Internet Protocol Version 6: Federal Agencies Need to Plan for Transition and Manage Security Risks
Published: 2005-05-20T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Internet protocol (IP) provides the addressing mechanism that defines how and where information such as text, voice, and video move across interconnected networks. Internet protocol version 4 (IPv4), which is widely used today, may not be able to accommodate the increasing number of global users and devices that are connecting to the Internet. As a result, IP version 6 (IPv6) was developed to increase the amount of available IP address space. It is gaining momentum globally from regions with limited address space. GAO was asked to (1) describe the key characteristics of IPv6; (2) identify the key planning considerations for federal agencies in transitioning to IPv6; and (3) determine the progress made by the Department of Defense (DOD) and other major agencies to transition to IPv6.
section_title: What GAO Found
paragraphs: The key characteristics of IPv6 are designed to increase address space, promote flexibility and functionality, and enhance security. For example, by using 128-bit addresses rather than 32-bit addresses, IPv6 dramatically increases the available Internet address space from approximately 4.3 billion addresses in IPv4 to approximately 3.4 x 10^38 in IPv6. Key planning considerations for federal agencies include recognizing that the transition is already under way, because IPv6-capable software and equipment already exists in agency networks. Other important agency planning considerations include developing inventories and assessing risks; creating business cases that identify organizational needs and goals; establishing policies and enforcement mechanisms; determining costs; and identifying timelines and methods for transition. In addition, managing the security aspects of an IPv6 transition is another consideration since IPv6 can introduce additional security risks to agency information. For example, attackers of federal networks could abuse IPv6 features to allow unauthorized traffic or make agency computers directly accessible from the Internet. DOD has made progress in developing a business case, policies, timelines, and processes for transitioning to IPv6. Despite these efforts, challenges remain, including finalizing plans, enforcing policy, and monitoring for unauthorized IPv6 traffic. Unlike DOD, the majority of other major federal agencies reported not yet having initiated key planning efforts for IPv6. For example, 22 agencies lack business cases; 21 lack transition plans; 19 have not inventoried IPv6 software and equipment; and none had developed cost estimates.

section_title: Letter
paragraphs: In 2003, the President’s National Strategy to Secure Cyberspace identified  the development of secure and robust Internet mechanisms as important  goals because of the nation’s growing dependence on cyberspace. The  Internet protocol (IP) is one of the primary mechanisms that defines how  and where information such as text, voice, and video moves across  networks. Internet protocol version 4 (IPv4), which is widely used today,  may not be able to accommodate the increasing number of global users and  devices that are connecting to the Internet. As a result, IP version 6 (IPv6)  was developed to increase the amount of available IP address space. There  has been increasing interest in this new version of IP and its implications  for federal agencies.
As agreed with your office, our objectives were to (1) describe the key  characteristics of IPv6, (2) identify the key planning considerations for  federal agencies in transitioning to IPv6, and (3) determine the progress  made by the Department of Defense (DOD) and other major federal  agencies to transition to IPv6.
To accomplish these objectives, we researched and documented key IPv6  attributes, including security features, and analyzed technical and planning  information from experts in government and industry. Additionally, we  obtained and analyzed documents from the Department of Commerce. We  also studied DOD plans, procedures, and actions for transitioning to IPv6.  Finally, we identified efforts undertaken by the other 23 Chief Financial Officer (CFO) Act agencies to determine their progress in addressing IPv6  transition challenges. We conducted our work from August 2004 through  April 2005 in accordance with generally accepted government auditing  standards. Details of our objectives, scope, and methodology are included  in appendix I.
subsections: section_title: Background
paragraphs: The Internet is a worldwide network of networks comprised of servers,  routers, and backbone networks. Network addresses are used to help send  information from one computer to another over the Internet by routing the  information to its final destination. The protocol that enables the  administration of these addresses is the Internet protocol (IP). The most  widely deployed version of IP is version 4 (IPv4).
subsections: section_title: Internet Protocol Transmits Information across Interconnected Networks
paragraphs: The two basic functions of IP include (1) addressing and (2) fragmentation  of data, so that information can move across networks. An IP address  consists of a fixed sequence of numbers. IPv4 uses a 32-bit address format,  which provides approximately 4.3 billion unique IP addresses. Figure 1  provides a conceptual illustration of an IPv4 address.
By providing a numerical description of the location of networked  computers, addresses distinguish one computer from another on the  Internet. In some ways, an IP address is like a physical street address. For  example, in the physical world, if a letter is going to be sent from one  location to another, the contents of the letter must be placed in an envelope  that contains addresses for the sender and receiver. Similarly, if data is  going to be transmitted across the Internet from a source to a destination,  IP addresses must be placed in an IP header. Figure 2 provides a simplified  illustration of this concept. In addition to containing the addresses of  sender and receiver, the header also contains a series of fields that provide  information about what is being transmitted.
The fields in the header are important to the protocol’s second main  function: fragmentation of data. IP fragments information by breaking it  into manageable parts. Each part has its own header that contains the  sender’s address, destination address, and other information that guides it  through the Internet to its intended destination. When the various packets  arrive at the final destination, they are put back together into their original  form.
section_title: Internet and Protocol Management and Development Involve Several Key Organizations
paragraphs: Several key organizations play a role in coordinating protocol development  and Internet management issues, including the following:  The Internet Corporation for Assigned Names and Numbers, (ICANN),  is a nonprofit corporation responsible for Internet address space  allocation and management of the Internet domain name system.
Regional Internet Registries allocate Internet address blocks from  ICANN in various parts of the world and engage in joint projects, liaison  activities, and policy coordination. The registries include the African  Network Information Center, Asia Pacific Network Information Centre,  American Registry for Internet Numbers, Latin American and Caribbean  Internet Addresses Registry, and Réseaux IP Européens Network  Coordination Centre.
Competing companies known as registrars are able to assign domain  names, the mnemonic devices used to represent the numerical IP  addresses on the Internet (for example, www.google.com). More than  300 registrars have been accredited by ICANN and are authorized to  register domain names ending in .biz, .com, .coop, .info, .name, .net,  .org, or .pro. A complete listing is maintained on the InterNIC Web site.
The Internet Society is a large, international, professional organization  that provides leadership in addressing issues that may affect the future  of the Internet and assists the groups responsible for Internet  infrastructure standards. The Internet Society also provides legal,  financial, and administrative support to the Internet Engineering Task  Force (IETF).
IETF is the principal body engaged in the development of Internet  standards. It is composed of working groups that are organized by topic  into several areas (e.g., routing, transport, security, etc.).
section_title: IPv4 Address Limitations and Mitigation Efforts
paragraphs: Limited IPv4 address space prompted organizations that need large  amounts of IP addresses to implement technical solutions to compensate.  For example, network administrators began to use one unique IP address  to represent a large number of users. By employing network address  translation, an enterprise such as a federal agency or a company could have  large numbers of internal IP addresses, but still use a single unique address  that can be reached from the Internet. In other words, all computers behind  the network address translation router appear to have the same address to  the outside world. Figure 3 depicts this type of network configuration.
While network address translation has enabled organizations to  compensate for the limited number of globally unique IP addresses  available with IPv4, the resulting network structure has eliminated the  original end-to-end communications model of the Internet. Network  address translation complicates the delivery of real-time communications  over the Internet.
In 1994, IETF began reviewing proposals for a successor to IPv4 that would  increase IP address space and simplify routing. IETF established a working  group to be specifically responsible for developing the specifications for  and standardization of IPv6. Over the past 10 years, IPv6 has evolved into a mature standard. A complete list of IPv6 documents can be found at the  IETF Web site.
section_title: IPv6 Is Gaining Momentum Globally
paragraphs: Interest in IPv6 is gaining momentum around the world, particularly in  parts of the world that have limited IPv4 address space to meet their  industry and consumer communications needs. Regions that have limited  IPv4 address space such as Asia and Europe have undertaken efforts to  develop, test, and implement IPv6.
subsections: section_title: Asia
paragraphs: As a region, Asia controls only about 9 percent of the allocated IPv4  addresses, and yet has more than half of the world’s population. As a result,  the region is investing in IPv6 development, testing, and implementation.  For example, the Japanese government’s e-Japan Priority Policy Program  mandated the incorporation of IPv6 and set a deadline of 2005 to upgrade  existing systems in both the public and private sector. The government has  helped to support the establishment of the IPv6 Promotion Council to  facilitate issues related to development and deployment and to provide tax  incentives to promote deployment. In addition, major Japanese  corporations in the communications and consumer electronics sectors are  also developing IPv6 networks and products.
The Chinese government’s interest in IPv6 resulted in an effort by the China  Education and Research Network Information Center to establish an IPv6  network linking 25 universities in 20 cities across China. In addition, China  has reportedly set aside approximately $170 million to develop an IPv6- capable infrastructure.
Taiwan has also started to work on developing IPv6 products and services.  For example, the Taiwanese government announced that it would begin  developing an IPv6-capable national information infrastructure project.  The planned initiative is intended to deploy an infrastructure capable of  supporting 6 million users by 2007.
In September 2000, public and private entities in India established the  Indian IPv6 Forum to help coordinate the country’s efforts to develop and  implement IPv6 capabilities and services. The forum hosted an IPv6  summit in 2005.
section_title: Europe
paragraphs: The European Commission initiated a task force in April 2001 to design an  IPv6 Roadmap. The Roadmap serves as an update and plan of action for the  development and future perspectives of IPv6. It also serves as a way to  coordinate European efforts for developing, testing, and deploying IPv6.  Europe currently has a task force that has the dual mandate of initiating  country/regional IPv6 task forces across European states and seeking  global cooperation around the world. Europe’s task force and the Japanese  IPv6 Promotion Council forged an alliance to foster worldwide  deployment.
section_title: Latin America
paragraphs: Latin America also has begun developing projects involving IPv6. Some of  these projects include an IPv6 interconnection among all the 6Bone sites  of Latin America and a Native IPv6 Network via Internet2. Also in Mexico,  the National Autonomous University of Mexico has been conducting  research. In 1999, the university acquired a block of address space to  provide IPv6-enabled service to Mexico and Latin America.
section_title: North America
paragraphs: Established in 2001, the North American IPv6 Task Force promotes the use  of IPv6 within industry and government and provides technical and  business expertise for the deployment of IPv6 networks. The task force is  composed of individual members from the United States and Canada who  develop white papers and deployment guides, sponsor test and  interoperability events, and collaborate with other task forces from around  the world. Currently, the task force, the University of New Hampshire, and  DOD are collaborating on a national IPv6 demonstration/test network.
section_title: Initial Governmentwide Efforts to Address IPv6 Began in 2003
paragraphs: In 2003, the President’s National Strategy to Secure Cyberspace identified  the development of secure and robust Internet mechanisms as important  goals because of the nation’s growing dependence on cyberspace. The  strategy stated that the United States must understand the merits of, and  the obstacles to, moving to IPv6 and, based on that understanding, identify  a process for moving to an IPv6-based infrastructure.
To better understand these challenges, the Department of Commerce  formed a task force to examine the deployment of IPv6 in the United  States. As co-chairs of that task force, the Commerce Department’s  National Institute of Standards and Technology (NIST) and the National  Telecommunications and Information Administration invited interested  parties to comment on a variety of IPv6-related issues, including: (1) the  benefits and possible uses; (2) current domestic and international  conditions regarding the deployment; (3) economic, technical, and other  barriers to the deployment; and (4) the appropriate role for the U.S.  government in the deployment. As part of the task force’s work, the  Department of Commerce issued a draft report in July 2004, Technical and  Economic Assessment of Internet Protocol Version 6, that was based on  the response to their request for comment. Many organizations and  individuals—such as private sector software, hardware, and  communications firms, and technical experts—responded, providing their  views on the benefits and challenges of adopting the new protocol.
section_title: IPv6 Key Characteristics Increase Address Space, Improve Functionality, Ease Network Administration, and Enhance Security
paragraphs: The key characteristics of IPv6 include  a dramatic increase in IP address space,  a simplified IP header for flexibility and functionality,  improved routing of data,  improved quality of service, and  integrated Internet protocol security.
These key characteristics of IPv6 offer various enhancements relative to  IPv4 and are expected to increase Internet services and enable advanced  Internet communications that could foster new software applications for  federal agencies.
subsections: section_title: IPv6 Dramatically Increases Address Space
paragraphs: IPv6 dramatically increases the amount of IP address space available from  the approximately 4.3 billion addresses in IPv4 to approximately 3.4 × 10IPv6 addresses are characterized by a network prefix that describes the  location of an IPv6-capable device in a network and an interface ID that  provides a unique identification number (ID) for the device. The network  prefix will change based on the user’s location in a network, while the  interface ID can remain static. The static interface ID allows a device with a  unique address to maintain a consistent identity despite its location in a  network. In IPv4, the limited address space has resulted in a plethora of  network address translation devices, which severely limits the possibilities  for end-to-end communications. In contrast, the massive address space  available in IPv6 will allow virtually any device to be assigned a globally  reachable address. This change fosters greater end-to-end communication  abilities between devices with unique IP addresses and can better support  the delivery of data-rich content such as voice and video.
section_title: Simplified Header Intended to Promote Flexibility and Functionality
paragraphs: Simplifying the IPv6 header promotes flexibility and functionality for two  reasons. First, the header size is fixed in IPv6. In the previous version,  header sizes could vary, which could slow routing of information. Second,  the structure of the header itself has been simplified. While the IPv6  addresses are significantly larger than in IPv4, the header containing the  address and other information about the data being transmitted has been  simplified. The 14 header fields from IPv4 have been simplified to 8 fields in  IPv6. Figure 5 illustrates the differences between the two IP headers,  including the various data fields that were eliminated, renamed, or  reorganized.
Another benefit of the simplified header is its ability to accommodate new  features, or extensions. For example, the next header field provides  instructions to the routers transmitting the data across the Internet about  how to manage the information.
section_title: Improved Routing Offers More Efficient Movement of Information
paragraphs: The improved routing, or movement of information from a source to a  destination, is more efficient in IPv6 because it incorporates a hierarchal  addressing structure and has a simplified header. The large amount of  address space allows organizations with large numbers of employees to  obtain blocks of contiguous address space. Contiguous address space  allows organizations to aggregate addresses under one prefix for  identification on the Internet. This structured approach to addressing  reduces the amount of information Internet routers must maintain and  store and promotes faster routing of data. In addition, as shown in figure 5,  IPv6 has a simplified header because of the elimination of six fields from  the IPv4 header. The simplified header also contributes to faster routing.
section_title: Enhanced Mobility Features Provide Seamless Connectivity
paragraphs: IPv6 improves mobility features by allowing each device (wired or  wireless) to have a unique IP address independent of its current point of  attachment to the Internet. As previously discussed, the IPv6 address  allows computers and other devices to have a static interface ID. The  interface ID does not change as the device transitions among various  networks. This enables mobile IPv6 users to move from network to  network while keeping the same unique IP address. The ability to maintain  a constant IP address while switching networks is cited as a key factor for  the success of a number of evolving capabilities, such as evolving  telephone technologies, personal digital assistants, laptop computers, and  automobiles.
section_title: Enhanced Configuration Capabilities Can Ease Aspects of Network Administration
paragraphs: IPv6 enhancements can ease difficult and time-consuming aspects of  network administration tasks in today’s IPv4 networks. For example, two  new configuration enhancements of IPv6 include automatic address  configuration and neighbor discovery. These enhancements may reduce  network administration burdens by providing the ability to more easily  deploy and manage networks.
IPv6 supports two types of automatic configuration: stateful and stateless.  Stateful configuration uses the dynamic host configuration protocol. This  stateful configuration requires another computer, such as a server, to  reconfigure or assign numbers to network devices for routing of  information, which is similar to how IPv4 handles renumbering.
Stateless automatic configuration is a new feature in IPv6 and does not  require a separate dynamic host configuration protocol server as in IPv4.
Stateless configuration occurs automatically for routers and hosts. Another  configuration feature—neighbor discovery—enables hosts and routers to  determine the address of a neighbor or an adjacent computer or router.
Together, automatic configuration and neighbor discovery help support a  plug-and-play Internet deployment for many devices, such as cell phones,  wireless devices, and home appliances. These enhancements help reduce  the administrative burdens of network administrators by allowing the IPv6- enabled devices to automatically assign themselves IP addresses and find  compatible devices with which to communicate.
section_title: Enhanced Quality of Service Can Prioritize Information Delivery
paragraphs: IPv6’s enhanced quality of service feature can help prioritize the delivery of  information. The flow label is a new field in the IPv6 header. This field can  contain a label identifying or prioritizing a certain packet flow, such as a  video stream or a videoconference, and allows devices on the same path to  read the flow label and take appropriate action based on the label. For  example, IP audio and video services can be enhanced by the data in the  flow label because it ensures that all packets are sent to the appropriate  destination without significant delay or disruption.
section_title: Enhanced Integration of IP Security Can Assist in Data Protection
paragraphs: IP Security—a means of authenticating the sender and encrypting the  transmitted data—is better integrated into IPv6 than it was in IPv4. This  improved integration, which helps make IP Security easier to use, can help  support broader data protection efforts.
IP Security consists of two header extensions that can be used together or  separately to improve authentication and confidentiality of data being sent  via the Internet. The authentication extension header provides the receiver  with greater assurance of who sent the data. The encapsulating security  header provides confidentiality to messages using encrypted security  payload extension headers.
section_title: IPv6 Characteristics Can Contribute to More Advanced Communications and Applications
paragraphs: IPv6’s increased address space, functionality, flexibility, and security help  to support more advanced communications and software applications than  are thought to be possible with the current version of IP. For example, the  ability to assign an IP address to a wide range of devices beyond computers  creates many new possibilities for direct communication. While  applications that fully exploit IPv6 are still in development, industry  experts have identified various federal functions that might benefit from  IPv6-enabled applications:  Border security: could deploy wireless sensors with IPv6 to help provide  situational awareness about movements on the nation’s borders.
First responders: could exploit the hierarchal addressing of IPv6 to  promote interoperability and rapid network configuration in responding  to emergencies.
Public health and safety: could exploit IPv6 end-to-end communications  to deliver secure telemedicine applications and interactive diagnoses.
Information sharing: could benefit from various features of IPv6,  including securing data in end-to-end communications, quality of  service, and the extensibility of the header to accommodate new  functions.
section_title: IPv6 Considerations Include Significant Planning Efforts and Immediate Actions to Ensure Security
paragraphs: Key planning considerations for federal agencies include recognizing that  an IPv6 transition is already under way because IPv6-capable software and  equipment exist in agency networks. Other key considerations for federal  agencies to address in an IPv6 transition include significant IT planning  efforts and immediate actions to ensure the security of agency information  and networks. Important planning considerations include  developing inventories and assessing risks,  creating business cases for an IPv6 transition,  establishing policies and enforcement mechanisms,  identifying timelines and methods for the transition.
Furthermore, specific security risks could result from not managing IPv6  software and equipment in federal agency networks.
subsections: section_title: Recognizing That an IPv6 Transition Is Already Under Way for the Federal Government
paragraphs: The transition to IPv6 is under way for many federal agencies because their  networks already contain IPv6-capable software and equipment; for  example, most major operating systems currently support IPv6, including  Microsoft Windows, Apple OS X, Cisco IOS, mainframe software, and UNIX  variants including Sun Solaris and Linux. In addition, many routers,  printers, and other devices are now capable of being configured for IPv6  traffic.
The transition to IPv6 is different from a software upgrade because the  protocol’s capability is being integrated into the software and hardware. As  a result, agencies do not have to make a concerted effort to acquire it  because it will be built into agencies’ core communications infrastructure.  However, as IPv6-capable software and hardware accumulates in agency  networks, it can introduce risks that may not be immediately obvious to the  network administrators or program officials. For example, agency  employees might begin using certain IPv6 features that are not addressed in  agency security programs and could therefore inadvertently place agency  information at risk of disclosure.
section_title: Developing an Inventory and Risk Assessment
paragraphs: Developing an IPv6 inventory and risk assessment is an important action  for agencies to consider in addressing IPv6 decision making. An inventory  of equipment (software and hardware) provides management with an  understanding of the scope of an IPv6 transition occurring at the agency  and assists in focusing agency risk assessments.
Risk assessments are essential steps in determining what controls are  required to protect a network and what level of resources should be  expended on controls. Moreover, risk assessments contribute to the  development of effective security controls for information systems and  much of the information needed for the agency’s system security plans.  These assessments are even more important when transitioning to a new  technology such as IPv6. Knowing what risks there are and how to mitigate  them appropriately will lessen problems in the future.
section_title: Creating a Business Case for Transition
paragraphs: Creating a business case for transition to IPv6 is another important  consideration for agency management officials to address. A business case  usually identifies the organizational need for the system and provides a  clear statement of the high-level system goals. Best practices for IT  investment recommend that, prior to making any significant project  investment, information about the benefits and costs of the investment  should be analyzed and assessed in detail. One key aspect to consider while  drafting the business case for IPv6 is to understand how many devices an  agency wants to connect to the Internet. This will help in determining how  much IPv6 address space is needed for the agency. Within the business  case, it is crucial to include how the new technology will integrate with the  agency’s existing enterprise architecture.
section_title: Establishing Policies and Enforcement Mechanisms
paragraphs: Developing and establishing IPv6 transition policies and enforcement  mechanisms are important considerations for ensuring an efficient and  effective transition. For example, IPv6 policies can address  agency management of the IPv6 transition,  roles and responsibilities of key officials and program managers,  guidance on planning and investment,  authorization for using IPv6 features, and  configuration management requirements and monitoring efforts.
Further, because of the scope, complexities, and costs involved in an IPv6  transition, effective enforcement of agency IPv6 policies is an important  consideration for management officials. Enforcement considerations could  include  collaboration among the chief information officer and senior  contracting officials to ensure IPv6 issues are addressed in information  technology acquisitions in accordance with agency policy;  role definitions for the chief information officer, inspector general, and  program officials, to review current IPv6 capabilities in agency systems  and what, if any, future requirements might be needed; and  policies for configuration management methods, to ensure that agency  information and systems are not compromised because of improper  management of information technology and systems.
Without appropriate policies and effective enforcement mechanisms,  federal agencies could incur significant cost and security risks. As we have  previously reported, planning for system migration and security are often  problematic in federal agencies. IPv6 planning efforts and security  measures can be managed using the federal government’s existing  framework, which includes enterprise architecture, investment  management processes, and security policies, plans, and risk assessments.  The potential scope of an IPv6 transition makes development of robust  policies and enforcement mechanisms essential.
section_title: Determining IPv6 Costs
paragraphs: Considering the costs of IPv6 and estimating the impact on agency IT  investments can be challenging. Cost benefit analyses and return-on- investment calculations are the normal methods used to justify  investments. Initially, IPv6 may appear to have a minimal cost impact on  an organization because IPv6 functionality is being built into operating  systems and routers. However, the costs to upgrade existing software  applications so they can benefit from IPv6 functionality could be  significant. Additional costs to consider include  human capital costs associated with training,  operational costs of multiple IP environments,  existing IT infrastructure, and  timing of an IPv6 transition.
These costs can be managed through a gradual, rather than an accelerated,  transition process. For example, long-range planning can help to mitigate  costs and position an agency to benefit from IPv6’s characteristics and  applications. Early adopters of IPv6 have determined that transitioning can  be coordinated with an organization’s ongoing technical refreshments or  upgrades. Accordingly, agencies can ensure that IPv6 compatibility is  integrated into their IT contracts and acquisition process. Officials from  OMB’s Office of E-Government and Information Technology stated that  they recognize the challenges associated with determining cost and are  taking action. For example, OMB required federal agencies to submit the  following items by January 31, 2005:  an updated enterprise architecture documentation and a revised  Information Resource Management strategic plan to illustrate how IPv6  is being incorporated into the agency’s plans and  a joint memorandum from the agency’s chief information officer and  chief procurement official describing how the agency will address the  acquisition of technology with IPv6 as part of the life cycle of existing  investments.
During the year 2000 (Y2K) technology challenge, the federal government  amended the Federal Acquisition Regulation (FAR) and mandated that all  contracts for IT include a clause requiring the delivered systems or service  to be ready for the Y2K date change. This helped prevent the federal  government from procuring systems and services that might have been  obsolete or that required costly upgrades. Similarly, proactive integration  of IPv6 requirements into federal acquisition requirements can reduce the  costs and complexity of the IPv6 transition of the federal agencies and  ensure that federal applications are able to operate in an IPv6 environment  without costly upgrades.
section_title: Identifying Timelines and Methods for Transition
paragraphs: Identifying timelines and the various methods available to agencies for  transitioning to IPv6 are important management considerations. The  timeline can help keep transition efforts on schedule and can provide for  status updates to upper management. Having a timeline and transition  management strategy in place early is important to mitigating risks and  ensuring a successful transition to IPv6. Such timelines and process  management can help a federal agency determine when to authorize its  various component organizations to allow IPv6 traffic and features.
subsections: section_title: Dual Stack Networks
paragraphs: In a dual stack network, hosts and routers implement both IPv4 and IPv6.  Figure 6 depicts how dual stack networks can support both IPv4 and IPv6  services and applications during the transition period. Currently, dual stack  networks are the preferred mechanism for transitioning to IPv6.
section_title: Tunneling
paragraphs: Tunneling allows separate IPv6 networks to communicate via an IPv4  network. For example, for one type of tunneling method, IPv6 packets are  encapsulated by a border router, sent across an IPv4 network, and decoded  by a border router on the receiving IPv6 network. Figure 7 depicts the  tunneling process of IPv6 data inside an IPv4 network.
section_title: Translation
paragraphs: Translation allows networks using only IPv4 and networks using only IPv6  to communicate with each other by translating IPv6 packets to IPv4  packets. The use of a translator allows new systems to be deployed as IPv6  only, while older systems remain IPv4 only. While this method may result in  bottlenecks while packets are being translated, it can provide a high level  of interoperability.
These transition methods represent a few of the common approaches for  ensuring interoperability between IPv6 and IPv4 communications. They  can be used alone or in concert to enable communication among IPv4 and  IPv6 networks. However, while such techniques mitigate interoperability  challenges, in some instances, they may result in increased security risks if  not analyzed and managed.
section_title: IPv6 Creates New Opportunities for Network Abuse
paragraphs: As IPv6-capable software and devices accumulate in agency networks, they  could be abused by attackers if not managed properly. For example, IPv6 is  included in most computer operating systems and, if not enabled by  default, is easy for administrators to enable either intentionally or as an  unintentional byproduct of running a program. We tested two IPv6  features—automatic configuration and tunneling—and found that, if not  properly managed, they could present serious risks to federal agencies.
subsections: section_title: Automatic Configuration Can Facilitate Network Attacks If Not Managed
paragraphs: Automatic configuration can facilitate attacks because a rogue or  unauthorized router may reconfigure neighboring devices by assigning  them new addresses and routes. Once IPv6 is enabled, almost all operating  systems will automatically configure IPv6 addresses, and most will  automatically configure additional IPv6 addresses (including global ones)  and routes provided by IPv6 routers. For example, with IPv6 enabled, most  systems we tested would automatically accept IPv6 router advertisements.  This results in hosts automatically adding IPv6 addresses and routes. This  can be mitigated by the signing of router renumbering updates with IP  Security. We tested the security issues surrounding the automatic  configuration and found that, if a computer on the internal network had  turned IPv6 on, that computer could use IPv6 services on other systems  using IPv6 locally. This activity would not be seen by a typical IPv4 network  intrusion detection system, because it would only be looking for  anomalous or inappropriate IPv4 behavior and would not detect the IPv6  activity.
section_title: Tunneling Can Permit Unauthorized Traffic
paragraphs: As previously discussed, tunneling is a transition mechanism that allows  IPv6 packets to be sent between computers via IPv4 traffic. When IPv6  packets are tunneled through IPv4, they are invisible to typical network  intrusion detection systems and firewalls that are configured for IPv4  traffic but not for IPv6 traffic. As a result, intrusion detection systems and  firewalls configured for IPv4 may not identify or prevent tunneled traffic.  Once tunnels are established, traffic can penetrate the network undetected.  This can allow attackers to access agency information and resources that  are protected only by IPv4 filters and tools. Even worse, if a computer on  an internal network acted as an IPv6 router and was able to tunnel IPv6 to  the IPv4 Internet, other nearby machines could be automatically  configured with global IP addresses. As a result, internal agency  computers—never intended to directly provide services to other computers  on the Internet—are suddenly globally reachable and may lack the requisite  security for Internet-accessible hosts.
Although new tools are being developed, the security considerations  associated with an IPv6 transition make configuration management of  federal systems extremely important. We determined that common IPv6  tunneling techniques could be controlled by implementing best practices  for IPv4 security, specifically by tightening the firewalls to deny direct  outbound connections and by requiring proxies for allowed protocols and  ports. We also noted that tighter configuration management, including  restricting user privileges, could help control IPv6 usage by end hosts and  that network intrusion detection systems could be tuned to detect IPv6  traffic and common tunneling techniques.
section_title: US-CERT Issued a Security Alert for Federal Agencies
paragraphs: In April 2005, the United States Computer Emergency Response Team (US- CERT), located at the Department of Homeland Security, issued an IPv6  cyber security alert to federal agencies based on our testing and  discussions with DHS officials. The alert warned federal agencies that  unmanaged, or rogue, implementations of IPv6 present network  management security risks. Specifically, the US-CERT notice informed  agencies that some firewalls and network intrusion detection systems do  not provide IPv6 detection or filtering capability, and malicious users might  be able to tunnel IPv6 traffic through these security devices undetected.  US-CERT provides agencies with a series of short-term solutions, including  determining if firewalls and intrusion detection systems support IPv6  and implement additional IPv6 security measures and  identifying IPv6 devices and disabling if not necessary.
section_title: Progress Has Been Made at Defense but Is Lacking at Other Federal Agencies
paragraphs: Recognizing the importance of planning, DOD has made progress in  developing a business case, policies, a timeline, and methods for  transitioning to IPv6, but similar efforts at the majority of the other CFO  agencies are lacking. Despite these efforts, Defense still faces major  challenges in managing its transition to IPv6. The majority of the other CFO  agencies report they have not begun to address key transition planning  issues, such as developing plans, business cases, and estimating costs.
subsections: section_title: DOD Has Established a Business Case for Transitioning to IPv6
paragraphs: Defense’s transition to IPv6 is a key component of its business case to  improve interoperability among many information and weapons systems,  known as the Global Information Grid (GIG). The IPv6 component of GIG  is to facilitate DOD’s goal of achieving network-centric operations by  exploiting these key characteristics of IPv6:  enhanced quality of service, and  enhanced security features.
The increased address space provides DOD with an opportunity to  reconstitute its address space architecture to better address the future  proliferation of numerous unmanned sensors and mobile assets. Using this  architecture, the department plans to use IPv6 as part of the GIG. Although  no final decisions have been made, DOD could use the increased address  space to render a three-dimensional map of the globe, or theater of combat,  using IP addresses as coordinates. This, along with other GIG components,  would allow tracking movements of, and maintain detailed information on,  military vehicles and individual soldiers in real time.
Permitting devices to directly communicate on the move is essential,  because DOD wants to use the enhanced mobility and automatic  configuration to rapidly deploy networks across the globe. Further,  Defense believes that the return to an end-to-end communications security  model will allow it to provide greater information assurance by, among  other things, providing for more secure peer-to-peer communications.  Finally, Defense requires IPv6’s improved quality of service features to  enhance many of its other initiatives, such as voice over IP.
section_title: DOD Has Made Progress Developing Policies, a Timeline, and Methods for Transition
paragraphs: DOD’s efforts to develop policies, timelines, and methods for transitioning  to IPv6 are progressing. Some of the department’s efforts to transition to  IPv6 have been under way for approximately 10 years, including the  following:  In 1995, the Department of the Navy first began working with IPv6, and  subsequently deployed IPv6 test beds in 2000 and 2001.
In 1998, DOD began, along with our North Atlantic Treaty Organization  partners, joint action on IPv6-related issues.
In 2003, one of the Navy’s early test beds, the Defense Research and  Engineering Network, was selected to be the overall DOD IPv6 pilot.
In 2003, the Office of the DOD Chief Information Officer issued a  mandate that, as of October 2003, all assets developed, procured, or  acquired must be IPv6-capable and, in addition, the assets must  maintain interoperability with IPv4 systems capabilities.
In 2004, Defense established an IPv6 transition office to provide the  overall coordination, common engineering solutions, and technical  guidance across the department to support an integrated and coherent  transition to IPv6.
subsections: section_title: IPv6 Transition Office Performs Central Role in Coordination of Transition Planning
paragraphs: DOD’s Transition Office performs a central role in coordination of IPv6  planning, including developing detailed guidance and policies for  implementing schedules and designs for DOD. This guidance includes  deriving departmentwide requirements, technical guidance—including  IPv6 addressing—transition techniques, network architecture guidance,  and applications development guidance. While the Transition Office  provides the overall planning framework, the accountability for the actual  transition resides within each of the individual services and defense  agencies. These DOD components are to use the core planning guidance,  time frames, and metrics that the Transition Office develops within their  respective transition models.
The Transition Office, under the authority of the Defense Information  Systems Agency, is in the early stages of its work and has developed an  early set of work products, including a draft system engineering  management plan, risk management planning documentation, budgetary  documentation, requirements criteria, and a master schedule. The  management schedule includes a set of implementation milestones that  include DOD’s goal of transitioning to IPv6 by fiscal year 2008. A senior  Transition Office official stated that the department plans to develop an  end-to-end communications security model by fiscal year 2008 as well.
In addition to its internal IPv6 coordination-related activities, the  Transition Office has built relationships with other federal agencies, North  Atlantic Treaty Organization partners and coalition allies, IETF, and  academic institutions, and is currently working with the American Registry  of Internet numbers to allocate the requisite IPv6 address space for the  department.
In parallel with the Transition Office’s efforts, the Office of the DOD Chief  Information Officer has created a transition plan that includes sections on  transition governance, acquisition and procurement, transition tasks and  milestones, and program and budget. The Chief Information Officer has  responsibility for ensuring a coherent and timely transition, establishing  and maintaining the overall departmental transition plan, and is the final  approval authority for any IPv6 transition waivers. Other key players in the  department’s transition are the Defense Information Systems Agency, Joint  Forces Command, the National Security Agency, and the Defense  Intelligence Agency.
section_title: DOD IPv6 Efforts Face Challenges
paragraphs: Although DOD has made substantial progress in developing a planning  framework for transitioning to IPv6, it still faces challenges, including  developing an inventory of GIG systems that have IPv6-capable software   finalizing its IPv6 transition plans,  monitoring its operational networks for unauthorized IPv6 traffic, and  developing a comprehensive enforcement strategy, including leveraging  its existing budgetary and acquisition review process.
According to DOD officials, the department recognizes the need to monitor  IPv6 traffic and has taken steps to minimize this risk. For example, it has  established policies addressing IPv6 use in an operational environment.
section_title: Majority of Federal Agencies Have Not Initiated Transition Planning Efforts
paragraphs: Unlike DOD, the majority of other federal agencies reporting have not yet  initiated transition planning efforts for IPv6. For example, of the 22  agencies that responded, only 4 agencies reported having established a  date or goal for transitioning to IPv6. The majority of agencies have not  addressed key planning considerations (see table 1). For example,  22 agencies report not having developed a business case,  21 agencies report not having plans,  19 agencies report not having inventoried their IPv6-capable equipment,   22 agencies report not having estimated costs.
section_title: Conclusions
paragraphs: The increase in IPv6 address space and the other new features of the  protocol are designed to promote flexibility, functionality, and security in  networks. IPv6 can facilitate the development of a variety of new  applications that take advantage of the end-to-end communications it  provides. Through the use of IPv6 and associated new applications, federal  agencies can have new ways of delivering business service and conducting  operations.
Nevertheless, transitioning to IPv6 presents federal agencies with  challenges, including addressing key planning considerations and taking  immediate actions to ensure the security of agency information and  networks. By recognizing that an IPv6 transition is under way, agencies can  begin developing risk assessments, business cases, policies, cost estimates,  timelines, and methods for the transition. If agencies do not address these  key planning issues and seek to understand the potential scope and  complexities of IPv6 issues—whether agencies plan to transition  immediately or not—they will face potentially increased costs and security  risks. For example, if federal contracts for IT systems and services do not  require IPv6 compatibility, agencies may need to make costly upgrades.  Finally, if not managed, existing IPv6 features in agency networks can be  abused by attackers who have access to federal information and resources  without being detected. Undetected penetrations of federal networks can  have far-reaching impacts on the security of both information and the  operations it supports.
Transitioning to IPv6 is a pervasive challenge for federal agencies that  could result in significant benefits to agency services. But such benefits  may not be realized if action is not taken to ensure that agencies are  addressing the attendant challenges. Recognizing the importance of  planning, DOD has made progress addressing some key planning  considerations, but still faces challenges. However, the vast majority of  federal agencies have not yet started this process. If their respective  progress is not monitored closely, it could result in significant costs for the  federal government.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Director of OMB take the following two actions: 1.
Instruct federal agencies to begin addressing key IPv6 planning  considerations, including  developing inventories and assessing risks,  creating business cases for the IPv6 transition,  establishing policies and enforcement mechanisms,  identifying timelines and methods for transition, as appropriate. 2. Amend the Federal Acquisition Regulation with specific language that  requires that all information technology systems and applications  purchased by the federal government be able to operate in an IPv6  environment.
Because of the immediate risk that poorly configured and unmanaged IPv6  capabilities present to federal agency networks, we are recommending that  agency heads take immediate actions to address the near-term security  risks, including determining what IPv6 capabilities they may have, and  initiate steps to ensure that they can control and monitor IPv6 traffic.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOD, Commerce, and OMB for review  and comment. In providing oral comments, officials from DOD’s IPv6  Transition Office,  Commerce’s National Institute of Standards and  Technology, and OMB’s Offices of Information and Regulatory Affairs and  General Counsel generally agreed with the contents of the report and  provided technical corrections, which we incorporated, as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to interested congressional  committees; the Director, Office of Management and Budget; and the heads  of all major departments and agencies. Copies of this report will be made  available to others on request. In addition, the report will be available at no  charge on GAO’s Web site at http://www.gao.gov.
If you have any questions about this report, please contact David Powner at  (202) 512-9286, or pownerd@gao.gov; Keith Rhodes at (202) 512-6412, or  rhodesk@gao.gov; or J. Paul Nicholas at (202) 512-4457, or  nicholasj@gao.gov. Major contributors to this report are listed in  appendix II.
section_title: Objectives, Scope, and Methodology
paragraphs: The objectives of our review were to  describe the key characteristics of Internet Protocol version 6 (IPv6);  identify the key planning considerations for federal agencies in  transitioning to IPv6; and  determine the progress made by the Department of Defense (DOD) and  other major federal agencies to transition to IPv6.
For our first two objectives, the scope included the Department of  Commerce, the Office of Management and Budget, and various federal and  nonfederal technical experts. For our third objective, we focused on DOD  and the other 23 major federal departments and agencies.
To describe the key characteristics of IPv6 and identify the key  considerations for the federal agencies in transitioning to IPv6, we  researched and analyzed technical documents and gathered data from IPv6  experts in government and industry. Specifically, we reviewed a number of  key documents and text, including IPv6-related documents from the  Internet Engineering Task Force, technical papers on IPv6 capabilities and  security issues, the President’s National Strategy to Secure Cyberspace,  and responses to the Department of Commerce’s request for comment on  the IPv6 transition. In addition, we documented IPv6 characteristics and  transition considerations with officials from the National Institute of  Standards and Technology, the National Telecommunication and  Information Administration, the chief technical officer of the IPv6 Forum, a  co-author of the TCP/IP protocol suite, key members of the  telecommunications industry, members of the Internet Engineering Task  Force and Internet Society, and officials from major software and hardware  vendors. Further, we conducted computer security tests using our lab to  identify potential IPv6 security challenges, including testing stateful packet  filtering firewalls, network intrusion detection systems, and hosts  representing a variety of operating systems, including Windows XP/2003,  Sun Solaris, Linux variants, and IBM z/OS. We used IPv4 firewall rules that  “default deny all” inbound and “default permit all” outbound, and network  intrusion detection systems with default signatures.
To determine the progress made by DOD and other relevant federal  agencies to transition to IPv6, we analyzed DOD’s IPv6 transition plans,  guidelines, and transition schedule. In addition, we met with the Office of  the DOD Chief Information Officer, members of the DOD IPv6 Transition  Office, and the Defense Information Systems Agency, and reviewed  transition challenges and approaches being undertaken by DOD. We also  surveyed the other 23 chief financial officer agencies to determine the  extent to which they had established a transition date for converting to  IPv6; developed IPv6 business cases or transition plans; estimated costs or  allocated money for the transition; and identified resource challenges.
We performed our work from August 2004 through April 2005 in  accordance with generally accepted government auditing standards.
section_title: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: Camille Chaires, West Coile, Jamey Collins, John Dale, Neil Doherty, Nancy  Glover, Richard Hung, Hal Lewis, Harold Podell, David Plocher, and Eric  Winter made key contributions to this report.