Government Computer News
IPv6 security: The forgotten element
With proper agency planning, a network with baked-in security is possible
Digg
De.licio.us
Slashdot
Technorati
One of the selling points for moving to IPv6 is improved security, but if you don’t plan for securing your IPv6 network, chances are you won’t be any better off .
“There is a lot of attention about migrating to version 6, but security is unfortunately not a demand,” said Andre Yee, CEO of NFR Security Inc. of Rockville, Md. “All the upfront planning needs to be done for security as well as for infrastructure. Failure to do so will make you vulnerable.”
Security people should be involved in transition planning from the beginning, said John Pearce, an associate with Booz Allen Hamilton.
The problem is not that IPv6 is inherently any less secure than IPv4, but it is different. That means network infrastructure and applications that support the new protocols could present a new range of vulnerabilities to systems now optimized for IPv4.
As the products start supporting IPv6 more, that inherently adds more code complexity, Pearce said. “That will inevitably result in more vulnerabilities.”
Two networks in one
Because IPv4 is not going away anytime soon, administrators essentially will be managing two networks for the foreseeable future, adding additional worries. There are three primary ways to accommodate traffic using both protocols.
“Dual stack seems to be the best approach,” according to Charles Lee, Verizon CTO for civilian networks, which operates its own IPv6 backbone.
Address translation between versions is an option, but “most apps are not going to survive address translation,” he said.
Tunneling, or encapsulating one version’s packets inside the other’s, also is likely to be common. This has its own risks, as tunneling can be used to mask malicious behavior.
“The people who seem to be most interested in tunneling right now are those with malicious intent,” Yee said.
Most networking equipment now supports IPv6 to a certain extent, and under Office of Management and Budget mandates, agencies are supposed to be buying IPv6-enabled equipment when available. If this capability is enabled, the new protocols can present a security risk even if the network is not supposed to be using it yet.
![1105 Government Information Group [purity]](/images/1105logo_website.gif "Government Computer News [purity]")
© 1996-2008 1105 Media, Inc. All Rights Reserved.
