Advanced IPv6 Security

March 19, 2012 (at 10 a.m.)

This workshop covers advanced security aspects of IPv6 in enterprise environments. We will focus on architecture and planning aspects and discuss latest developments in the technology and standards space.

The goal is to enable the participants to take well-informed decisions when it comes to deploying IPv6 in a both secure and operationally feasible manner.

It is assumed athat participants already dispose of some fundamental knowledge as for IPv6′s inner workings.

Agenda

Current state of IPv6 security in LANs:

Attack trends and tools.
Which of those are presumably relevant and which are not.
Best practices for network stability and security.
Overview of devices of main vendors supporting RA guard and the like (NDP, DHCP snooping).

Choosing the right addressing approach:

Some notes on the ULA discussion.
When & where to use link local addresses from a security perspective.

Privacy extensions:

Advantages & disadvantages from a security & privacy point of view.
Default behavior of common desktop and smartphone operating systems (and how to potentially adjust it).
Practical implications (e.g. reverse DNS).

Filtering IPv6 traffic:

Best practices and sample configurations.
Overview of IPv6 support in common security devices.
NAT in the IPv6 world – the endless debate.

Target Audience:

Network planners
Sysadmins in IPv6 environments
Security Officers

Enno Rey

Enno Rey @Enno_Insinuator is an old school network security guy who has been involved with IPv6 since 1999. In the last years he has contributed to many IPv6 projects in very large environments, both on a planning and on a technical implementation level.

Christopher Werny

Christopher has been involved with IPv6 since 2005 and has performed a number of IPv6 planning, implementation and troubleshooting projects & tasks since then. He leads the network security team at ERNW.