Internet Protocol Version 6: Federal Agencies Need to Plan for Transition and Manage Security Risks

On May 20, 2005, we identified that the majority of federal agencies had not initiated the following planning efforts for the transition to Internet Protocol Version 6 (IPv6): (1) cost determination, (2) business case creation, (3) identification of timelines and methods, (4) development of inventories and risk assessment, and (5) establishment of enforcement mechanisms. As a result, we recommended that the Director of the Office of Management and Budget (OMB) instruct agencies to begin to address key planning considerations for the IPv6 transition. Based on GAO analysis of the issues surrounding IPv6, OMB issued a policy memorandum on August 2, 2005, to aid federal agencies with the transition to the new protocol. The guidance includes a deadline of June 2008 for all government agencies' to transition their network backbones to IPv6. The OMB policy memorandum ensures that federal agencies will have a structured approach to follow as they transition to IPv6. The memorandum addressed all GAO planning considerations, with the exception of a discussion on creating a business case. In February 2006 OMB issued additional IPv6 guidance for the agencies. This guidance discusses creating a business case.

DHS has taken action to determine its IPv6 capabilities by conducting a systems inventory.

Agriculture has taken actions to address near term security risks by conducting a systems inventory of all IPv6 capable hardware and software.

Education has taken action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

Commerce took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

As reported in our June 2006 report on federal efforts to transition to IPV6, the Department of Defense has conducted an inventory of existing routers, switches, and hardware firewalls.

Energy has taken action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

HUD has taken action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

HHS has taken action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

SSA took action to determine its IPv6 cababilities by conducting a systems inventory of all IPv6 capable hardware and software.

Interior took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

Justice has taken action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

Transportation took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

Labor has taken actions to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

Treasury took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

VA took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

State took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

EPA took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

GSA took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

NASA took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

NSF took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

SBA took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

NRC took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

OPM took action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

USAID has taken action to determine its IPv6 capabilities by conducting a systems inventory of all IPv6 capable hardware and software.

Consistent with our recommendation, the Department of Agriculture, among other things, conducted readiness tests for transporting IPv6 data across its core network, and between this network, partner agencies, and the Internet which it documented in its February 2008 IPV6 Readiness Testing Implementation Summary.

Education has begun to address near term security risks by actively monitoring their network for IPv6 traffic. Additionally, they have included IPv6 related network monitoring and internal controls in their policies per ED's Security Review Board (SRB).

Commerce has begun to address near term security risks by creating a policy within their IPv6 transition plan that bans IPv6 traffic from DOC networks that carry operations traffic.

Defense has taken steps to address near term IPv6 security risks by including a policy in their IPv6 transition plan stating that no IPv6 traffic is allowed on networks that contain operations traffic.

In its IPV6 transition plan, the Department of Energy included policies that dictate network maintenance and monitoring policies for the new protocol.

HUD has included a policy in its IPv6 transition plan that states that, as IPv6 is enabled, the network control center must perform the daily maintenance and support of the network.

SSA included a policy in its IPv6 transition plan that states that its network will be monitored for IPv6 traffic.

Consistent with our recommendation, the Department of Interior configured its firewalls to prevent inbound and outbound IPV6 traffic which it documented in its July 2009 IPV6 Security Posture.

Consistent with our recommendation, the Department of Labor, among other things, used a test environment to transport IPv6 data across its networks which it documented in its May 2008 IPV6 Test Results Summary.

On September 16, 2009, the Department of Veterans Affairs provided evidence that it has developed IPv6 security policy and that it has the capability to monitor IPV6 traffic.

State included a policy in their IPv6 transition plan that defines what needs to be done to manage IPv6 traffic on its network.

The EPA has taken steps to address near term security risks by including a policy in its IPv6 transition plan that calls for IPv6 network monitoring, management and troubleshooting.

GSA developed an IPV6 transition plan that included policies for managing and monitoring IPv6 traffic.

Consistent with our recommendation, the National Science Foundation, among other things, configured its firewalls so that they do not route IPV6 traffic and is monitoring network switch data to ensure no IPv6 traffic.

Consistent with our recommendation, the Small Business Administration developed an IPv6 Information Security Plan in November 2007. The security plan, among other things, includes information on IPv6 security threats and the implementation of a separate firewall for IPv6 traffic.

NRC has included a policy in their IPv6 transition plan that states they will block and monitor IPv6 traffic.

In October 2007, OPM issued an IPv6 Risk Assessment. This assessment includes a threat identification and impact analysis among other security analysis on IPv6.

USAID has taken steps to control and monitor IPV6 traffic including. On September 17, 2009, USAID security officials presented evidence of USAID's IPV6 capable network intrusion detection system that was capable of monitoring all inbound and outbound IPV6 traffic.