‘Tis the season for tech bloggers to prognosticate and pontificate about the trends for the next year.  This is also the time of year when we fondly reflect on the amazing rate of innovation during the past year and try to imagine how the pace of new technology will continue to accelerate. 

When publicly making these types of predictions, it is prudent to write about trends that are probable, and it is unwise to write about things that are too far-reaching. Along these lines, here are six network and security technology predictions that are probable for 2017.

1. Malware will continue to evolve

Malware has been the most effective way for attackers to reach targets globally.  Malware propagation has been the definitive attack method for the past few years, and now the effectiveness of most antivirus products is called into question. More and more security vendors offer malware defenses, but not all of these vendor’s solutions are completely effective as malware continues to metamorphize.

To read this article in full, please click here

More and more enterprise organizations are planning and deploying into cloud platforms. This trend is occurring despite organizations' historical push-back on cloud services claiming that they are less secure than private on-premises data centers.  Even though there is evidence to suggest that cloud application attacks are on the rise, there are best practice methods to secure cloud services. 

To read this article in full, please click here

It is often said, "the Internet is running out of phone numbers," as a way to express that the Internet is running out of IPv4 addresses, to those who are unfamiliar with Internet technologies. IPv4 addresses, like phone numbers are assigned hierarchically, and thus, have inherent inefficiency. The world’s Internet population has been growing and the number of Internet-connected devices continues to rise, with no end in sight. In the next week, the American Registry for Internet Numbers (ARIN) will have exhausted their supply of IPv4 addresses. The metaphorical IPv4 cupboards are bare. This long-predicted Internet historical event marks opening a new chapter of the Internet’s evolution. However, it is somehow anti-climactic now that this date has arrived. The Internet will continue to operate, but all organizations must now accelerate their efforts to deploy IPv6.

To read this article in full, please click here

Many people anticipated that enterprise organizations would adopt Software Defined Network (SDN) technologies later than service providers or multi-tenant data centers and cloud service providers.  We are now seeing more use of Network Functions Virtualization (NFV) within enterprises and some enterprises are starting SDN pilot projects.  As enterprises consider how to utilize SDN technologies in their data center environments, they start to consider what new security capabilities SDN can provide.  SDN switches can drop packets for flows that are not permitted by the controller.  This article explores if SDN switches can behave like a traditional firewall.

To read this article in full, please click here

In order to gain intelligence about the threats that may be directed to our organizations we need to tune into what is happening on the Internet.  By reading the latest annual security reports we can learn from what others have experienced and broaden our perspective on the current threat landscape.  Security practitioners should be sharing information about threats and attacks just as readily as the attackers share information, exfiltrated data and access to botnets.  We can learn from recent security reports and anticipate what we can expect to occur in 2015 and try to adapt our defensive strategies to protect our enterprises.

IT Security is Like Dental Floss

Parallels can be drawn between IT security and using dental floss.  We know that using dental floss can add years to your life expectancy but it requires discipline and a small time commitment every day.  Similarly, IT security requires a relatively small capital investment and a relatively small investment in time to configure granular policies and be vigilant.  Good security is a result of taking time to configure prudent security and then spending the time to establish situational awareness of the environment.  The papers are full of news about companies that have not invested enough time into their security programs.

To read this article in full, please click here

As enterprises look to adopt Software Defined Networking (SDN), the top of mind issue is the concern for security. Enterprises want to know how SDN products will assure them that their applications, data and infrastructure will not be vulnerable. With the introduction of SDN, new strategies for securing the control plane traffic are needed. This article will review the attack vectors of SDN systems and share ways to secure the SDN-enabled virtualized network infrastructure. This article will then discuss the methods currently being considered to secure SDN deployments.

To read this article in full, please click here

OpenFlow is a Software-Defined Networking (SDN) protocol used for southbound communications from an SDN controller to and from a network device. OpenFlow is the protocol used to inform the topology of network switches on which flows should be added to their flow tables and advise switches how they should handle traffic flows that are not in the current flow tables. Initially, OpenFlow did not have any definition for handling IPv6 communications. Now, newer OpenFlow versions have IPv6 capabilities and more vendors are deploying products that use the newer OpenFlow versions. This article goes over the IPv6 functions within the OpenFlow protocol and describes how these are being used.

To read this article in full, please click here

The way we have created IT systems over the years has been very linear with each individual component being statically configured.  If a human makes an error in any one of the many configurations, then the whole system breaks down.  Over the years, IT systems have become increasingly complex with multiple layers of abstraction and virtualization making it difficult to enforce stability and gain scalability.  Promise theory provides a new way to think about how IT systems rely on each other to form an entire system that businesses can depend.  This article will cover the foundation concept of promise theory and give examples of how it is used.

To read this article in full, please click here

Clos networks were first created in the mid-1950s as a method to switch telephone calls. Clos networks evolved into crossbar topologies and eventually into chassis-based Ethernet switches using a crossbar switching fabric. Now Clos networks are being used in modern data center networking architectures to achieve high performance and resiliency. This concept has been around for many years and it is now a key architectural model for data center networking. It is fascinating how concepts reemerge again and again in the history of networking.

Origin of the Clos Network

Charles Clos was a researcher at Bell Laboratories in the 1950s. He published a paper titled "A Study of Non-blocking Switching Networks" in the Bell System Technical Journal in 1953. In this paper he described how telephone calls could be switched with equipment that used multiple stages of interconnection to allow the calls to be completed. The switching points in the topology are called crossbar switches. Clos networks were designed to be a three-stage architecture, an ingress stage, a middle stage, and an egress stage. The concept is that there are multiple paths for the call to be switched through the network so that calls will always be connected and not "blocked" by another call. The term fabric came about later because the pattern of links looks like threads in a woven piece of cloth.

To read this article in full, please click here

There are several universal laws in the networking world that we must all abide by. Understanding these laws gives us deeper insight into the connected world we live in. Like civil law, in some cases these laws are not necessarily meant to be broken. Other laws just beg to be broken in an attempt to innovate network technologies. Here are the laws of the physical networking universe that is continually expanding.

Metcalfe's Law

Bob Metcalf's insight into networking is legendary. His law states that "the value of a network is proportional to the square of the number of connected users." For example, when a network is just a point-to-point link between two users the network has a value of 4 (2^2). However, when the network allows full-mesh connectivity between 100 users then the value is 10,000 (100^2). Now the Internet has about 2.7 billion users so its value is approximately 7X10^18.

To read this article in full, please click here

Many enterprises use OSPF version 2 for their internal IPv4 routing protocol. OSPF has gone through changes over the years and the protocol has been adapted to work with IPv6. As organizations start to contemplate how they will deploy IPv6 at their Internet perimeters and within their enterprise networks they should be aware of OSPF version 3 and how it differs from what they are familiar with. This article reviews the differences between OSPF version 2 and OSPF version 3 and how they can be configured to work with IPv4, IPv6 and both protocols.

To read this article in full, please click here

Good engineering practices dictate that when we prepare to build something we must plan for the long-term operations. Having the ability to properly manage the technology after it is deployed will ensure its longevity. If the system is neglected, it will become unreliable and eventually fail. There are many organizations that have deployed IPv6 at their Internet perimeters, yet they lack the ability to manage the usage of this new protocol. Having the right IPv6-capable management tools will give us the visibility to our IPv6 deployments.

External Visibility

Many organizations have deployed IPv6 at their Internet perimeter. Other organizations may have IPv6 traffic traversing their DMZs and they do not even realize it. There could be 6in4 tunnels in use that allows the IPv6 traffic to be transported within IPv4 encapsulation. Both of these types of organizations have a need to be able to maintain their IPv6-enabled systems and be able to troubleshoot IPv6-related problems. These organizations will be operating a dual-protocol environment for many years and they must develop in the capability to maintain both protocols.

To read this article in full, please click here

In 2013, it is expected that the number of mobile devices will exceed the number of people. Each of these devices will need an IP address to reach content on the Internet. The Bring Your Own Device (BYOD) movement is driving the need for more ubiquitous connectivity to support a mobile workforce. Even though some content providers have deployed IPv6, the vast majority of content remains reachable over IPv4-only. As more global communities join the Internet and the Internet of Things (IoT) continues to grow the availability of IP addresses will become critical.

To read this article in full, please click here

Many networks use 1500-byte MTU size, but the MTU size can be reduced by encapsulation, tunneling or other overlay network protocols. These situations reduce the end-to-end effective MTU size which reduces throughput and network efficiency and sometimes causes application problems. Many network devices now support larger sizes of Ethernet frames and use of Jumbo Frames is becoming more common. This article covers how to determine if your network is capable of using Jumbo Frames and if you should enable this feature.

Compensate by Increasing the MTU Size

A previous article on "MTU Size Issues" discussed the issues of MTU size, how Path MTU Discovery (PMTUD) is performed and the results of fragmentation. Today, the vast majority of data networks use a default 1500-byte MTU size. This is because this is the default Ethernet MTU size for hosts and switches. Frequently, links between enterprise routers and the upstream ISP routers only support 1500-byte MTU. This is also true on the links between MPLS CE routers and PE routers. The primary issue with MTU size occurs when encapsulation is taking place between sites that only support 1500 byte MTU.

To read this article in full, please click here

The Maximum Transmission Unit (MTU) is the largest number of bytes an individual datagram can have on a particular data communications link. When encapsulation, encryption or overlay network protocols are used the end-to-end effective MTU size is reduced. Some applications may not work well with the reduced MTU size and fail to perform Path MTU Discovery. In response, it would be nice to be able to increase the MTU size of the network links.

MTU Size

The Maximum Transmission Unit (MTU) is the largest possible frame size of a communications Protocol Data Unit (PDU) on an OSI Model Layer 2 data network. The size is governed based on the physical properties of the communications media. Historical network media were slower and more prone to errors so the MTU sizes were set smaller. For most Ethernet networks this is set to 1500 bytes and this size is used almost universally on access networks. Ethernet Version 2 networks have a standard frame size of 1518 bytes (including the 14-byte Ethernet II header and 4-byte Frame Check Sequence (FCS)). It should also be mentioned that other communications media types have different MTU sizes. For example, T3/DS3 (or E3) and SONET/SDH interfaces have an MTU size of 4470 bytes (4474 with header).

To read this article in full, please click here

Last week was the 2013 North American IPv6 Summit conference. This was the 6th year of the IPv6 conference held in Denver, CO. One of the items that all attendees received at the registration booth was an IPv6 Buddy keypad. This got people thinking about what other changes we might expect to experience as we move into a dual-protocol Internet world.

Picture of my new little IPv6 Buddy.

This is a small USB keypad that is specially made for entering IPv6 addresses. It contains "0" through "9", "A" through "F" and special characters like ":", "::", and "/". It is intended to speed up the entering of IPv6 addresses rather than use a standard keyboard and number pad.

To read this article in full, please click here

Security professionals have been relying on the BackTrack security distribution for many years to help them perform their assessments. The industry has been waiting for the next major release of BackTrack. However, the creators of BackTrack have gone in a new direction and created Kali Linux.

RELATED: A visual history of Linux

Kali Linux is similar to BackTrack in many ways, but it lays a new foundation and makes substantial improvements that will allow it to be even more useful to penetration testers in the coming years.

To read this article in full, please click here

It is just a fact of life that attackers and defenders are now operating in a dual-protocol world. With the addition of IPv6, attackers are learning new tricks and defenders will need to anticipate and protect against those new attacks. Attackers will try to use IPv4 and IPv6, each alone or in combination, for their exploits. We can predict that attacks will use a combination of IPv4 and IPv6 in a way that could allow an attacker to avoid detection by today's protection mechanisms.

Attackers commonly use a specific methodology when using malware propagation and command-and-control networks for exploitation. However, attackers use a different standard methodology when performing a targeted attack. Attackers start with reconnaissance, exploring and scanning, exploitation, maintaining access, covering up tracks, and leveraging access to expand to other systems. When an attacker is performing reconnaissance, they may only focus on the IPv4 addresses of the target. However, a sophisticated attacker would recognize when a target is reachable over IPv6 transport. If a victim only uses IPv4 then they are reachable only over that one protocol, but if a victim is reachable over both, then the "attack surface" has effectively doubled. An attacker will perform reachability testing and scanning over IPv4 and IPv6, thus doubling their workload. Both attackers and defenders must now do everything twice; once for IPv4 and once for IPv6. Every activity that the attacker performs will use IPv4 and IPv6 to determine if one protocol is less fortified than the other. Then the attacker will leverage the weakest of the two connection protocols.

To read this article in full, please click here

This is my 100th blog post for the Network World Cisco Subnet community. As I reflect on the last four years of writing this blog, I think about the fun I've had sharing ideas with you and hearing your feedback. In this blog I list the most popular articles and review how IPv6 adoption has changed over the years. I share with you my writing process and ask for your input on future blogs.

Most Popular Blog Topics

There are many talented Network World bloggers who share their insight with the world and, as a result, their blogs are very popular. This blog may not have the catchiest titles or be on news-worthy topics written by a journalist. My blog is not the most popular, but it gets a decent number of hits for a column on computer networking and security. This blog draws between 1% and 2% of all of Network World's blogs visits. My articles tend to have a "long tail" and get hits many months after they were posted. My blog gets between 10,000 to 20,000 hits each month out of the million or more hits that all Network World blogs receive.

To read this article in full, please click here

Many networking, systems and security engineers have been studying IPv6-related topics for many years. You may be wondering if you can get a certification to show for all the time and effort you have spent learning IPv6. IPv6 has been incorporated into vendor certifications and other non-vendor IPv6-specific certifications. You can work toward attaining these certifications to show your current or future employer that you possess IPv6 knowledge and skills.

Vendor-Specific IPv6 Certifications:

There are many vendors who have embraced IPv6 and included it in their product's features. These vendors have training programs for their products that cover IPv6-related topics and accompanying certifications that test your knowledge of IPv6 and how it is configured.

To read this article in full, please click here