Bangalore: It was a milestone in internet’s history. Last week, the world eagerly witnessed the grand launch of IPv6, as this paved path for the internet which aims at replacing current IPv4. Along with web giants like Facebook and Google, some of the Indian websites also joined hands in stepping to the new platform. The Telecom Department of India reports that about 27 Indian websites have already made the big leap. But now a question is raised- How about the security? Has this new system or platform given importance to security? The interesting part is that most of them are skeptical about the issue.
According to Steve Santorelli, who is with Team Cymru, an Internet security research company, after quitting the jobs from the US Scotland Yard's Computer Crime Unit and Microsoft’s Internet Crimes Investigation Team, “To most developers, security comes as a distant afterthought and so is the case with IPv6? IPv6 is not a security fix, and if we're not careful, it might be the opposite as the global attack surface will grow with people having a false sense of security over IPv4.”
Santorelli also warns that the shift to IPv6 from IPv4 is just like changing numbers. So if the firms are really not thinking about the security then they really should from now on. The reason behind this is that IPv6 wasn’t developed with security as its main core. So now or never, we me might be on the verge finding new and harder security issues.
Another major issue is that IPv6 doesn’t support Internet Protocol Security (IPsec) which is the used for securing communications and for end to end security. The reason said behind this is that the launch of IPv6 was so abrupt that its integration wasn’t possible. Deepak Rout, Director at ISACA Delhi chapter, explains that “The integration didn’t happen because of the rapidity of the rollout. So, today IPv6 will be deployed largely without cryptographic capabilities. CIOs will have to deploy encryption technologies over the protocol to make point to point security possible.”
Owen Delong, director of professional services for global Internet backbone Hurricane Electric reasons out, “Yes, there are some unknowns and some other challenges with the migration towards dual stack and eventually the replacement of IPv4. The concerns include translation/transition/tunneling mechanism for attacks, new types of reconnaissance attacks and some new twists on header manipulation and fragmentation attacks.”
But these issues will never keep organizations from shifting to the new platform because IPv4 has already exhausted in the number of IP addresses and enterprises will have to pay more if they are willing to stay in IPv4 that has slower web hosting and connections.
