SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Is Cyber Security IPv6-Ready ?

artie avatar
artie
15 diapositives · 336 Views · Jul 21, 2014

Is Cyber Security IPv6-Ready ?. HEPiXX – Vancouver, BC Bob Cowles October, 2011. Quiz: What Happened to IPv5. Lost in space? Born out of TCP? Replaced by the iPod? Protocols are even numbers?. What happened to IPv4?. IPv6 Concepts Quiz (six-foo). Minimum MTU?

#is cyber security ipv6-ready ? #is cyber security ipv6-ready ? ppt #powerpoint #presentation
Is Cyber Security IPv6-Ready ? - slide 1
01 / 15Is Cyber Security IPv6-Ready ?
1 / 17

Télécharger la présentation

Is Cyber Security IPv6-Ready ?
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Is Cyber Security IPv6-Ready? HEPiXX – Vancouver, BC Bob Cowles October, 2011

  2. Quiz: What Happened to IPv5 • Lost in space? • Born out of TCP? • Replaced by the iPod? • Protocols are even numbers?

  3. What happened to IPv4?

  4. IPv6 Concepts Quiz (six-foo) • Minimum MTU? • You can get a logo if you are IPv6 ______? • NIST guidelines for secure config 800-___ • Number of address bits router examines? • 2001:0db8:76ff:0000:dab4:0000:0000:da8c • What are ::1/128? fe80::/10? fd00::/8? 2000::/3? • ff02::1, ff02::2, ff02::fb ? • Maximum jumbo packet size? • # of IPv6 addresses for a host on the internet?

  5. Are there Security Issues? • Architecture • Design • Implementation • Configuration • Operation • Co-Existence with IPv4 • Tools

  6. Architecture • Multicast, IPsec, ICMPv6 required • IP addresses impossible to remember • dead:beef • bebe • Address mapping is now many to1 to many • Fragmentation left to hosts

  7. Design • Routing Headers bring back source routing • Too many things are suggestions and not strictly enforced • TCP can adjust MSS to prevent fragmentation • Order of Extension Headers • Unused fields can be covert channels • Mobility IP

  8. Implementation • Implementations are still partial • E.g. centos firewall accepts IPv6 – does nothing • IPv4 errors will be repeated • Error conditions will be undetected or handled in different ways • Inconsistencies in specs are still being discovered • SEcure Neighbor Discovery (SEND) not widely implemented – required for adequate security • Protects RA/RS and ND • RFC3971

  9. Configuration • Many additional or different issues to consider • Explosion of IP addresses per host • Considerations in subnet and IP address assignment • Non-obvious vs. easy to guess? • Based on MAC vs. privacy • Use routing headers? IP mobility? DHCP?

  10. Operation • Everything has to be tested in detail • Devices IPv6-Ready but associated firmware is not available (e. g. printers) • Host option controls • Autoconfigvs DHCPv6 • Mobile IP • IP address changing • Use of routing headers • Response to mDNS • Response to Neighbor Solicitations/Advertisements

  11. Co-Existence with IPv4 • Dual stacks add complexity • Ability to send packets over two different protocols (evade packet inspection) • Tunnels – 6-to-4, Teredo (shipworm) • Interactions not fully understood but wiill be exploited • Windows – can turn off IPv6 but not restore via registry entry

  12. Tools • Some new tools, some old tools with new options • traceroute6 (unix), tracert -6 (windows) • tcpdump extended with new options and functionality (e. g. “protochain to parse extension headers) • wireshark, nmap is OK, snort is not ready • Passive asset discovery easier than active

  13. Security? • Attention to configuration guidelines • http://www.nsa.gov/ia/_files/routers/I33-002R-06.pdf • http://csrc.nist.gov/publications/nistpubs/800-119/sp800-119.pdf • Plan transition carefully – use experiences already published as guidelines • Join mailing lists, working groups • Test, test • Everything works that is supposed to work • Nothing works that isn’t supposed to work

  14. Get Prepared! Courtesy of xkdc.com Ethernet?

  15. Liftoff!