IPv6 security: a new playing field
At the time, many of us were still just discovering the Internet, IPv4 protocol, and related security issues.
the imminent arrival of IPv6
Almost 20 years later, IPv4 address exhaustion is a reality. IPv6 has officially been launched, and setting up IPv6 networks and services has therefore become a top priority for operators, equipment providers and companies.
But don’t hold your breath: IPv6 is no revolution in terms of security. A cursory reading of the Requests for Comments does make it seem like Internet Protocol Security will be the cornerstone of IPv6 security, but we can’t jump to that conclusion quite yet.
assessing risk with IPv6
If we assume that total security risk equals the sum of “probability x criticality” for each threat, how does IPv6 measure up?
For now, the threats identified for IPv6 do not seem to be evolving very much, so probability is not changing greatly. At the same time, because security products have not fully integrated IPv6 (battery management by the central processing unit as opposed to an Application-Specific Integrated Circuit or ASIC, for example), threats tend to be much more critical.
This all means that IPv6 threats are riskier than IPv4 threats—at least during this transition phase. So just managing a simple Transmission Control Protocol flood can become a total nightmare for network and security admins.
primary IPv6 threats
Take all the IPv4 threats we already know about (spoofing, flooding, denial of service, etc), get rid of a couple (network address translation, Address Resolution Protocol, etc), add a bit of IPv6 (Type 0 Routing Header, IPv4-IPv6 tunneling), and your new technical playing field is up and running.
And don’t forget to train security teams, office teams and users if they will be using IPv6 addresses:
- "Can you confirm that your IP address is 2001:db8:0:85a3::ac1f:8001?"
- "No, it’s 2001:0db8:0000:85a3:0000:0000:ac1f:8001!"
a little more reading
While we wait for more articles to be published on IPv6 security, here is a list of links (the most informative in my opinion) for further reading. I know it’s short, but if you search you’ll see that writing on the topic is pretty repetitive.
IPv6 Security Considerations and Recommendations (Microsoft)
IPv6 Security (Cisco)
IPv6 and IPv4 Threat Comparison and Best-Practice Evaluation (Sean Convery)
About IPv6 Security (STIndustries)
products and services
open call to seasoned experts
Obviously, the above list is anything but exhaustive and should only be used as a starting point for researching the topic.
Any of you who have already done additional reading or research can tell us more and share links in the “comments” section.
image © so47Fotolia.com