NSA Published IPv6 Security Guidance – Cybersecurity Information Sheet

To encourage the Division of Defense (DoD) and other system directors in figuring out and minimising security dangers connected to the transition to Net Protocol version 6 (IPv6), the National Security Company (NSA) has released IPv6 Security Steering.

The most modern IP version, IPv6, offers benefits over the earlier IP version 4 technologies (IPv4). The IPv4 address rental, particularly, is insufficient to address the rising selection of networked devices that require routable IP addresses, whereas IPv6 offers a mountainous address rental to fulfill both most modern and future wants.

The NSA notes that the transition to IPv6 is anticipated to contain the most effects on community infrastructure, affecting every networked hardware and machine in some system, to boot to cybersecurity.

“Working twin stack will enhance the operational burden and the attack ground. Machine owners and directors have to composed implement cybersecurity mechanisms on both IP protocols to protect the community”, reads the NSA’s IPv6 security guidance.

Federal and DoD networks are expected to goal twin stack, that plan they’re going to concurrently hasten IPv4 and IPv6. This extends the attack ground and items additional security considerations.

IPv6 Security Steering

Using stateless address auto-configuration (SLAAC), a bunch can robotically keep itself an IPv6 address. Static addresses will be most well-most long-established in some cases, corresponding to for fundamental servers, nonetheless allowing devices to robotically self-keep or ask an IPv6 address dynamically is extra efficient.

“NSA recommends assigning addresses to hosts through a Dynamic Host Configuration Protocol version 6 (DHCPv6) servers to mitigate the SLAAC privacy converse”, states the company.

“Alternatively, this converse can additionally be mitigated by the utilize of a randomly generated interface ID that adjustments over time, making it subtle to correlate exercise while composed allowing community defenders requisite visibility”.

One protocol will even be transmitted within one other protocol the utilize of the transitional system known as tunneling.

“Except transition tunnels are required, NSA recommends averting tunnels to gash complexity and the attack ground. Configure perimeter security devices to detect and block tunneling protocols that are dilapidated as transition programs”, the company published IPv6 Security Steering.

The NSA advises implementing IPv6 cybersecurity measures corresponding to those keep in keep for IPv4, corresponding to firewall tips, and blocking other transitional measures, including tunneling and translation, for twin-stack networks.

Extra, directors have to composed check procure entry to control lists (ACLs) or filtering tips to procure obvious that the bulk efficient traffic from licensed addresses is allowed because a couple of community addresses are recurrently assigned to the similar interface in IPv6. They have to composed additionally log all traffic and habits routine log critiques.

The NSA additionally advises ensuring that community directors produce sufficient coaching and education on IPv6 networks in relate to greater protect and strengthen IPv6 security on a community.

Hence, IPv6 security threats pause exist and could well even be observed, they’re going to even be diminished by a combination of strictly following configuration ideas and system owners’ and directors’ coaching all around the transition.

“The Division of Defense will incrementally transition from IPv4 to IPv6 over the following couple of years and tons DoD networks will be twin-stacked,” acknowledged Neal Ziring, NSA Cybersecurity Technical Director.

“It’s fundamental that DoD system admins utilize this handbook to title and mitigate doable security considerations as they roll out IPv6 strengthen of their networks.”