Two Accolades for Titania at the Computing Security Awards 2014

The prestigious ceremony for the Computing Security Awards 2014 brought outstanding results for Titania. Thanks to everyone’s votes, Titania took part in five categories. Last night, Titania’s CEO and founder, Ian Whiting took home the coveted “Personal Contribution to IT Security Award 2014” and Nipper Studio scooped up the nomination of Runner Up for “Enterprise Security Solution of the Year”.

Ian Whiting, the creator of Nipper Studio, said: “We were up against well-established names in the industry, so these awards are very important, even more so as the winners were chosen through public votes. It is so encouraging to know we have so many customers and partners that believe in us and the services we provide. We want to thank everyone for all the support and kind words we received.”

The Computing Security Awards were created to celebrate the best solutions of the industry, the best information security providers and individual representatives whose efforts have made a difference to the cybersecurity community. Running in their fifth year (with the third consecutive win for Titania), the awards are well-known and highly regarded by the industry. All applications were submitted to two rounds of public vote, via the Computing Security Awards website, to determine the winners.

This year's Personal Contribution to IT Security Award goes to Titania's Ian Whiting. Well done Ian! @TitaniaLimited

— Computing Security (@CSMagAndAwards) October 9, 2014

@TitaniaLimited @CSMagAndAwards Thanks guys! See you next year :-)
— Halon Security (@halonsecurity) October 10, 2014

Ian Whiting CEO & creator #networksec audit tool #NipperStudio won Personal Contribution to IT @CSMagAndAwards! Proud moment @TitaniaLimited
— Titania (@TitaniaLimited) October 9, 2014

Titania joins a long list of acclaimed winners, including Celestix, Egress, Fortinet, CheckPoint, Nettitude, WatchGuard, Palo Alto Networks, CyberArk, VASCO, Assuria and Cyberoam. For more details visit the Computing Security Awards website.

Final congrats @CSMagAndAwards: @CyberArk @cyberoam @wickhill @TweetBrookcourt @wallixcom @CelestixNetwork @TitaniaLimited #WellDone
— Titania (@TitaniaLimited) October 9, 2014

“It was an incredible night. Everyone was celebrating and networking. The venue was outstanding, but the infosec community really built up a wonderful atmosphere.” said Marketing and Sales Manager, Ruth Inglis.

@Stuey_James @ThomLangford @CSMagAndAwards Thank you v much! Worthy opponents @HostUnknownTV. Expecting challenge to the title nxt year :)
— Titania (@TitaniaLimited) October 10, 2014

@TitaniaLimited @CelestixNetwork @AuthNews @VASCODataNews We'll second that - and congrats again to Team Titania of course!
— Computing Security (@CSMagAndAwards) October 10, 2014

The runner up for Enterprise Security Solution, network security auditing software, Nipper Studio started as a tool intended to simplify the work of penetration testers, in the laborious task of auditing firewalls, switches and routers. Soon after, it garnered interest worldwide and multiple awards, from the acclaimed Govies in the US government IT security, to innovation-driven European Smart Metering awards, while gaining praise from cybersecurity professionals as well as non-security specialists that needed accurate and detailed analysis regarding the security of their network. The team has now returned to the office with two more prestigious accolades as standing proof that the acclaims are grounded.

Titania was a proud sponsor for the Computing Security Awards 2014 alongside CheckPoint, Celestix, ZeroDayLab and Brookcourt. To keep up to date with news from Titania, please follow us on Twitter @TitaniaLimited. If you would like more information regarding our network auditing solutions, please email us at enquiries@titania.com

Plaudits for the PCI Audits

First published in Computing Security magazine


By Ian Whiting (CEO, Titania) 

About the Author 

Ian has been working with leading global organizations and government agencies to help improve computer security for more than a decade. He has previously been accredited by CESG for his security and team leading expertise for over 5 years. In 2009 Ian Whiting founded Titania with the aim of producing security auditing software products that can be used by non-security specialists and provide the detailed analysis that traditionally only an experienced penetration tester could achieve.

Non-compliance is no longer an option, yet conflicting views still exist upon compliance and security, and what they mean for an organisation. After numerous high-profile breaches (Target, Neiman Marcus), PCI DSS has come heavily under the spotlight. The full extent of these attacks is yet to be revealed, but the compliance industry is already changing to cater to the ever-increasing threats and vulnerabilities that affect the card payment protection industry.

PCI DSS 3.0, which was announced in November 2013, will remain under 'best practice' guidelines until 30 December 2014. The new version addresses some of the issues reported by the industry, such as education, awareness, securing cardholder data and inconsistency in assessments, which have led to poor security practices and compliance failures.

CHANGES TO PENETRATION TEST REQUIREMENTS 
According to Verizon's 2014 PCI Compliance Report, Requirement 11 'was the least complied-with requirement […]. Just 23.8% of companies met all the controls between 2011 and 2013'. Requirement 11 concerns vulnerability scanning and penetration testing, and 11.3 in particular specifically deals with the demands of penetration testing. Outlined below are three major changes to Requirement 11:

1. External and internal penetration testing is to be carried out at least annually. This also requires tests to be performed after significant infrastructure or application upgrades. Recommendations include the tests to be performed by a qualified internal resource or a qualified external third-party, according to a defined methodology. In this case, the tester is not required to be a QSA or ASV (Approved Scanning Vendor).

2. Fix exploitable vulnerabilities found during penetration testing and repeat testing to verify corrections. The tests should be undertaken at least annually and after significant changes to the environment - eg, an operating system upgrade or web server additions.

3. Annual penetration tests that verify segmentation is used to isolate the Cardholder Data Environment (CDE). PCI DSS 3.0 guidance advises that penetration testing is to be used to assess how effective the segmentation that isolates CDE from other networks is. It specifies that the testing methodology should be reviewed to ensure all segmentation methods are covered, as well as verifying there is no connectivity between in-scope and out-of-scope networks. The tests should be performed annually and in light of any changes to segmentation controls or methods. These changes outline that, in order to combat the increasing threat, the detail and frequency of internal and external audits needs to increase (especially after system upgrades).

Although some worry that this will put extra time and financial pressures on companies meeting the PCI DSS standard, the reality is that the quality and frequency of tests is often sacrificed by companies for the sake of 'ticking the box'. The refined recommendations for defined methodologies and specified frequency should, in fact, help level the market and provide a fair deal to organisations shopping around for the best pen testing solutions.

Although some PCI requirements are such that no tool can truly perform a fully automated assessment, there is a plethora of cost-effective auditing tools that can help increase speed and accuracy of PCI audits. These can not only be used to ease the cost of internal audits, but also by pen testers to offer more thorough assessments without significantly impacting costs.