A year ago the world celebrated World IPv6 Launch Day, which was supposed to be the day IPv6 was activated by major Web operators and service providers.

At the time of the launch, there were concerns about whether or not IPv6 was a security risk. As it turns out, at least one high-profile network has been attacked over IPv6 in the past year.







New IPv6 Security Approaches

Prince noted that it's important for companies of all sizes to start to take IPv6 security into account, as it is likely to emerge as a new attack vector. As such, it's important to make sure security solutions have capabilities in place to handle IPv6 attacks.

Instead of relying on blacklisting IP addresses, CloudFlare has  built its own software stack that looks at more than just the addresses.

"We're trying to build a reputation engine about everything we know about a particular user, and that includes an IP address as well as the subnet, the origination and the target destination," Prince said. "All of that provides us with a score that helps us to access what the risk is from a particular visitor."

The idea being that by having more intelligence on a given connection, an appropriate decision on routing can be made. If the reputation of a given connection is considered to be a risk, Prince said CloudFlare will increase the friction against the connection before it can connect to a site on the CloudFlare platform.

Prince also noted that in one respect, IPv6 will make it easier for companies to determine reputation.

"While IPv6 blacklists are more difficult to administer than IPv4 blacklists, IPv6 provides a routable address all the way to the end device," Prince said. "As such IPv6 whitelists are very powerful and usable in contrast with  IPv4 whitelists where addresses can move around."
