IPv6 Security - Where is the Challenge
0 likes894 views
The document discusses security challenges related to IPv6 deployment. It notes that while IPv6 introduces some new vulnerabilities, the biggest risks come from human errors like coding bugs, configuration mistakes, and poor design. Some specific IPv6 vulnerabilities mentioned include rogue router advertisements and weaknesses in the neighbor discovery protocol. The document emphasizes that securing access at lower layers and following best practices like patching systems, enabling encryption, and using strong authentication can help mitigate risks for both IPv4 and IPv6. Ultimately, the human factor is the largest source of security incidents rather than any vulnerabilities inherent in the protocols themselves.
IPv6 Security - Where is the Challenge
- 1. IPv6 Security Where is the challenge? Marco Hogewoning External Relations RIPE NCC Sunday, April 21, 2013
- 2. Biggest Hurdle Deploying IPv6 2 (NRO: Global IPv6 Deployment Survey) Sunday, April 21, 2013
- 3. Increased Awareness? 3 (Ernst & Young: Global Information Security Survey) Sunday, April 21, 2013
- 4. Where is the Risk? Sunday, April 21, 2013
- 5. Threat or Vulnerability? • Threat: the potential to cause harm – DoS, unauthorised access, viruses • Vulnerability: a weakness that can be exploited – Bugs, configuration errors, design flaws • Risk: the possibility that a vulnerability will be exploited by somebody to cause harm 5 Sunday, April 21, 2013
- 6. Human Factor • Vulnerabilities exist because of human errors: – Coding errors – Configuration errors – Design flaws • Doesn’t mean it is your fault – But a lot of times you can limit the risk 6 Sunday, April 21, 2013
- 7. Examples Is this IPv6 related? Sunday, April 21, 2013
- 8. Rogue Router Advertisement • IPv6 relies on routers to announce themselves using ICMPv6 multicasts • Protocol has little to no security • Every machine can claim to be a router – Reconfigure clients to another subnet – Redirect or intercept traffic 8 Sunday, April 21, 2013
- 9. Rogue Router Advertisement (IPv4) • Every machine can start a DHCP server – Reconfigure clients to another subnet – Redirect or intercept traffic – NAT44 makes it much easier to hide it • ARP spoofing – Pretend I am the router by claiming its MAC address 9 Sunday, April 21, 2013
- 10. Protection at Protocol Layer • “RA Guard” feature – Filter route announcements on switches – On all ports except for the known router – Present in a lot of equipment already • SEcure Neighbor Discovery (SEND) – Fix the protocol by adding verification – Add cryptographic certificates and signatures – No widespread implementation 10 Sunday, April 21, 2013
- 11. What About Layer 2? • Securing access to the physical network: – 802.1x authentication – Disable unused ports on switches – Strengthen wireless passwords – MAC address counters or filters (port security) • Lowers the risk for both protocols – Can protect for other vulnerabilities 11 Sunday, April 21, 2013
- 12. Upper Layers Where are you? Sunday, April 21, 2013
- 13. Vulnerabilities are Everywhere • Most security incidents caused in the application layers: – Buffer overflows – SQL injection – Man-in-the-middle attacks – Weak authentication 13 Sunday, April 21, 2013
- 14. General Prevention Methods • Don’t run any unnecessary services • Keep up to date with software patches • Use encryption where possible • Use two-factor authentication • Keep it simple 14 Sunday, April 21, 2013
- 15. Source of Incidents 15 (PWC: Information Security Survey) Sunday, April 21, 2013
- 16. The Human Factor • Attacks are triggered by somebody • Known vulnerabilities are ignored • Mistakes can and will happen 16 Sunday, April 21, 2013
- 17. Capacity Building • Test your implementations before deploying – Don’t rely on the glossy brochure • Build up knowledge – Learn to identify potential risks – Learn how to deal with them • Make use of available resources – Training courses and tutorials – Share your experiences 17 Sunday, April 21, 2013
- 18. Improving Security with IPv6 • Multiple subnets makes it easier to separate functions or people • Lack of NAT – Makes everything much more visible – Security moves to the end hosts – Forces you to think • Somebody might already use IPv6! – Using tunnels to hide what is going on 18 Sunday, April 21, 2013
- 19. Conclusion • IPv6 might add some vulnerabilities • IPv6 is not a threat • You are the biggest risk 19 Sunday, April 21, 2013