A challenge (was Re: Default security functions on an IPv6 CPE)

[Frank Bulk - iName.com]

If the end-user's IPv6 address is known, a CPE with a firewall is an
effective means against unsolicited connection attempts.

Frank

-----Original Message-----
From: ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de] On Behalf Of
Mark Smith
Sent: Thursday, May 19, 2011 2:17 AM
To: ipv6-ops at lists.cluenet.de
Subject: Re: A challenge (was Re: Default security functions on an IPv6 CPE)

<snip>

The original question was whether to enable a CPE firewall by default.
The discussion is therefore constrained to threats for which a CPE
firewall is a possible mitigation. As a CPE firewall is not effective
mitigations against those other threats, those other threats are
irrelevant to the discussion as to whether to enable a CPE firewall by
default or not.

If people want to expand the scope of the discussion to other threats,
then by all means do so. That is the only way to be sure that all
threats have been considered and mitigated, if necessary, by appropriate
security measures.

> I do not agree with Ted on just shutting down
> inbound completely, but -this- is a strawman, and I dislike fud.

So they can correct me on their assumptions if they're different to what
I stated.

FUD is not realising that Internet security landscape has changed in the
last 10 years, and believing that the threats to IPv6 are both  exactly
the same types and likelihoods as those to IPv4.


Regards,
Mark.