6/19/2007 -- It looks as if the federal sector is on the cusp of an IPv6 revolution of sorts. Even better, IPv6 deployments could lead to security improvements -- if federal agencies rise to the challenge, of course.

"Because many agencies will be operating in dual-mode during the transition, they will need to configure and support both their IPv4 and IPv6 networks at the same time," said Shawn McCarthy, director of government vendor programs with International Data Corp.'s (IDC) Government Insights subsidiary. "If firewalls or intrusion detection systems are not properly configured to recognize IPv6 traffic, IP packet-switching networks can be exploited to deliver malicious software, or malware. Such configuration should be supervised at an enterprise level, but many agencies are not set up for that at the moment."

According to IDC, as agencies take a "true risk" management approach to addressing security vulnerabilities, the security risk posed by dual-mode configurations will force them to deploy enterprise-wide configuration management tools. As a result, the IDC report said, agencies should not only make security automation software part of their IPv6 network transition plan, but use this software to set and monitor configuration settings.

IDC also predicted a change to the existing, largely from-the-hip status quo, in which individual federal agencies take a piecemeal approach to improving security efforts.

"By standardizing and enforcing security configurations and managing access controls across multiple systems, government agencies will not only address the IPv6 issue, but also simultaneously address multiple other network security shortcomings such as patch management, software programming, interface requirements and monitoring configuration settings for accidental or malicious changes," McCarthy wrote.

At the very least, federal agencies should be aware of what's at stake, McCarthy concluded: "On the other hand, if the security issues of dual-mode are ignored, then the government's IPv6 transition will become an even larger enterprise-wide security headache." --Stephen Swoyer