IPv6, The Pathway to Improved IT & IoT Security.

Transcription

1 IPv6, The Pathway to Improved IT & IoT Security

2 AGENDA IPv6 is now a Business Decision! New Security Features SOC s & Sensors Next Steps

3 I LIKE A GOOD IPV6 FICTION Running IPv4 & IPv6 in parallel increases CAPEX/OPEX 2x Deployment will take years My gear does not support IPv6 My Customers & Partners don t use or want IPv6 IPv6 is slower because of the larger header We don t need that many addresses IPv6 is just a fad waiting till IPv9 Many, Many more Source:

4 IPV6 BUSINESS CASE Decrease OPEX/CAPEX, Increase Competiveness & Agility

5 THE BUSINESS REALITY OPEX/CAPX : WELLS FARGO Greater space for growth Reduced requirement for readdressing duplicate address space in mergers/ acquisitions Support for low-functionality end-points that may lack DHCP and static addressing capabilities (IoT, even Android devices) Reduce reliance on NAT (and associated logging complexity) More universally geo-locate address space (assuming ULA usage is reduced compared to RFC1918) Simplification of routing tables through improved summarization International Commerce

6 THE BUSINESS REALITY OPEX/CAPX : MICROSOFT Improved peer-to-peer networking for communications Personalized user experience using IP-based location services We see minor performance benefits as address translators are removed and implementations are improved NAT64 & NAT 444 (CGN) obscure location data, and cause service failures Market opportunities increase when customers mandate IPv6 support IPv6 allows faster infrastructure growth for services experiencing rapid customer usage Microsoft corporate IT efforts are based on a belief that IPv6 support is a cost of business, with returns on investment to be seen only over a very long time frame.

7 THE BUSINESS REALITY OPEX/CAPX : FACEBOOK Easier management of networks: Flatter, simpler, and more manageable. End-to-end connectivity integrity: Direct addressing is possible, due to vast address space Shortest path, no additional latency (middle boxes). Improved User Experience & Higher Engagement: One address per user (or household), no additional latency (10-15% faster). Improved interoperability and mobility capabilities (which are already widely embedded in network devices) Reference:

8 THE BUSINESS REALITY OPEX/CAPX : COMCAST Reduce costs based on depleted IPv4 addresses USD 9.50/IPv4 address (In Bulk) USD 35.00/IPv4 address in cloud Reduce operational complexity One IPv6 address per user/household Increase service offerings and become more competitive IoT wireless and analytics

9 THE BUSINESS REALITY OPEX/CAPX : LINKEDIN Better Use Experience 10% to 40% faster mobile (LTE) users applications NOTE: Just purchased by Microsoft Reference:

10 OUT WITH THE OLD THE BUSINESS REALITY OPEX/CAPX : IPV4 END OF LIFE

11 IN WITH THE NEW IMPACT ON COMPETITION THE BUSINESS REALITY OPEX/CAPX : IPV6 ONLY Wireless: High Bandwidth 4G LTE NG Wireless & 5G Wireless Low Bandwidth Low Power Cognitive radio (TV Whitespace) & IoT Networks (LoRaWan) IoT & IoTT (Internet of Trusted Things) 6LowPan (IPv6 for low power systems) Car-toCar/Car-to-Infrastructure Communications Many New Wireless networks already exist Cellular infrastructure does not exist Many international smart cites, smart buildings, smart transportation system

12 DID I MENTION THE US GROWTH? Reference:

13 DID I MENTION THE WORLD GROWTH? Reference:

14 EVERYONE IS DOING IPV6! Capable Prefered ~ Users Americas 18.55% 17.22% 114,465,082 Europe 13.04% 12.53% 92,278,761 Oceania 7.44% 6.72% 4,652,665 Asia 5.01% 3.96% 308,201,990 Africa 0.25% 0.24% 60,420,617 Reference:

15 SUMMARY IPV6 IS NOW A BUSINESS DISCUSSION NOT A TECHNICAL DISCUSSION! RISK AND CYBER SECURITY HEADACHE IF NOT MANAGED!

16 NEW SECURITY FEATURES INCREASE THE COSTS TO THE ATTACKERS! REDUCE COSTS TO DEFENDERS!

17 IPV6 HELPS REMOVE THE SCARS 1. Re-Architect for better Operations & Security! 2. Justifications to perform the SANS Top 20 Inventory of Authorized and Unauthorized Devices Inventory of Authorized and Unauthorized Software Secure Configurations for Hardware and Software Continuous Vulnerability Assessment and Remediation 3. Justifies removing devices which do not support IPv6 4. Update existing products which do support IPv6 Security Engineering for New Infrastructure

18 LAW OF SMALL VS. LARGE NUMBER 45 Min Scan all Internet IP s (no DNS) 500,000+ Years /24 < 1 Min Scan smallest range (no DNS) /64 < 500 Years /24 < 1 Min Reverse DNS Scan /64 < 500 Years Simplifies identification of Bots, C&C, active attacks

19 NAT VS. END-TO-END PRINCIPLE IPv4 Overlapping Addresses Anyone can insert a NAT Router Anyone can connect end-device Requires renumbering Static or DHCP NAT disassociates trust IPv6 Unique Addresses Quickly identify routers Quickly identify end-devices Auto-numbering feature if required Auto-configuration and/or DHCP Restore end-to-end Trust Unique Addresses speed internal identification of badne

20 SINGLE ADDRESS VS. MULTIPLE ADDRESSES IPv4 One address for all services (Default) On Link Across the enterprise Mapped across the Internet IPv6 Multiple addresses (Default) On Link (FE80:: ) Across Enterprise (ULA) Internet (Global inbound connection) Internet (Privacy Addresses) Different services different addresses Management and Monitoring API s & Webservers Patching & Backup Address provides simplified security policies

21 LAW OF SMALL VS. BIG ADDRESSES IPv4 No Geo-location context No Network context No rack context IPv6 Map to Physical location Network location VLan Rack Overlay network Wireless, wired & data centers Application Address provides Internal context

22 NAT STATEFULNESS IMPACTS POWER IPv4 Hosts 1 Application 1 or more connections per application Keep alive for each IPv6 Hosts 1 Application 1 or more connection per application No Keep Alive needed Each Firewall/Routers with NAT Firewall/Router M-1 hosts with M-1 Hosts N-1 applications N-1 applications P-1 connections per application P-1 connections per application Maintain State for 1 to 15 min. Maintain state based on connection queues 3-14% power reduction and battery savings

23 SUMMARY INCREASING THE COSTS TO THE ATTACKERS! REDUCE COST TO DEFENDERS!

24 SOC S & SENSORS Things to Think About Today

25 NETWORK SENSOR Dependencies & Challenges Capable of detecting and processing all variations of any protocol Black lists & white lists Blocking Constraint Logging Management via IPv6 Research is OLD Opportunity Topology Hiding (Link Local)

26 NETWORK BLOCKING Dependencies & Challenges Capable of detecting and processing all variations of any protocol Black lists & white lists Blocking Constraint Logging Management via IPv6 Research is OLD Opportunity Topology Hiding (Link Local)

27 NETWORK HOST Dependencies & Challenges Choice of Address Assignment & Management Choices of Name Resolution & Management Addressing IP/MAC vs. DHCP Unique Identifier (DUID) Multiple Addresses Docker/VM <- Great BYOD/Devices moving on your network <-Track? VPN Problem IPv4 only vs. IPv6 only vs. IPv4/IPv6 IPv6 only network to IPv4 NAT64/DNS64

28 SEIM/ANALYTIC Dependencies & Challenges Processing IPv6 Addresses Geolocation Carrier Grade Nat (CGN) Lack of matching IPv4 with IPv6 devices/attacks Management via IPv6

29 AUDIT/ASSESSMENT/PEN TESTING (COMPLIANCE) Dependencies & Challenges Audit Processes & Tools Assessment Processing & Tools Pen testing Do you meet compliance if you have not testing IPv6? Security controls IPv4!= IPv6

30 SOC S & SENSORS Things to Think About Today

31 NEXT STEPS Disrupt6 Research?

32 ADVANCED SECURITY IPV6 FEATURES INDICATORS OF INTENT (IOI)

33 TRACKING THROUGH CYBERSPACE & TIME

34 ATTRIBUTION THROUGH TOR

35 A VISIT FROM ANONYMOUS

36 IPV4 & IPV6 DECOYS

37 ATTACKER & BROKER ATTRIBUTION RESULTS Privacy vs. Attribution: Provide Privacy to Users Deny Privacy and Attribute Attacker, Bots & Brokers Additional Findings: Statistical validation of attacker which reduced dependency on IP addresses Better Geo-location Statistical validation of other attributed including: Browser type, Networks, Operating Systems, Tunnels, VPN s, TOR, etc. Identified Data Brokers which scan and provide ($) vulnerability to others

38 AGENDA IPv6 is now a Business Decision and a Security Headache! New Security Features SOC s & Sensors Next Steps

39 IPv6, The Pathway to Improved IT & IoT Security