Slides from IPv6 Threats
Download as PPTX, PDF4 likes962 views
This document discusses the challenges and security threats associated with the transition to IPv6, emphasizing that while many threats exist in both IPv4 and IPv6, the transition period poses unique risks. It highlights concerns such as tunneling, rogue devices, and IP reputation, which are exacerbated by the differences in IP address allocation between the two protocols. Recommendations include careful planning for IPv6 implementation and education on networking fundamentals to mitigate these threats.
Slides from IPv6 Threats
- 1. IPv6 ThreatsSlides from June 2011 webcast
- 2. 2View the recorded webcast on SlideShare at… http://www.slideshare.net/Commtouch/commtouch-ipv6-threatson
- 3. Eyal OrgilMarketing DirectorCommtouchWelcome to Part 2IPv6 Informational Series
- 4. IPv6 Informational SeriesPart 1: An Introduction to IPv6onEyal OrgilMarketing DirectorCommtouchhttp://www.slideshare.net/Commtouchor atwww.commtouch.com/introduction-ipv6
- 5. IPv6 Informational SeriesPart 1: An Introduction to IPv6Part 2: IPv6 Security ThreatsEyal OrgilMarketing DirectorCommtouch
- 6. SpeakersAsaf GreinerVP ProductsCommtouchGabriel M. MizrahiVP TechnologiesCommtouch
- 7. Have a question? Send questions to: IPv6@commtouch.comResponses posted: http://blog.commtouch.com
- 8. Is the Change to IPv6 aSignificant Security Event?
- 9. Is IPv6 a Significant EventMove to IPv6 a transition, not an eventTaking place for several yearsWill continue for many more yearsThere will be security implicationsDuring the transition periodAfter fully implementedMany threats same as IPv4Especially while dual-stacks are in use
- 10. Is IPv6 a Significant EventMany IPv4 threats not applicable to IPv6Care must be taken when using dual-networksMany existing security solutions can protect against IPv6 threatsBut, must be properly configuredMany threats related to transition to IPv6, not new threats
- 11. Is IPv6 a Significant EventMany IPv6 users today are experts and enthusiastsIPv6 is not yet in widespread usageStill see minimal usage of IPv6Wider adoption of IPv6 depends on readiness of network infrastructuresCurrently no big incentive to move to IPv6
- 12. Is IPv6 a Significant EventHackers will utilize IPv6 when it will bring them valueNot deployed widely enough in order to invest timeAs IPv6 grows it will appear on the Hacker radarTransition a long process, not a one day eventAdvise that you learn and adjust
- 13. The Hype About IPv6 – Is it Just Another Y2K Scare?
- 14. Is IPv6 Another Y2K?Don’t be scared of IPv6, but don’t take lightly IPv6 is a technology which offers:New opportunitiesNew challengesNo date for IPv6Will take years for IPv6 to become the main protocol
- 15. Is IPv6 Another Y2K?Expect many mission critical infrastructures to remain IPv4Enough IPv4 addresses for theseUnlikely websites will be moved to be IPv6 in near futureWhen a large move occurs, we will know:There is a large user IPv6 baseEnd of transition period is near
- 16. Top Security Issues with IPv6
- 17. IPv6 Security IssuesTop three security related issues IPv6:Tunneling of IPv6 over IPv4 (6 to 4)Rogue devicesIP Reputation
- 19. IPv6 Tunneling ThreatIPv4 ConfiguredFirewallIPv4 NetworkIPv4IPv4IPv4IPv4 AddressInternalNetworkInternet
- 20. IPv6 Tunneling ThreatIPv4 ConfiguredFirewallIPv4 NetworkIPv4IPv4IPv4IPv6 AddressInternalNetworkInternet
- 21. IPv6 Tunneling ThreatIPv4 ConfiguredFirewallIPv4 NetworkGWIPv4-to-IPv6GatewayIPv4IPv6IPv4IPv4IPv6IPv6 over IPv4IPv6 AddressIPv6 over IPv4 tunnelInternalNetworkInternet
- 22. IPv6 Tunneling ThreatIPv4 ConfiguredFirewallIPv4websiteFW Policy: No Angry BirdsIPv4 NetworkIPv4IPv4IPv4InternalNetworkInternet
- 23. IPv6 Tunneling ThreatIPv4 ConfiguredFirewallIPv4websiteFW Policy: No Angry BirdsIPv4 NetworkGWIPv4-to-IPv6GatewayIPv6websiteIPv6IPv4IPv6IPv4IPv4IPv6 over IPv4Bypass firewall policyInternalNetworkInternet
- 24. IPv6 Tunneling ThreatNeed to be aware that security devices are configured for IPv6For example firewallsAnother example – IDS (Intrusion Detection System) Can inspect IPv6, but you need to enable itIf not, you won’t be enforcing the policy on IPv6
- 26. Rogue Devices
- 28. Rogue DevicesIPv6 PrefixIPv6 PrefixRogue Device
- 29. Rogue DevicesWindows 7Windows 7Windows 7IPv4 Network
- 30. Rogue DevicesWindows 7Windows 7Windows 7IPv6 NetworkIPv4 NetworkIPv6 enabledby default
- 31. Rogue DevicesWindows 7Windows 7Windows 7Internet?Internet?Internet?IPv6 NetworkIPv4 NetworkIPv6 searchesfor accessto the Internet
- 32. Rogue DevicesWindows 7Windows 7Windows 7Internet?Internet?Internet?IPv6 NetworkIPv4 NetworkIPv6 PrefixIPv6 PrefixInternetIPv6Rogue Device
- 33. Rogue DevicesThe difference is:IPv4 is used dailyIf a different allocation is provided, there will be noticeable effectsWith IPv6, the insertion of a rogue device may go unnoticed
- 34. Rogue DevicesIPv6 NetworkMan in the middleInternetIPv6Rogue Device
- 35. Rogue DevicesIPv6 NetworkMan in the middleInternetIPv6Rogue Device
- 36. Rogue DevicesIPv6 NetworkMan in the middleInternetIPv6Rogue Device
- 37. Rogue DevicesIPv6 NetworkMan in the middleInternetIPv6Rogue Device
- 38. Rogue DevicesNot only a Windows problemAn issue with most operating systemsIPv6 is defined by defaultIPv6 could run in the background without anyone’s knowledgeSecurity risk also in IPv4 with DHCPMake sure unauthorized devices cannot connect to your network
- 40. IP ReputationFar more IP addresses in IPv6232 compared to 2128ChallengesIP allocation will be different from IPv4Anyone can get a large IP allocationAny person can get a 64 bit allocation (264)The entire Internet today is 232
- 41. IP ReputationLast 64 bits define the device IDComplicate issue by using randomizer to change 64 bitEvery spam message could be sent from different IPFrom IP address: wwwwFrom IP address: xxxxFrom IP address: yyyy264 DifferentIP AddressesInternetFrom IP address: zzzz
- 42. IP ReputationIP reputation on 128 bits very difficult
- 43. Need other methods to build reputation
- 44. Such as subnets
- 45. Storing IP information in memory
- 46. Vast amount of memory will be needed
- 47. No NAT in IPv6
- 48. Some believe a security issue
- 49. They believe NAT provides a layer of security
- 50. IPv6 provides public IPs for all devicesCommtouch Compliancewith IPv6
- 51. Commtouch and IPv6Commtouch has been working on IPv6 for some timeMaking changes to client side and back-endClient side will be transparentFocus has been on the back-endGlobalView Mail Reputation transparently supports more IPs addressesStill single query of an IP address but data storage more efficient
- 52. Commtouch and IPv6Monitoring the Internet Identifying IPv6 threatsClassifying threatsCurrently seeing minor IPv6 spam activityBelieve spammers experimenting with IPv6Too noticeable today to send spam via IPv6 when there is very little email on this network
- 53. Recommendations for MinimizingIPv6 threats
- 54. Gabriel Mizrahi’s IPv6 RecommendationsMake sure you have mapped all devices on your networkImplement IPv6 step-by-stepHave a written procedure of how you will introduce IPv6Plan to implement a dual stack as a first stage
- 55. Asaf Greiner’s IPv6 RecommendationsGet educated about IPv6Everyone should go back to networking fundamentalsUnderstand what’s implemented on our network today, and whyThen look at what needs to remain or changeLearn from othersWhat mistakes and successes other have experienced
- 56. Asaf Greiner’s IPv6 RecommendationsLockdown from IPv6 as a startThen implement staged plan to roll out IPv6Take care to avoid configuration errors
- 57. Thank you toAsaf GreinerCommtouch VP ProductsGabriel M. MizrahiCommtouch VP Technologies
- 58. 51View the recorded webcast on SlideShare at… http://www.slideshare.net/Commtouch/commtouch-ipv6-threatson
- 59. Have a question? Send questions to: IPv6@commtouch.comResponses posted: http://blog.commtouch.com
- 60. Please check back for future informational webcasts