Cybersecurity implications of IPv6 implementation

IPv6 requires a dedicated security strategy

In enterprise environments, the transition to IPv6 has specific security implications, some involving (automated) tools and systems used to keep networks secure. Enno Rey, a pioneering IPv6 specialist who now works for Apple, recently published a blog that provides a useful general summary.

Planning

As his starting point, Rey takes three functions of the IP address: identification (of a network interface or system), enabling specific actions (e.g. routing and filtering) and logging/analysis (e.g. for incident response and fraud detection). Significantly, he says, an IPv6 address is more likely than an IPv4 address to introduce a temporal dimension to identification and the associated analysis: an address identifies an interface or system only for a particular timespan. Of those three functions, it is on account of the logging/analysis function that large IPv6 implementations take so long and require so much planning. The point being that, before you can proceed, the hardware and software need to be adapted to process IPv6 addresses. Until that's been done, you can't configure your routers and firewalls, and you can't give your systems IPv6 addresses.

NIST Cybersecurity Framework

Rey goes on to identify several key points requiring attention in relation to each of the three identified functions: modification of database fields, string processing, vulnerability scanning, IPv6-specific risks, modification of network system features and configurations, new/modified analysis methods, personnel training, and modification of monitoring and response processes. All Rey's observations are based on the NIST Cybersecurity Framework: US guidelines on the protection of digital infrastructures. The framework is the product of collaboration involving the government, academia and the business community. Although it was developed primarily with critical US infrastructure in mind, NIST believes that the framework is also suitable for cybersecurity risk management by non-critical and small organisations.

European guidelines

The importance of developing a distinct, explicit security strategy for the implementation of IPv6 is also emphasised in the EU's Guidelines and Process: IPv6 for Public Administrations in Europe. However, the author makes the point that such a strategy document should really have been produced ten years earlier, when IPv6 functionality was added to all network equipment. European Regulation 2019/881, better known as the Cybersecurity Act, explicitly identifies IPv6 (along with DNS and BGP) as a critical feature of the internet infrastructure. The Regulation assigns EU-level responsibility to the European Union Agency for Cybersecurity, ENISA.

No alternative

"Transitioning to IPv6 is much more (complex) than just enabling IPv6 addresses on systems," Rey's blog concludes, while acknowledging that transition is necessary because "we don’t have any alternative to IPv6."