eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Way to go, vendors of low-end routers and intrusion detection and prevention systems—youre a stumbling block on Bechtels path to the next-generation Internet.
“Were doing [both IPv4 and the next-generation IPv6 networks], and we anticipate doing both for a number of years,” said Fred Wettling, a Bechtel Fellow who manages technology standards and is sponsoring the enterprise IPv6 challenge within Bechtel. “This creates a challenge from the security standpoint of making sure the security mechanisms will do tracking [and] protection on both v4 and v6 concurrently.”
The problem, he said, is that “some people making security products are not quite there yet,” with “there” meaning product support of native IPv6 connectivity. “Thats kind of frustrating.”
Why does Bechtel want IPv6? Imagine the company rapidly deploying employees to New Orleans in the wake of Hurricane Katrina, which the construction outfit in fact did. With the vast IP addressing space IPv6 has ushered in—its main draw—and its ability to turn every notebook, cell phone or other IP-enabled gadget into a server on the peer-to-peer network that IPv6s endpoint-to-endpoint architecture enables, post-Katrina recovery would have been markedly different. For example, trailers could have been connected to each other dynamically once the IP cloud was established, with no work required from Bechtels IT people.
Its not pie in the sky. IPv6 is here, now. Europe and Asia are roughly tied in the total number of IPv6 addresses they have per capita, said Wettling, based in Oak Ridge, Tenn., and a member of the North American IPv6 Task Force and executive director of the IPv6 Business Council. Also, the U.S. governments Office of Management and Budget has mandated that the federal government—including agencies and contractors—transition by June 2008.
Perhaps most notably for North American enterprises that havent yet dabbled in IPv6, Microsoft is serving up the technology in Windows Vista and “Longhorn,” with a protocol to tunnel IPv6 traffic over IPv4—a transition technology to compensate for security and network perimeter device vendors lag time in supporting the new protocol.
IPv6 is now here, and so are its security issues. It is a nightmare scenario for any security officer, according to multiple sources, including Charles Lee, chief technology officer for Verizon Federal—the group within Verizon Business dedicated to serving federal government customers.
“I think that the tipping point has been reached,” said Lee in Washington. “What I point to as the killer app is VOIP [voice over IP]. There are huge market forces around untethered voice service: PDA-enabled cell phones and so on. Untethered assets are a real market force. In order for those applications to behave well and work in a broad environment, they need v6 capability. V6 is here. The cell phone folks have already set up address allocations: Nokia reserved 500,000 addresses for itself, [and the] chips have been introduced [that] will enable the next generation of services.”
In other words, consumers are either using it now or will use it in the next 12 to 18 months, Lee said. What that will look like to your network is this, he said: “You can do P2P so much easier. Instead of me having to directly access some central repository, I may be able to send information from my cell phone to yours, bypassing any other tracking or storage device in the middle of the network, and thereby have complete security in the course of moving this information.”
Yes, IPv6 brings security—or obfuscation, as the case may be—to moving information. One notable feature of IPv6 is that it puts encryption into the hands of the user. Were an IPv6 user to illicitly collect data, he or she could pass it off, without network perimeter security checks able to look inside its encrypted contents, to another peer on IPv6—an accomplice who could be anywhere. “And youve just laid out the nightmare scenario for any security officer,” Lee said.
The industry already is facing those challenges, Lee said. “Its not uncommon for security people to be very concerned with data integrity and keeping proprietary data under lock and key, and often we miss the fact that the guy who just walked in has a camera in his cell phone,” he said.
The security challenges P2P presents exist today, but theyll be more obvious when IPv6 walks through your enterprises door, Lee said, because “new generations of capabilities will be sitting on peoples hips.”
Tunneling is another security implication. Symantec in November first brought up the security implications of Microsofts Vista and the upcoming Longhorn server using the Teredo protocol for tunneling IPv6 over IPv4 networks. Again, the potential security implications of Teredo concern the inability of perimeter devices to see inside packets. IDSes (intrusion detection systems) are generally good at inspecting TCP and UDP (User Datagram Protocol) traffic, which are the traditional protocols that transport Web and e-mail requests. If attacks on a system are tunneled, however, theyll be invisible to IDSes.
“Any security device needs to be aware of Teredo in order to look into it and analyze traffic traveling over it,” said Oliver Friedrichs, director at Symantecs Security Response team, in Mountain View, Calif. “For enterprises, this presents, obviously, a serious concern. Attackers can, for one, tunnel through perimeter devices without being seen and tunnel attacks over [Teredo] without being seen by perimeter devices.”
Such perimeter devices include firewalls and low-end routers, such as those from Linksys. “The firewall is traditionally there to filter traffic, but with Teredo its rendered in many cases ineffective,” he said.
Next Page: Bechtel wont touch Teredo.
2
For Bechtel, which is getting ready to flip the switch on an IPv6 network in the coming year, Teredo isnt a big deal. Thats not because Bechtel considers Teredo safe; its because the company wont touch it.
“Teredo is off the map, not part of our game plan,” Wettling said. “Were trying to avoid the additional overhead of implementing transition technology that doesnt get us to the state [in which] we want to be, which is to deploy IPv6 end to end throughout the network.”
The reason for tunneling protocols is that IPv4 isnt going to suddenly disappear. Rather, IPv4 and IPv6 will coexist for many years to come. Theres a tremendous amount invested in the current IPv4 Internet. Also, IPv6 businesses will have to interact with those that choose to stick with IPv4 until equipment or software upgrades force the issue.
For its part, Bechtel will run two separate stacks simultaneously: one for IPv4, one for IPv6. Having two separate stacks wont require twice the management time or twice the people-power, Wettling said, because the next-generation network is “a lot easier to run than IPv4.”
“Its absolutely amazing,” he said. “Were a big company, and we have, internally, a mix of public and private addressing. We grow and shrink [address allocation] on sites according to how many people we have [in a given location]. [Bechtels business locations] move dynamically all over the world. As we grow and shrink populations, well add pools of IP addresses.
“The shrinkage and growth over time has created a bunch of [address fragmentation],” Wettling said. “IPv4 address blocks are not contiguous. With IPv6, everythings dynamic. We dont have to go through the process of saying Im adding a new server, the address is blah blah blah. If its running IPv6, it gets the site prefix from an upstream router, creates its own IPv6 [address] and off we go. You can reboot 100 times and it comes up with the same address. Things like that, people dont talk about, but its a big sigh of relief.”
Wettling said another driver for the no-Teredo approach is that Bechtel wants to build a solid and secure foundation for innovation. The company has been having extensive discussions with external customers as well as with its internal customers, such as the engineering and construction departments. The parties have found opportunities to use IPv6 to improve its work methods, Wettling said—the Katrina scenario being one example—and wants to build those applications on a firm grounding.
Granted, Wettling doesnt have a grudge against Teredo; he uses it at home with no problem. That said, he suggests that a company take heed if it plans to use it. If running Teredo on the host layer, for example, companies need to understand the implications, he said: “One is you need to make sure you have some local firewall to do some level of local blocking, and [make sure] it uses IPv6.”
Bechtel runs Cisco PIX firewalls, which support IPv6, to protect its IPv6 network, which now runs only in the lab. At this point the company is upgrading its intrusion detection/intrusion prevention systems to make sure they have the current versions of hardware and software to support IPv6.
Also important when considering IPv6 from a security standpoint is to have logging facilities in place that can support IPv6. Bechtel, like many companies, keeps tabs on traffic flowing in and out of its network. “Being able to log IPv6 is important to us, so were working on making sure logging mechanisms will record v6 sessions,” Wettling said. “Its not complete yet; thats one of the last things we have to do to connect to the outside.”
Once the logging piece is in place, Bechtel will be able to see source and destination addresses in network traffic. The company now records what machines from which a given transaction originates, as well as what user is attached to that machine. With IPv6s facility for stealth, how will Bechtel replicate that tracking? Wettling said IPv6 traffic differs from VOIP traffic, which uses a call manager or the like to set up a call but handles communication directly from P2P. IPv6 will be more similar to P2P—a technology with which companies already wrestle and that doesnt employ an external enabler.
“A lot of companies have the challenge of wrestling with, What do we do with IM [instant messaging]? Treat it like e-mail as far as logging, or not?” he said. “Were still debating that within Bechtel.”
And after all, IPv6 and IPv4 are just protocols. At the end of the day, its that chunk of communication theyre transporting that matters. “Thats where people really need to focus on security stuff: Focus on protecting what needs to be protected,” Wettling said.
“The transport from my standpoint doesnt make much difference. Its protecting the resource. V6 gives us the ability to do things differently. We need to understand what the security risks are, and balance them against what the business opportunities are.”
Check out eWEEK.coms for the latest news, views and analysis on servers, switches and networking protocols for the enterprise and small businesses.