IPv6 security: The forgotten element
Connecting state and local government leaders
With proper agency planning, a network with baked-in security is possible.
One of the selling points for moving to IPv6 is improved security, but if you don't plan for securing your IPv6 network, chances are you won't be any better off .'There is a lot of attention about migrating to version 6, but security is unfortunately not a demand,' said Andre Yee, CEO of NFR Security Inc. of Rockville, Md. 'All the upfront planning needs to be done for security as well as for infrastructure. Failure to do so will make you vulnerable.'Security people should be involved in transition planning from the beginning, said John Pearce, an associate with Booz Allen Hamilton.The problem is not that IPv6 is inherently any less secure than IPv4, but it is different. That means network infrastructure and applications that support the new protocols could present a new range of vulnerabilities to systems now optimized for IPv4.As the products start supporting IPv6 more, that inherently adds more code complexity, Pearce said. 'That will inevitably result in more vulnerabilities.'Because IPv4 is not going away anytime soon, administrators essentially will be managing two networks for the foreseeable future, adding additional worries. There are three primary ways to accommodate traffic using both protocols.'Dual stack seems to be the best approach,' according to Charles Lee, Verizon CTO for civilian networks, which operates its own IPv6 backbone.Address translation between versions is an option, but 'most apps are not going to survive address translation,' he said.Tunneling, or encapsulating one version's packets inside the other's, also is likely to be common. This has its own risks, as tunneling can be used to mask malicious behavior.'The people who seem to be most interested in tunneling right now are those with malicious intent,' Yee said.Most networking equipment now supports IPv6 to a certain extent, and under Office of Management and Budget mandates, agencies are supposed to be buying IPv6-enabled equipment when available. If this capability is enabled, the new protocols can present a security risk even if the network is not supposed to be using it yet.'There is a security risk,' said Peter Tseronis, the Education Department's director of network services, echoing a Government Accountability Office report that warned dual environments are more vulnerable. 'You have to have the proper people to maintain the network in a dual-stack mode. You want to make sure [that] if you run two protocols it does not leave more opportunity for a hacker to breach the network.'An OMB official told GCN that their office will work with the General Services Administration, National Institute of Standards and Technology and the CIO Council to coordinate with industry to ensure security is built into IPv6 products.NFR, which makes intrusion prevention and detection systems, also scans networks for vulnerabilities.'We've been at a number of sites where [they] tell us, 'We don't have IPv6 traffic, so we don't have to worry about that,' ' Yee said.But a scan of traffic often reveals IPv6 packets on the network if it has been enabled in the networking equipment.Whether or not the traffic is malicious, 'it's more prevalent than you think,' Yee said.Detecting and monitoring this traffic requires security tools enabled for IPv6. OMB includes these tools in its requirements for purchasing IPv6-capable equipment.'It is not a trivial expense to get your security tools IPv6 compliant,' Yee said.Many tools are enabled for IPv6 to some extent, but the degree of compliance varies. Because IPv6 functionality may be added as a software upgrade, there could be performance problems when that processing is done in software rather than hardware, Pearce said.'But when you bring up your IPv6 network, you'll probably have little IPv6 traffic, so the impact should not be great,' he said.
With proper agency planning, a network with baked-in security is possible
Two networks in one
GCN news editor Jason Miller contributed to this story.
Two networks in one
GCN news editor Jason Miller contributed to this story.
NEXT STORY: The software question