Here at nCircle, we watched World IPv6 Day with great interest. U.S. federal government mandates have been a long-standing driver for our focus on IPv6, as have some key commercial customers. But outside those few, it seems like most people in cybersecurity circles have their hands full with other challenges and have greater priorities than IPv6.
That's an approach that will need to change; Federal CISO's and other security executives are going to have to wrap their heads and hands around this one pretty soon. Federal agencies, because of government mandates, will end up out in front whether they are ready or not. And unfortunately, there are some security fundamentals that must change, radically, to cope with an IPv6 world. One was identified in the test yesterday, where buffer overflows and DOS attacks could result from improper or immature implementations of the protocol.
But the security challenges will be harder than just double-checking implementation details. There's a tendency to think that IPv6 is just like IPv4, only bigger. My colleague, TK, has a wonderful riff on just how much bigger IPv6 is... there's a point at which scale changes everything. Let's take just one example that's really salient in nCircle's segment of security. Traditional methods of actively scanning a network to discover and profile assets - done in hours in IPv4 - would take billions of years in IPv6. Yet it will be easier than ever to hide a rogue presence. Where, indeed, are your assets?
New technologies are needed to secure this vastly larger frontier; nCircle and many others are working today to make sure that the right solutions are available. In the meantime, cybersecurity execs do have some meaningful choices they can make today. For one, they can certainly require that current asset discovery or scanning solutions at least identify IPv6-capable, and IPv6-enabled, devices resident in their IPv4 environments. After all you probably have IPv6 in your environment today, residing side-by-side with IPv4 on your existing devices. It is hard enough to manage and secure devices you know are there...much harder if you don't...
For most of the buzz around World IPv6 Day the focus was on function: will everything work? I hope that the numerous federal agencies participating will bring a security perspective to the experiment. What new security challenges will we face in an IPv6 world? Some speculate, but I look forward to hearing about the wide range of security issues that are identified through experiments like World IPv6 Day.
