Adopting and Enforcing an IPv6-Only Policy: If Not Now, When?

Charles Sun

As the next-generation Internet Protocol, IPv6 (Internet Protocol version 6) is the prerequisite for the future growth and development of the Internet. In the era of artificial intelligence (AI), 5G, and Internet of Things (IoT), there are increasingly more and more innovations and emerging technologies that will be heavily relying on the support of the Internet, which is currently running in the so-called dual-stack of mode operations using both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6). Moreover, adopting and enforcing the IPv6-only policy worldwide by securely deploying the single stack of IPv6, turning off IPv4, and setting a specific deadline to sunset IPv4 completely, will dramatically reduce the overall cybersecurity threats and attacks based on IPv4.

Therefore, the IPv6-only policy is not only the most effective and efficient approach to protect and defend our new cyber frontier but also the best weapon we have in cyber warfare. Here are the reasons why:

First, despite hundreds of billions of dollars are spent globally each year on cybersecurity, organizations worldwide, big or small, are still struggling around the clock every single day to deal with constant cyberattacks and data breaches, most of which are based on the current predominate version of Internet Protocol - IPv4. This seems to be a losing battle that one can hardly see the light at the end of the tunnel anytime soon, let alone gain an upper hand in the fight.

In 2018, for instance, there were more than 41,600 security incidents reported and over 2,000 confirmed data breaches worldwide, notwithstanding we spent more than $114 billion worldwide in 2018 on cybersecurity. In other words, there were more than 114 reported security incidents on average every day in 2018, approximately six of which were confirmed data breaches, costing the global economy more than $1.5 trillion with over $2,900,000 being lost to cybercrime every minute! One related report predicts that cybercrime will cost the world over $6 trillion annually by 2021. Meanwhile, a study in 2019 predicted that global spending on cybersecurity products and services would exceed $1 trillion cumulatively over the five years from 2017 to 2021. A similar study estimated that worldwide spending on information security-related products and services reached over $124 billion in 2019 alone with an increase of more than 141 percent since 2010. According to one of the Gartner’s forecast analyses, the global information security market will reach $170.4 billion in 2022.

Second, the situation can only get worse in a few more years when the IPv6 adoption rate will reach 100 percent running in parallel with IPv4, effectively doubling the overall attack vectors. According to one estimate, based on the current trend the global IPv6 adoption rate will reach 100 percent in 2028.

Based on the latest Internet Society’s State of IPv6 Deployment 2018 report, worldwide IPv6 deployment has increased dramatically since 2012. For instance, in 2018 more than 80 percent of smartphones in the US already used IPv6, and the mobile wireless carriers are rapidly becoming an IPv6-only market with 93.69% of T-Mobile USA mobile users already using IPv6. Furthermore, many companies including Facebook, Google, Microsoft, are adopting an IPv6-only policy by turning off IPv4 internally within their enterprises.

Consequently, the federal government also seems ready to resume its leadership role in driving the IPv6 adoption across all federal agencies. The Department of Defense (DOD), for example, after many years of missing in action, finally restarted the effort to deploy very aggressively IPv6 across all of its components based on the recently published DOD CIO memo on IPv6, which in turn will undoubtedly have a huge influence on the creation of a new federal policy on IPv6 deployment across all federal agencies. The impact of such a new federal IPv6 policy on both the public and private sectors cannot be underestimated.

                                           

Third, adopting an IPv6-only policy to securely deploy the single stack of IPv6 globally and to sunset IPv4 will dramatically reduce the overall cybersecurity threats and attacks based on IPv4! It is a material fact that we will immediately achieve a 100 percent reduction of all current global cyberattacks and cybersecurity threats based on IPv4 the moment we turn off IPv4. We will also immediately achieve more than 50 percent reduction globally of the overall cyberattacks based on IPv4 and IPv6 separately, and the combination of both collectively.

Consequently, we must change our cybersecurity strategy dramatically right now to efficiently secure and effectively defend the global cyberinfrastructure before the time is running out. Our whole paradigm of cybersecurity and cyber defense policy must be completely shifted to focus on securely deploying the single stack of IPv6 worldwide instead of running and supporting both IPv4 and IPv6 simultaneously, engaging the enemies in two separate battlegrounds concurrently, fighting two separate wars with limited resources. We should and must utilize all of our global resources wisely and concentrate on fighting and winning only one war! The IPv6-only policy is not only the best weapon we have in cyber warfare but also our last chance to effectively protect the cyberspace and efficiently defend our new digital frontier.

Now it is high time to create and enforce an IPv6-only policy worldwide by turning off IPv4 and set a specific deadline to sunset IPv4 globally.

It is not a question as to whether or not we should adopt and enforce an IPv6-only policy by turning off and sunsetting IPv4, but rather a question that we all must ask: if not now, when?!

Disclaimer: The views presented are only personal opinions and they do not necessarily represent those of the U.S. Government.

Reference for this article:

Sun, Charles. “Adopting and Enforcing an IPv6-Only Policy: If Not Now, When?” Homeland Security Today. 11 February 2020.

https://www.hstoday.us/subject-matter-areas/cybersecurity/adopting-and-enforcing-an-ipv6-only-policy-if-not-now-when/

https://www.linkedin.com/pulse/adopting-enforcing-ipv6-only-policy-now-when-charles-sun

https://ipv6czar.blogspot.com/2020/02/adopting-and-enforcing-ipv6-only-policy_94.html

#cybersecurity #cyberattacks #cybersecuritythreats #cloudsecurity #cyber #ipv4 #ipv6 #ai #iot #5g #ipv6only #internetofthefuture

IoT Is the Ultimate Driver for Global Adoption of IPv6!

Since my recent article entitled “No IoT without IPv6” published by Computerworld, many people have provided very good feedback and comments. They also have asked a very good question: Why we are still talking about adopting IPv6 after so many years? It has been more than a decade since the U. S. government first formally requested federal agencies to adopt IPv6 and incorporate it in their enterprise architecture (EA) as stated in the 2005 OMB Memo; and it has been more than two decades since many people first started talking about the need to transition to IPv6.

Obviously, there are many reasons for the delays of IPv6 adoption worldwide. On one hand, as I commented previously in some of my online postings, changes are always difficult and many people simply don't like change. A lot of people also consider that IPv6 is boring because it is related to the network infrastructure.

On the other hand, many people don't understand it or simply don't care about it because, at the end of the day, IPv6 is a technical matter. For instance, IPv6 as part of the internet-layered protocols, is often, but not always, considered roughly as a subset of the Network Layer of the ISO OSI model. Not many people outside of the networking infrastructure or similar domains are familiar with it or care enough about it.

To make things even more unnecessarily complicated, while some people with non-technical background would like to constantly drag such a technical issue into the messy geopolitical discussions and debates in the international forums, many people involved with the research of IoT do not even think that they will ever need to use IPv6 or IP at all, because they are only focusing on different layers of the OSI model in their specific part of the world. Some individuals even think that they can deploy IoT using IPv4 and NAT.

In addition, the message on this technical issue must be clear, precise, and consistent, and it must be easy for the non-technical people to understand. However, that is not always the case. In my opinion, for far too many years, this technical issue of transitioning to IPv6 from IPv4 has become way too complicated, whether intentionally by some people or not.

As I wrote in an article last year entitled “IPv6, It's Easier Than You Think!”, ultimately, enabling IPv6 is only a configuration change to the existing networking infrastructure! This is especially true when we only enable the IPv6 in a dual-stack mode of operations (using both IPv6 and IPv4) where there is NO impact on the existing IPv4 functions or operations during the transition period.

It cannot be more clear and simple than that. Consequently, one should ask: when was the last time that the Board of Directors or the president of a company has to decide and approve an IT configuration change request for its network infrastructure, which not only does not impact its current IPv4 operations, but also is completely transparent to the end users?

In the final analysis, however, money is still one of the main reasons that have hindered the global IPv6 adoption so far. In many cases, at least as in the past, adopting and deploying IPv6 not only does not immediately generate revenue, but cost money: It needs money to train the engineers and IT staff about IPv6; it costs money to upgrade the existing network infrastructure and systems to enable IPv6 if they are dated; it doesn't provide the immediate ROI. For many companies, it doesn't help with the short-term share prices or meet the Wall Street expectations for the quarterly earnings and revenues in the short run...

As a result, there has been no particular incentive for many companies, especially for those companies in the networking and security business, such as network hardware manufactures and software application companies, to invest in R&D to fully support IPv6 and to ensure that all of their current products and services will support the full feature set of IPv6 as much as they would for IPv4.

If the major networking manufacturers and security companies cannot ensure that all of their current products and services will fully support IPv6, it will undoubtedly prevent the customers from deploying IPv6 easily and smoothly even if they want to. If the current security appliances and software cannot fully support IPv6, how can you expect the customers to fully adopt IPv6 without the fear that their IPv6 deployment may not be secured or at least as secured as the current IPv4 products and services, even though the level of security in IPv4 is still questionable given what is happening on a daily basis in cybersecurity breaches nowadays?

This all comes down to the point as I mentioned in my article that adopting IPv6 requires long term vision and leadership from the top management of the companies. They must realize that adopting IPv6 is a competitive edge for their companies as well as for their shareholders in the long run, especially in the global context.

Most importantly, the whole concept is simple, the goal is clear, the scope of the task is precise, and it is worth repeating here again:

Adopting and deploying the new Internet Protocol version 6 (IPv6) is only a configuration change to the existing IT infrastructure. 

By enabling a separate IPv6 stack in the current IPv4 computing environment (dual-stack) during the transition period, it will not impact the existing IPv4 functions or operations.

If we can all communicate consistently and precisely this idea to the non-technical stakeholders as well as the regular Internet users, I am confident that many people will be able to comprehend this issue and eventually be supportive of this global initiative.

The good news is that for the past a few years, especially for the past year or two, many companies started to realize the potential huge impact of IoT on their bottom line. After all, IoT represents at least several trillion dollars’ new business opportunities for many companies around the world.

That is why we have seen that worldwide IPv6 traffic have increased rather significantly since 2014 based on some of the IPv6 indicators, such as the information provided by Google – from less than 3% in 2014 to over 11% in May 2016.

It is for this reason that over two years’ ago I stated in my opinion article published by Computerworld on May 1, 2014 that “To a large extent, the Internet of Things will be the ultimate driver of global adoption of IPv6 in the coming years.”

Today, I still strongly believe that IoT will be the ultimate driver for global adoption of IPv6 for the very same reason, just as passionate as I was two years ago.

Only time will tell and history will be the judge.


Reference for this article:

Sun, Charles. “IoT Is the Ultimate Driver for Global Adoption of IPv6!”. 2 June 2016. https://ipv6czar.blogspot.com/2016/06/iot-is-ultimate-driver-for-global.html

Disclaimer: The views presented are only personal opinions and they do not necessarily represent those of the U.S. Government.

No IoT without IPv6

By Charles Sun 

Does your company foresee making big bucks from the Internet of Things? It won’t be happening without widespread adoption of IPv6 first.

Do you think the Internet of Things (IoT) will be the Next Big Thing? It can’t be. Not until we get past the real Next Big Thing: IPv6.

Without the extensive global adoption and successful deployment of IPv6 as the primary version of the Internet Protocol, the IoT won’t be possible. In fact, the future of the Internet itself is at stake.

For the complete text of the original article published by Computerworld and republished by CXO Media Inc., NetworkWorld, ITWorld, etc. on May 19, 2016, please refer to the following links:

1.      http://www.computerworld.com/article/3071625/internet-of-things/no-iot-without-ipv6.html

2.      https://www.computerworld.com.au/article/600153/no-iot-without-ipv6/

3.      http://www.cio.com/article/3072499/internet-of-things/no-iot-without-ipv6.html

4.      http://www.cio.com.au/article/600153/no-iot-without-ipv6/

5.      http://www.networkworld.com/article/3072855/internet-of-things/no-iot-without-ipv6.html

6.      http://www.itworld.com/article/3071625/internet-of-things/no-iot-without-ipv6.html

Reference for this article:

Sun, Charles. “No IoT without IPv6.” Computerworld. 19 May 2016.

Sun, Charles. “No IoT without IPv6.” CIO. 19 May 2016.