[ipv6hackers] "Stick to limited IPv6 deployments, businesses warned"

[Jim Small]

> Fix the underlying problem: improve the protocol, and slap the lazy vendors.

Vendors are very practical - they focus their efforts where people are willing to pay for them.  However, if we look at the US Federal Government - they worked to come up with a list of reasonable security requirements (USGv6, NIST SP800-119, and others) for IPv6.  The result?  Vendors have implemented code and products that meet these standards.  In fact, when I do my testing I heavily rely on NIST SP800-119.

Perhaps a more fruitful tactic for improving the security of IPv6 would be to work with governments, periodicals/publications, enterprises, etc. to come up with a list of required features.  If you want to roll out IPv6 to your organization you should look for the following security features...  Wouldn't that achieve the result of moving security forward while also letting us address IPv4 exhaustion?

What do you think?
  --Jim