Comments on: IPv6 Firewalls http://technosailor.com/2007/02/15/ipv6-firewalls/ Web Technology and Real Life Merge Thu, 18 Mar 2010 02:16:34 +0000 hourly 1 http://wordpress.org/?v=3.0-alpha By: Paul Robertson http://technosailor.com/2007/02/15/ipv6-firewalls/comment-page-1/#comment-63468 Paul Robertson Wed, 21 Feb 2007 01:17:07 +0000 http://www.technosailor.com/ipv6-firewalls/#comment-63468 Well, I think the discussion on diabling the protocol is more interesting, not being able to firewall off v6 clients will likely lead to abuse on the radio side of things. As for personal firewalls, outbound blocking allows you to stop trojans from calling home- so it's useful even if it's not on by default on the Mac and you can't do it in Windows without 3rd party software. Firewalls are useful in stoping target of opportunity attacks. Limiting what devices can access an open port is good for reducing vulnerability. Especially for new vulnerabilities in nework services for which there isn't yet a patch. Firewalls stop real attacks all the time, so I'm not sure why the folks enabling v6 devices haven't started to work out the issues and build in some protection. If you don't have a real trusted and validated computing base, then you're pretty much stuck with arbitrating access as a security mechanism. What's the alternative? Paul Well, I think the discussion on diabling the protocol is more interesting, not being able to firewall off v6 clients will likely lead to abuse on the radio side of things.

As for personal firewalls, outbound blocking allows you to stop trojans from calling home- so it’s useful even if it’s not on by default on the Mac and you can’t do it in Windows without 3rd party software.

Firewalls are useful in stoping target of opportunity attacks. Limiting what devices can access an open port is good for reducing vulnerability. Especially for new vulnerabilities in nework services for which there isn’t yet a patch.

Firewalls stop real attacks all the time, so I’m not sure why the folks enabling v6 devices haven’t started to work out the issues and build in some protection.

If you don’t have a real trusted and validated computing base, then you’re pretty much stuck with arbitrating access as a security mechanism. What’s the alternative?

Paul

]]>