The Security Skeptic

FCC Paper on IPv6 Transition says little about security: or is this all they can say?

The FCC released a report in December 2010, Potential Impacts on Communications from IPv4 Exhaustion & IPv6 Transition. The report describes the near exhaustion of the IPv4 address space and introduces IPv6, citing support for adoption by all Internet addressing authorities and a long list of government and standards bodies, including US DoD, OMB and Federal CIO Council,  ICANN, ISOC, the European Commission, the OECD, and the ITU.  The paper offers a history lesson on network protocol transitions (NCP to TCP/IPv4 in the early 1980s). This is helpful for folks who are unfamiliar with terms such as "dual stack", "flag-day", and "offline" (hint: this is what happened to your network if you failed to complete your transition by the flag-day). The paper continues with an interesting discussion of potential issues. The pace of adoption is slow, largely because of a negative networking effect, a polite way of saying no one is converting because you can't reach much content using IPv6 once you do. The paper also cites consumer demand. Actually it admits, "there has not been consumer demand for IPv6". It also mentions that there is no flag-date, "no hard and fast deadline creating urgency, which has been key to other successful transitions" such as the US Congress mandated for digital TV (DTV). The paper finishes with a discussion of IPv6 transition methods, preparation, costs, NAT, and Security. The entire section on Security is reproduced below: "IPv6 is a new network protocol which will require new training, experience, and implementations. During the transition, new vulnerabilities could be introduced, and IPv4 security devices and software may be of limited use. As network operators have done when introducing anything new into networks, operators will have to work with and test IPv6 implementations in order to ensure security."

I worry that the obvious is the most the FCC could find to say about security and IPv6. Was it wrong for me to hope that the paper would offer some information regarding the availability and quality of IPv6 security software and hardware? Or comment whether organizations would be able to deploy security measures in IPv6 nets that are commensurate with what they have in their IPv4 nets? I know that "security commensurate to IPv4" doesn't exactly set the bar very high, but the clock is ticking: has anyone done a thorough gap analysis yet? Care to share?

Choke and screen firewall: the modern day concentric castle

Security experts often use terms of warfare to describe Internet security. Some of the terms come from the castle building era. Castle design evolved over time to incorporate multiple lines of defenses to defeat attacks and resist sieges. These principles are included in Internet security under the rubric

Defenses in Depth

Castles protected people, their property and possessions against attacks from rival lords and invading armies. Initially, castle fortifications consisted of a single line of defense. An earthwork called a motte protected a keep. The motte surrounded the area to be defended and was frequently located on a hilltop.	Photo by jayneandd
Durham County Council	The Motte The motte is similar to the field fortifications a Roman legion built around each encampment during a campaign. Legionnaires would dig a ditch  around their camp and pile the dirt behind the trench. This effectively doubled the height of the wall. Mottes were in many cases much larger and wider. The ditch was also often dug deeper and wider than a Romain camp entrenchment.
Castle designers were engineers. Like modern engineers, they learned from failures as often as successes. As siege tactics improved and the motte became too regularly breached, engineers determined that multiple lines of defense would offer more protection than any single wall, no matter how formidable that wall might be. They added a wall within the outer wall.	HistoryOnTheNet.com
Wikipedia	Concentric Castles Concentric castles relied on the outer wall to blunt the bulk of the attack. The inner wall was used to bolster the defenses of the outer wall and to defend against any attackers who managed to penetrate the outer wall. Checkpoints at gateways were used at both walls to permit access to residents and visitors and deny access to intruders.

Firewall Evolution

The early evolution of firewalls tracks closely with castle defenses. Initially, a single perimeter defense, the Internet firewall, protected an enterprise’s clients and servers against network attacks. This arrangement proved effective while organizations hosted applications primarily or exclusively for users behind the Internet firewall.

As Internet presence became a business imperative, organizations had to find ways to separate applications intended for internal users from external visitors or customers. Look carefully at concentric wall design and you can see that firewalls could be similarly deployed. An outer, Internet firewall would blunt or screen attack traffic and serve as a checkpoint to allow traffic to public facing applications intended for external visitors. These applications would be situated behind the Internet firewall. An inner firewall would serve as a choke point to ensure that no traffic intended for public facing applications gained access to the organization’s internal (private) applications and hosts.

Screen and Choke Firewall

The screen and choke firewall arrangement, like its concentric castle predecessor, proved effective. Evolving business needs (intranets, Wikis, secure application access), technology (WLANs) and attack targets (client as well as web applications and services) have forced us to think beyond the original deployment, the choke and screen firewall arrangement is remains popular. Today, web application firewalls (WAPs), firewall load balancers (FWLBs), and interdepartmental firewalls serve as the screening firewall in many screen and choke deployments.