Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

World IPv6 Day draws attention to security issues with new protocol

Jaikumar Vijayan, Computerworld | June 9, 2011
The marking of World IPv6 Day yesterday has drawn fresh attention to the next-generation Internet addressing protocol, as well as to the security considerations that enterprises will need to deal with as they migrate to it.

One of the biggest potential threats lies in the immaturity of the various implementations of the protocol, said Noa Bar Yosef, senior security strategist at Imperva.

IPv4 addresses are 32-bit numbers, while the IPv6 protocol uses 128-bit numbers. The difference is like having one postal system with a five-digit ZIP code, and one with a nine-digit ZIP code, she said. Older IPv4 systems are designed to handle smaller addresses, whereas IPv6 systems rely on 128-bit addresses.

A failure to properly accommodate the much longer address space in IPv6 by network vendors, security vendors, software makers and others can result in vulnerabilities such as buffer overflow flaws and those that enable denial-of-service attacks and address spoofing, she said.

Enterprises will also need to support both protocols for several more years in order to ensure that their websites and services are accessible to others and vice versa; that could be a problem as well.

The tunneling or encapsulation technologies and methods used to enable IPv4 sites and IPv6 sites to communicate with each other during the transition period, for instance, could be one weak link, said Carl Herberger, vice president of security solutions at Radware.

"The challenge with encapsulation is that there are no standards on the way to encapsulate," which could be a potential security weakness, Herberger said.

Similarly, the memory and processing requirements for handling IPv6 address headers, which are four times larger than IPv4 address headers, could also make older network components such as routers and switches easier to "tip over," he said.

Core security tools such as firewalls and intrusion detection systems designed for IPv4 networks could trip up in an IPv6 environment.

Many of these are issues that will need to be addressed by vendors of various technologies. However, enterprises also need to be aware of the potential implications and prepare for them, said Curran.

"Enterprises need to realize that IPv6 is out there," he said. "Whether they have turned it on or not, it is important they assess how to deal with it."


Previous Page  1  2 

Sign up for Computerworld eNewsletters.