NSA CSI IPv6 Security Guidance (2023) [pdf]
media.defense.gov
NSA CSI IPv6 Security Guidance (2023) [pdf]
1–10 of 57 posts
Re: NSA CSI IPv6 Security Guidance (2023) [pdf]
#2TLDR: Avoid it if you can!
Re: NSA CSI IPv6 Security Guidance (2023) [pdf]
#3Interesting that they prefer dual stack to tunnel. I would have thought running your own 6to4 at the network edge would have been more preferential.
Re: NSA CSI IPv6 Security Guidance (2023) [pdf]
#4TLDR: Avoid it if you can!
Aren't these comments getting a bit old at this point? Running dual-stack should not be any more difficult than just running IPv4. There is a plethora of automated deployment tools and I'd hardly think people are DHCP'ng addresses to their servers. You don't have to use SLAAC and can statically assign addresses just like IPv4. Even for your dual stacked devices getting IPv6 addresses via RA can be tracked back to their IPv4 DHCP bootp requests.
I'm making the assumption here that anyone concerned about their network attack surface is actively capturing network or netflow data in which tools like openargus[1] or Arkime[2] make all of this collectable/searchable. Additionally most network devices support mirror/monitoring to offload data if you aren't working on the scale of needed dedicated taps/aggregators.
Re: NSA CSI IPv6 Security Guidance (2023) [pdf]
#5TLDR: Avoid it if you can!
[deleted]
Re: NSA CSI IPv6 Security Guidance (2023) [pdf]
#6Interesting that they prefer dual stack to tunnel. I would have thought running your own 6to4 at the network edge would have been more preferential.
What would be the advantages of running 6to4 on your network edge?
Re: NSA CSI IPv6 Security Guidance (2023) [pdf]
#7TLDR: Avoid it if you can!
That's not at all what I got from this.
Ipv4 security guidelines do not look much different.
TLdr: be aware of the differences and prefer ipv6-only instead of dual stack if you can, to reduce complexity.
Re: NSA CSI IPv6 Security Guidance (2023) [pdf]
#8TLDR: Avoid it if you can!
Aren't these comments getting a bit old at this point? Running dual-stack should not be any more difficult than just running IPv4. There is a plethora of automated deployment tools and I'd hardly think people are DHCP'ng addresses to their servers. You don't have to use SLAAC and can statically assign addresses just like IPv4. Even for your dual stacked devices getting IPv6 addresses via RA can be tracked back to the…
They do feel a bit old. Especially considering that is not the "TL;DR" of the paper. The paper makes no statement on whether or not it is a good idea to use ipv6, only that the US Government is transitioning and some guidelines on how to do that.
Re: NSA CSI IPv6 Security Guidance (2023) [pdf]
#9Slightly off topic but IPV6 is a massive security hole for regular consumers. NATs sucked when you trying to connect to your favorite MMO but that is because they created a default drop rule for all special inbound ports.
I was shocked to see that as soon as your ISP switched to IPV6, your host is now directly addressed. As a by product of skipping NAT you are now relying on every machine having proper firewall settings. [UPDATE: or the router drops incoming IPV6 connections w/ it's firewall]
Just think about how many windows machines out there have Remote desktop enabled but were only safe because they were not publicly accessible or the hospital machines that are still running windows XP. God help us.
Re: NSA CSI IPv6 Security Guidance (2023) [pdf]
#10Interesting that they prefer dual stack to tunnel. I would have thought running your own 6to4 at the network edge would have been more preferential.
What would be the advantages of running 6to4 on your network edge?
My thinking was that it would be a single point of ipv4 traffic, rather than having to maintain all the components for dual stack. But thinking about it more, 6to4 probably increases the complexity of firewalls.