Government has an opportunity -- and the obligation -- to ensure that IPv6 products work securely
Connecting state and local government leaders
The current status of IPv6 networking in no way ensures security, but agencies can begin working with vendors now to ensure that better security is built in by the time the new protocols are in general use.
One of the benefits of IPv6 is that it can provide better security. That’s the theory, anyway. The reality is that although some security features have been included in the new Internet Protocols that were not included in IPv4, IPv6 by itself does not ensure security.
Related stories:
Agencies should plan now to enable IPv6 on public-facing servers
Security will not come naturally with IPv6
DOD updates IPv6 Standard Profile
First round of test specs for formal IPv6 compliance being readied
“IPv6 is not inherently more secure,” Brett Thorson, a network security adviser to the North American IPv6 Task Force, said last week at a Digital Government Institute conference.
Because many networking tools still are not designed to work with IPv6 traffic, introducing the new protocols into a network actually can increase security risks. These products often ignore or cannot see IPv6 traffic, creating blind spots that could be taken advantage of by bad guys using the protocols.
This is not a crisis yet because there is so little IPv6 being used, especially in North America. Administrators can either carefully monitor or block IPv6 traffic, and they probably will be all right. But in the not-too-distant future this tactic will no longer work. The whole point of IPv6 is to use it, and eventually there will be no avoiding it if an enterprise wants to be connected to the Internet. Observers now are putting that point at about two years from now.
That is when the present pool of IPv4 addresses is expected to dry up. However, IPv4 will not disappear. Because almost the entire existing Internet is built on that version of the protocols, it will be around for the foreseeable future. New deployments of IPv4 also will not immediately stop. Blocks of already-allocated but yet unused addresses will continue to be available to enterprises for years beyond the official depletion date. But beyond the depletion date, Internet growth increasingly will be in the IPv6 address space, says John Curran, president of the American Registry for Internet Numbers, one of five regional Internet registries. Network administrators will not be able to afford to ignore or to block IPv6 traffic on public-facing networks.
Operating systems and basic networking equipment such as servers and routers already can handle IPv6. But many ancillary appliances and tools such as logs, firewalls, antivirus, intrusion detection and prevention systems — you name it — are not yet ready. And just what it means to be “IPv6 ready” still is being worked out. So at this point it is impossible to say whether tools will work and play well together in this new sandbox.
New Federal Acquisition Regulations for IPv6 are expected to be published in late November or early December, said Lee Ellis of the General Services Administration’s Office of Governmentwide Policy. The National Institute of Standards and Technology has developed a “Profile for IPv6 in the U.S. Government” as part of the USGv6 program, and a program to test and certify product compliance is expected to be operational by 2010. These efforts are expected to get IPv6-ready products coming out of the federal-procurement pipeline by July 2010.
But the IPv6 profile “is not applicable to the very near term,” because all mandatory requirements in the profile will be phased in over 24 months, said NIST’s Doug Montgomery.
This means that for the next few years, as administrators are readying their networks for the new protocols, IPv6 will remain a wild and woolly landscape. It will be up to agencies to work closely with their vendors to define clearly what they need and expect from networking and security products, and to test the products and services to ensure that they are delivering as expected when IPv6 becomes a reality.