Paws Studio Review

By Jim Halfpenny 

About the Author 


Jim is an experienced IT practitioner with 14 years experience in both academia and industry, working with renowned companies including British Airways, Oracle, BSkyB and Cloudera.

Whether you see compliance as a burden or an aspiration we are frequently mandated to meet a certain set of security requirements around our information assets. One important aspect is being able to demonstrate to yourself and to others that your systems meet the criteria set by your compliance regime. How do you ensure that your systems are compliant with your policies or those mandated by compliance standards? A program of auditing your systems will help you understand the state of your estate.

Titania’s Paws Studio provides a means to audit Windows and Linux systems and provide compliance reports against a defined set of policies. It sets out to provide clear and detailed reports of the system’s level of compliance. Policy templates are editable and Paws Studio comes with predefined templates based on established policies and best practice including PCI, SANS and DoD STIG.

Policy templates are essentially a group of compliance audit checks built from the check library provided by Paws Studio. Checks range from high-level tests such as the presence of antimalware software right down to individual file permissions and registry settings.

There are two ways of creating and customising policy templates. The first is a wizard that guides you through creating your policy. Here you can define the rules that comprise your policy by clicking through a series of screen and selecting checks from the library. The interface is straightforward and self-explanatory and it is a great tool for less advanced users. However, the more technically minded user might find it time consuming and prefer to use the supplied Policy Editor instead which is undoubtedly the more powerful tool.

The Policy Editor provides you with a tree layout of your policy, giving you a bird’s eye view on the ability to quickly navigate through the rules.

In addition clicking on the advanced tab gives you a syntax-highlighted view of the raw policy XML. Whatever tool you choose, the result is an XML file defining the compliance checks for your policy and metadata used to generate the final compliance reports.

Once you have your policy defined it’s time to audit your systems. In order to compile a report you need the compliance audit data collected from a machine. At this point you have three options. You can choose to audit the local machine where Paws Studio is installed. You can also audit a system over the network. To do this will need valid administrator credentials on the remote system. Paws Studio will scan the local network for hosts to audit or you can specify the IP address of the machines in scope.

The third option is to use the portable data collector software, a small executable that can be run from a thumb drive. This is particularly useful where you need to audit a system that is not on the network or is air gapped from your audit workstation. Run the Data Collector, choose an audit policy and it will create a .paws file with the audit results.

Once you have collected your audit data you can produce a report on the audited system. Reports contain the result of each test on the system as well as summary charts showing percent tests passed and a breakdown of tests that failed by severity. Paws Studio creates a compliance audit report that can be saved as HTML, PDF, PostScript or Microsoft Word document. CSV and XML formats are also available so you can feed machine-readable reports into other reporting systems or build your own applications to consume your compliance data.

Paws Studio is available for Windows, Mac OS X and various flavours of Linux and currently supports auditing of Windows and Linux systems. This software pitches to the SME market who could be priced out by enterprise-grade auditing software though they are unlikely to benefit from the bells and whistles these tools provide. If you need a cost effective and easy to use compliance reporting tool, Titania’s Paws Studio certainly merits a second look.

Paws Studio Walkthrough

by Alen Damadzic (Software Developer, Titania)

About the Author

Alen is a key member of the technical team and is the lead developer of Paws Studio compliance auditing software. Since joining Titania as a computing graduate three years ago, Alen’s knowledge of software development and cyber security has grown with the company and he now uses this knowledge to support and train new members to the ever growing development team.

Paws Studio is a compliance auditing tool for servers, workstations and other Windows or Linux based systems. At a basic level, creating a compliance report in Paws Studio can be as simple as selecting an audit policy and clicking go. However, behind the scenes, Paws Studio is performing a number of different processes in order to determine what needs to be checked, collecting the data, comparing the collected data against a policy and finally creating a report. This article provides a walkthrough of those processes to enable you to create truly effective and thorough custom policies to audit against.

Figure 1. Paws Studio audit process

A typical Paws Studio audit is a two-step process. The initial step is to collect the data for the audit and the second is to create the report by comparing that data against a compliance list (see Figure 1).

Collecting Audit Data

Data, such as password policy settings, are collected using a data collector. On Windows, the data collector is a small native program that reads the registry, file permissions and so on. The data collector does not require installing on the system that is being audited and does not require anything to be installed. On Linux systems the data collector is a shell script.

The data collector only collects what is required to create the report. Those audit parameters are specified in a policy file, which we will come back to later.

Figure 2. Report creation methods

When you select to create a new report in Paws Studio (see Figure 2), it will give you the option to add all the systems that you want to audit (local and remote). Paws Studio will then deal with executing the data collector for you and retrieve the results. It is important to note that during this process, Paws Studio will tidy up after itself, so no audit files will be left on the audited system.

Figure 3. Manual data collector option

It is also possible for you to run the data collector yourself on various systems and provide Paws Studio with the collected data; this is shown as the “Manual” option (see Figure 3).

To obtain the latest data collector so that you can perform the audit yourself, select the “Export Collector” option from the “Utilities” menu. You will also need a copy of the audit policy file for the data collector. By default on a Windows system the policy files are stored in “C:\Program Files\Paws Studio\XML”. You will find policy files for PCI, STIG, SANS, and others.

The data collector can be executed from the command line on both Windows and Linux systems. This gives you the ability to script the software so you can automate the audit data collection process.

The Audit Policy

Figure 4. Audit policies

When you create a compliance audit report in Paws Studio you have to select an audit policy that you want to check compliance with. It could be a PCI policy, STIG or others. The policy that you check compliance against when producing a Paws Studio report is stored in a specially formatted XML file.

Although Paws Studio is supplied with a number of pre-defined audit policies, you can create your own. You could use your favourite XML editor to create an audit policy file but Paws Studio includes a policy editor.

The audit policy editor has two modes of operation, a wizard mode and editor mode (see Figures 5, 6). The wizard mode is designed to easily enable you to create your own new audit policy, or edit an existing one, and guide you through the process. The editor mode is more suited for advanced users and editing existing policies.

Figure 5. Policy editor: editor mode

Figure 6. Policy editor: wizard mode

Figure 7. Paws Studio Settings

Customizing an Audit Report

Your audit reports can be customized to change the company name, logo, classification and so on. If you want to override the default Cascading Style Sheet (CSS) there is even an option to do that.

Some key customization options such as the “Policy Editor” “Authorized Software” and “Authorized Startup Items” contain the lists of what is determined to be authorized or not during those particular checks.

The “Reporting” options include an “Interactive Mode” setting that will cause Paws Studio to potentially ask you some questions during an audit. For example, some checks may require a physical analysis, such as “is the server room door locked?”.

An Audit Walkthrough

Figure 8. Paws Studio main frame

Now that we have highlighted the key components of a Paws Studio audit, the simple process of performing a report with all the available options is straight forward.

Select the “Create Report” option (see Figure 8).

Figure 9. Report creation methods

Select what you want to audit (see Figure 9).

“Local” will enable you to perform an audit of your local machine.

“Network” will enable to audit other computers on the network. You many need to specify a username and password.

“Manual” will allow you to add manually collected audit data.

Figure 10. Audit policies

Select the audit policy report that you are interested in. You can select multiple audit policies or specify your own using the “Import Policy” button (see Figure 10).

Click on “Create Report”.

Then you can read your report and save it out to a number of different formats such as HTML, Word, PDF, CSV and others.

Conclusion

This article has delved into what goes on behind the scenes of Paws Studio. By walking you through the key processes involved in creating your own compliance reports, it will enable you to get the most out of the software.

Nipper Studio Q & A

By Aran Jarvis, Support Technician at Titania

About the Author

Aran has a key role within both the support and testing teams at Titania ensuring that users of the software receive the best products and services possible. Throughout his career Aran has always had a passion for cyber security and since joining Titania his interest and knowledge of the industry has continued to grow.

Nipper Studio is now used in 50 countries around the world by security conscious organisations, auditors and government departments. Below Aran has answered just a few of the commonly asked questions about the software. Nipper Studio has hundreds of setting to choose from that are not necessarily enabled by default.

1. Can I customize my Nipper Studio report with my own company information?

Yes, it is possible to customize your Nipper Studio report with a Company Name, Company Logo, Report, Title and Classification.

2. What Rating Systems can I use for my Nipper Studio audit report?

The default rating system is Nipper v1 which is based on industry, governmental and military best practice as well as the considerable penetration testing experience within Titania. If you wanted to use an industry standard vulnerability rating system, Nipper Studio enables you to switch to CVSS v2.

3. What kind of reports is Nipper Studio capable of creating?

Nipper Studio can create many different types of report. You can generate a singular report or combine multiple report types in one document. The report types are:

• Security Audit - a “best practice” security audit which combines checks from many different sources, including penetration testing experience

• STIG Compliance Audit - DISA STIG compliance audit against specific STIG checklists. STIG check lists can be updated using OVAL xml files.

• SANS Policy Compliance Audit - a SANS policy compliance audit against specific SANS policy documents.

• Configuration Report - a detailed report on how the device has been configured.

• Raw Configuration - details the actual device configuration data (SonicWall configurations are decrypted so that they are in a human readable raw format).

• Raw Change Tracking - the raw change tracking report will detail all the configuration lines that have changed since the previous report.

4. Is Nipper Studio capable of creating a report for multiple configurations from different network devices all at the same time?

Yes, you can either add a single configuration at a time or a directory of configurations. When a report is created using multiple configurations, each device is listed at the beginning of the report and also each issue has a section letting you know which device is affected by that particular issue.

5. Is it possible for Nipper Studio to report on overlapping or contradicting rules within a device’s configuration?

Yes, Nipper Studio can report on both overlapping and contradicting rules. These checks are not enabled by default as they can take an extended period of time to complete depending on how many filter rules that Nipper Studio has to check.

When checking for Overlapping Rules, Nipper Studio will check that no rules overlap or duplicate other rules which have been configured. For example, one rule could permit access to a range of services on a specific host and another could allow access to a number of the same services on the same host.

When checking for Contradicting Rules, Nipper Studio will check that no rules contradict other rules which have been configured. For example, one rule could allow access to a service which is then dropped by another rule in the same filter list.

6. Is it possible to set up different profiles for Nipper Studio to use when auditing different client configurations?

Yes, once you have configured Nipper Studio to report on the specific information and/or checks to be performed on your customer’s configuration. You can then save this configuration of Nipper Studio as a setting profile for use again at a later date. This will help save time and also means that your customer will always get the same report output each time you perform an audit for them.

Hopefully this information has helped answer a few questions about Nipper Studio and given you a taster of some of its functionality. If you have any other questions please contact us at support@titania.com and we would be happy to help.