The Internet is a worldwide network of networks made up of servers, routers, and backbone networks. To send a communication from one computer to another, a series of addresses is attached to information sent from the first computer to route the information to its final destination. The protocol that guides the administration of the routing addresses is the Internet protocol. The most widely deployed version of IP is version 4 (IPv4). The two basic functions of IP include (1) addressing and (2) fragmentation of data, so that information can move across networks. An IP address consists of a fixed sequence of numbers. IPv4 uses a 32-bit address format, which provides approximately 4.3 billion unique IP addresses. By providing a numerical description of the location of networked computers, addresses distinguish one computer from another on the Internet. In some ways, an IP address is like a physical street address. For example, if a letter is going to be sent from one location to another, the contents of the letter must be placed in an envelope that provides addresses for the sender and receiver. Similarly, if data are to be transmitted across the Internet from a source to a destination, IP addresses must be placed in an IP header. Figure 1 is a simplified illustration of this concept. In addition to containing the addresses of sender and receiver, the header also contains a series of fields that provide information about what is being transmitted. Limited IPv4 address space prompted organizations that need large numbers of IP addresses to implement technical solutions to compensate. For example, network administrators began to use one unique IP address to represent a large number of users. In other words, to the outside world, all computers behind a device known as a network address translation router appear to have the same address. While this method has enabled organizations to compensate for the limited number of globally unique IP addresses available with IPv4, the resulting network structure has eliminated the original end-to-end communications model of the Internet. Because of the limitations of IPv4, in 1994 the Internet Engineering Task Force (IETF) began reviewing proposals for a successor to IPv4 that would increase IP address space and simplify routing. The IETF established a working group to be specifically responsible for developing the specifications and standardization of IPv6. Over the past 10 years, IPv6 has evolved into a mature standard. A complete list of the IPv6 documents can be found at the IETF Web site. Interest in IPv6 is gaining momentum around the world, particularly in parts of the world that have limited IPv4 address space to meet their industry and consumer communications needs. Regions that have limited IPv4 address space, such as Asia and Europe, have undertaken efforts to develop, test, and implement IPv6 deployments. As a region, Asia controls only about 9 percent of the allocated IPv4 addresses, and yet has more than half of the world’s population. As a result, the region is investing in IPv6 development, testing, and implementation. For example, the Japanese government’s e-Japan Priority Policy Program mandated the incorporation of IPv6 and set a deadline of 2005 to upgrade existing systems in both the public and private sectors. The government has helped to support the establishment of an IPv6 Promotion Council to facilitate issues related to development and deployment and is providing tax incentives to promote deployment. In addition, major Japanese corporations in the communications and consumer electronics sectors are also developing IPv6 networks and products. Further, the Chinese government has reportedly set aside approximately $170 million to develop an IPv6-capable infrastructure. The European Commission initiated a task force in April 2001 to design an IPv6 Roadmap. The Roadmap serves as an update and plan of action for development and future perspectives. It also serves as a way to coordinate European efforts for developing, testing, and deploying IPv6. Europe currently has a task force that has the dual mandate of initiating country/regional IPv6 task forces across European states and seeking global cooperation around the world. Europe’s Task Force and the Japanese IPv6 Promotion Council forged an alliance to foster worldwide deployment. The key characteristics of IPv6 are designed to increase address space, promote flexibility and functionality, and enhance security. For example, IPv6 dramatically increases the amount of IP address space available from the approximately 4.3 billion in IPv4 to approximately 3.4 × 10This large number of IPv6 addresses means that almost any electronic device can have its own address. While IP addresses are commonly associated with computers, they are increasingly being assigned to other items such as cellular phones, consumer electronics, and automobiles. In contrast to IPv4, the massive address space available in IPv6 will allow virtually any device to be assigned a globally reachable address. This change fosters greater end-to-end communications between devices with unique IP addresses and can better support the delivery of data-rich content such as voice and video. In addition to the increased number of addresses, IPv6 improves the routing of data, provides mobility features for wireless, and eases automatic configuration capabilities for network administration, quality of service, and security. These characteristics are expected to enable advanced Internet communications and foster new software applications. While applications that fully exploit IPv6 are still in development, industry experts have identified various federal functions that might benefit from IPv6-enabled applications, such as border security, first responders, public health, and information sharing. The transition to IPv6 is under way for many federal agencies because their networks already contain IPv6-capable software and equipment. For example, most major operating systems, printers, and routers currently support IPv6. Therefore, it is important for agencies to note that the transition to IPv6 is different from a software upgrade because, when it is installed, its capability is also being integrated into the software and hardware. Besides recognizing that an IPv6 transition is already under way, other key considerations for federal agencies to address in an IPv6 transition include significant IT planning efforts and immediate actions to ensure the security of agency information and networks. Important planning considerations include the following: ● Developing inventories and assessing risks—An inventory of equipment (software and hardware) provides management with an understanding of the scope of an IPv6 transition and assists in focusing agency risk assessments. These assessments are essential steps in determining what controls are required to protect a network and what level of resources should be expended on controls. ● Creating business cases for an IPv6 transition—A business case usually identifies the organizational need for the system and provides a clear statement of the high-level system goals. One key aspect to consider while drafting the business case for IPv6 is to understand how many devices an agency wants to connect to the Internet. This will help in determining how much IPv6 address space is needed for the agency. Within the business case, it is crucial to include how the new technology will integrate with the agency’s existing enterprise architecture. ● Establishing policies and enforcement mechanisms—Developing and establishing IPv6 transition policies and enforcement mechanisms are important considerations for ensuring an efficient and effective transition. Furthermore, because of the scope, complexities, and costs involved in an IPv6 transition, effective enforcement of agency IPv6 policies is an important consideration for management officials. ● Determining the costs—Cost benefit analyses and return-on- investment calculations can be used to justify investments. During the year 2000 (Y2K) technology challenge, the federal government amended the Federal Acquisition Regulation and mandated that all contracts for information technology include a clause requiring the delivered systems or service to be ready for the Y2K date change. This helped prevent the federal government from procuring systems and services that might have been obsolete or that required costly upgrades. Similarly, proactive integration of IPv6 requirements into federal acquisition requirements can reduce the costs and complexity of the IPv6 transition of federal agencies and ensure that federal applications are able to operate in an IPv6 environment without costly upgrades. ● Identifying timelines and methods for the transition—Timelines and process management can assist a federal agency in determining when to authorize its various component organizations to allow IPv6 traffic and features. Additionally, agencies can benefit from understanding the different types of transition methods or approaches that can allow them to use both IPv4 and IPv6 without causing significant interruptions in network services. As IPv6-capable software and devices accumulate in agency networks, they could be abused by attackers if not managed properly. For example, IPv6 is included in most computer operating systems and, if not enabled by default, is easy for administrators to enable either intentionally or as an unintentional byproduct of running a program. We tested IPv6 features and found that, if firewalls and intrusion detection systems are not appropriately configured, IPv6 traffic may not be detected or controlled, leaving systems vulnerable to attacks by malicious hackers. Further, in April 2005, the United States Computer Emergency Response Team (US-CERT), located at the Department of Homeland Security (DHS), issued an IPv6 cyber security alert to federal agencies based on our IPv6 test scenarios and discussions with DHS officials. The alert warned federal agencies that unmanaged or rogue implementations of IPv6 present network management security risks. Specifically, the US-CERT notice informed agencies that some firewalls and network intrusion detection systems do not provide IPv6 detection or filtering capability and that malicious users might be able to tunnel IPv6 traffic through these security devices undetected. Further, one feature of IPv6, known as automatic configuration (where a device that is IPv6 enabled will derive its own IP address from neighboring routers without an administrator’s intervention), could allow devices to automatically configure themselves with an IPv6 address without authorization. US-CERT provided agencies with a series of short-term solutions including ● determining if firewalls and intrusion detection system products support IPv6 and implement additional IPv6 security measures and identifying IPv6 devices and disabling if not necessary. The Department of Defense’s transition to IPv6 is a key component of its business case to improve interoperability among many information and weapons systems, known as the Global Information Grid (GIG).