the heads of a few individuals. Many administrators with day-to-day responsibility for running networks will have to develop an additional set of skills.
Robert M. Hinden, a fellow at Check Point Software Technologies and a co-inventor of IPv6, offers three broad recommendations for securely deploying the new protocols:
- Create an IPv6 security policy that parallels current IPv4 policy.
- Protect against rogue router advertisements and DHCPv6 servers that, while not necessarily malicious, could open the network to threats if not anticipated.
- Set up default firewall rules for blocking all types of transition tunnels for the two protocols.
Because IPv6 comes enabled by default on many devices, it could already be running on networks without administrators’ knowledge. So the first step in managing it is to discover if and where it is running.
“You can’t stop what you can’t see,” Hinden said.
Because of its larger address space that can eliminate the need for Network Address Translation, operating an IPv6 network could in theory be simpler than running IPv4. Monitoring and managing a pure IPv6 address space should be easier. But in practice, both protocols will be running on most networks, adding complexity.
Because there often will not be complete IPv6 connectivity between end devices and servers, connections will be fragmented, and maintaining acceptable levels of service can be difficult. Network operators might have to choose between increasing network overhead by processing both IPv4 and IPv6 queries simultaneously for a user trying to reach an address so that it can provide a quick response, or reducing network overhead by trying an IPv6 connection first and then reverting to IPv4 query only if an IPv6 query times out.
Scanning a network using both protocols also will be more difficult, Gula said. Scanning an IPv6 address space could take 16 times as long as scanning an IPv4 network. “That’s my best guess,” he said. “It might be more than that or it might be less, but it will still take longer.”
As a practical matter, discovery of devices on a composite network running both protocols might be done more effectively by passive monitoring and network traffic analysis to identify devices, Gula said.
Another challenge is ensuring that network management and security tools work equally well with both sets of protocols. Although most tools support the new protocols, that does not mean they will operate as efficiently with IPv6.
If absolute performance parity between the two protocols has not yet been achieved, “in general it’s gotten a lot better in the last couple of years,” Hinden said. “Our products have gotten much better than they used to be.”
The fact that IPv6 tools continue to improve does not mean that they are inadequate now, Hinden said.
“We’ve been working IPv4 since the 1980s and it’s not like we’ve stopped improving the tools,” he said. “There is a moving target here, and that’s true for both IPv4 and IPv6.”