Infosec? What Country Is That?

Article originally published by The Analogies Project

By Alina Stancu (Marketing Coordinator, Titania)

About the Author

In this comparative article, Alina Stancu, Marketing Coordinator at Titania, talks about the struggles of discussing information security to outsiders and the similarities she experiences discussing her country of origin, Romania. Alina joined Titania whilst completing her final year studying; Advertising, Marketing and Public Relations at the University of Worcester. Alina has since become a valued member of the marketing team and during her time at Titania has developed an enviable amount of knowledge about the industry and the importance of cyber security.

I am familiar with the pains of discussing information security with “outsiders”, thanks to my Romanian origins. Explaining my country to non-Romanians is not much different to talking to non-technical people about security. Everyone has a vague idea of what it is, everyone knows a couple of standard stereotypes (thank you, Hollywood!), everyone has some expectations of what its inhabitants should look like.

Note: All the questions below have been posed to the author at one point or another, by various friends, acquaintances, strangers on the bus. You always start the conversation with the premise that no one will know what you are talking about, so you must accommodate the interlocutor and provide some context about the information security industry, clarify it’s a self-standing profession, and not to be confused with the more generic IT-support.

Interlocutor 1: So, is Romania a part of Russia?

Alina: No. Part of the former eastern European communist bloc of countries, but that ended in 1989, with the revolution. We’ve been aboard a merry democratic transition ever since…

Interlocutor 1: Ah… so it was part of Russia?

Alina: No

Interlocutor 1: I don’t get it. Sorry, I wasn’t very good at Geography. To be honest I don’t know much about Romania. It’s one of those places that you know they exist, but you don’t really hear much about.

Alina: That’s ok. It wasn’t ever part of Russia. We have lost Moldova (which is occupied by Romanians) to Russia, but Romania was never assimilated.

Interlocutor 1: Is it civilised? Do you have normal amenities?

Alina: What’s a normal amenity?

Interlocutor 1: Don’t know… electricity?

Alina: Mhm. We kinda need it. For, you know, essential living arrangements… like heating, lightning, Internet. Don’t get me wrong, we like living in caves heated by fire, as much as the next guy, but once in a while the iPad runs out of power.

 ***

Then, the dialogue seems to get a little more on track as people start recalling some names, or stories they may have read in the news. Hacking stories are not necessarily the most high-profile, but they do manage to draw some interest, awe or fear. Hollywood does drive some form of cyber awareness, at least. Problem is Hollywood also has a knack for exaggerating.

Interlocutor 2: Ah! Romania… I remember… Ceausescu. And that vampire… Dracula, right? He was some kind of a leader or king in your country, wasn’t he? Was he really a vampire?

Alina: Leader, yes. Vampire, not quite. Hollywood hasn’t got a great track record with sticking to facts and accuracy.

***

Then follow the natural confusions between the bad guys (cyber criminals) and the good guys (ethical hackers). Changing the perception that not all hacking is bad hacking and explaining that there is an actual need for ethical hackers (or penetration testers) to use their knowledge for good is always a challenge.

Interlocutor 3: I read that there are lots of Romanians begging on streets, in many European countries. Doesn’t make your people look very good. You see them in the news. I have to say it is a bit worrying.

Alina: Only a small proportion of the ones reported in media are actually Romanian. However, semantics, misleading information and lack of interest result in a wide-spread confusion outside of Romania’s borders.

Altogether, we have good and bad just like anywhere else, but when you’re an immigrant, you get scrutinised under microscope. Social issues get magnified to suit political agenda, and you find yourself in a very generic box with the label “dangerous” attached to your forehead.

***

Next, you explain the language. The technological lexicon can put off even the most patient, well intended ear. Most of the lack of interest towards cybersecurity stems from the intrinsically discombobulating vernacular attached to the industry. All the while, the more popular siblings such as mobile apps, web clients, social media have entered the colloquial jargon thanks to necessary integration into people’s professional and social lives. You would be hard pressed today for example, to find people not knowing what Microsoft Office is, or how to operate Skype.

Interlocutor 4: What kind of language do you speak in your country?

Alina: Romanian

Interlocutor 4: Is it like Russian, Polish? It sounds a little like it.

Alina: Haha! More like Spanish and Italian rather. Romania is part of the countries speaking 

Romance (or Latin) languages

Interlocutor 4: What did you say it’s called?

Alina: Romanian

Interlocutor 4: I don’t believe you.

Alina: …

***

Finally, gently break the expectancies of what the information security professional should look like. These particular stereotypes are a direct result of media portrayal of “geeks” as socially awkward people, mostly men (which in turn reflects the gender imbalance the industry deals with), that have little else in their lives aside from computers and gizmos. Is there any wonder that future generations may not want to be associated with these negative portrayals?

Interlocutor 5 (knowledgeable in ethnic physiognomy): I like Romanian girls. You don’t really look Romanian.

Alina: What does a Romanian look like?

Interlocutor 5: More blonde, with paler skin… I mean you obviously have a light skin, but you are not blonde, are you?

Alina: No. Neither is a large proportion of my co-nationals. But go on, what else should a Romanian look like?

Interlocutor 5: Don’t know, but they are usually very pretty. Alina leaves pondering over her national identity… and over her hair colour.

***

Much like a state, the information security industry has a different language, interesting people, its own pet hates, achievements, heroes and villains. That is not to say that it should remain marginalised and isolated from the rest of the society. Ignoring computer security is no longer a choice anyone can afford to make.

A country’s need for tourism, foreign policy and defence drives the national brand marketing. For an industry, bridging the communication gap means patience, cutting through the jargon and breaking stereotypes through education.

There is another problem that plagues the industry, and that is the “tired professional”. The IT professionals that after many years spent working with IT illiterates have got fed up with explaining and prefer to keep the strangers outside. Putting this in the same perspective of encountering people from all over the world, should you stop explaining to people where you come from just because they don’t know? Should they stop explaining to you about things you don’t know? Is there any point in harvesting knowledge, if it can’t be shared with others?

Network Security Is In The Details

Article originally published in Today's CIO

By Ian Whiting (CEO, Titania)

About the Author

Ian has been working with leading global organisations and government agencies to help improve computer security for more than a decade. He has previously been accredited by CESG for his security and team leading expertise for over 5 years. In 2009 Ian Whiting founded Titania with the aim of producing security auditing software products that can be used by non-security specialists and provide the detailed analysis that traditionally only an experienced penetration tester could achieve.

THERE ARE A GREAT DEAL OF SECURITY LESSONS HIDDEN in the plots and sub-plots of Star Wars – data security, hackers-for-hire, user error etc. However, what better suits the information security industry other than the striking moment that saw the Death Star exploding into glittery stardust? A chain of vulnerabilities and risk mismanagement ultimately lead to the unthinkable, the destruction of the Empires’ superweapon due to an exhaust vent vulnerability.

There is a case to be made that network security lies in the detail, especially with the rise of the advanced persistent threat and the development of cyberespionage worldwide. Criminals acting in the virtual space have long renounced the generic approach and have instead adopted a highly targeted crime deployment. Security measures must come to reflect this shift. For this, Star Wars shows us how attention to detail can be equally applied to your organisation for a more efficient defence of the network.

Advanced persistent threat: operation “Death Star”

The Death Star was an impressive military and political superweapon designed to annihilate entire planets. Yet in spite of its mightiness, the Death Stars’ defence was surprisingly vulnerable to attacks – one small weakness led to a devastating end result. An assessment of its vulnerabilities was long overdue and it may have been a chance to re-write Star Wars history.

 1. Network reconnaissance

Rebel spies led by Princess Leia manage to get possession of the Death Star’s plans, but their ship falls to the Imperial forces. Leia alone cannot analyse the information she retrieved. Instead she finds a way of transmitting the data back to her father’s home planet of Alderaan for further investigation, by storing the plans in the memory of R2-D2.

At this stage, Leia is captured by the Empire. For the time being, the Empire is unaware of Leia’s mission purpose. The princess insists they are there on a diplomatic mission.

Malware with backdoor capacities can infiltrate a network and remain undetected for years, while leaking information. For example SEDNIT infectors in operation Pawn Storm contained mainly backdoors designed to steal system information and send it to remote C&C servers.

Another example is the highly modular Snake (aka Uroburos) operation which indicates that the rootkit had gone undiscovered for at least 3 years, with a great ability to hibernate for a number of days, which made it untraceable even to professional eyes.

2. Outsourcing – “Hacking-as-a-Service”

Leia’s stolen plans reach the hands of Luke and Obi-Wan Kenobi who decide they must follow Leia’s instructions and reach Alderaan. Luke and Obi-Wan need extra assistance so they contract the services of mercenary Han Solo, who can transport them on his ship, the Millennium Falcon.

A coordinated cyberattack can involve multiple actors taking part, to accomplish various roles along the way. The underground forums of criminal activity are rife with hackers of various skills and knowledge that offer their services. Off-the-shelf tools are also popular either on a one-off basis or as a contractual service, including updating and maintenance work. The Silver Spaniel uncovered in 2014, shows a relatively simplistic campaign which did not build any software, but outsourced commodity tools available on hacking forums instead. The attack required little technical skill, yet it provided scam artists with a prosperous business.

Death Star - Shutterstock

3. Response SIEM – quarantine and counter-attack

The Millennium Falcon has to re-route, in order to reach the rebel base Yavin 4, as Alderaan was destroyed by Grand Moff Tarkin in a demonstration of the Death Stars’ capabilities. However, the Millennium Falcon gets captured by the Star’s tractor beam and brought into its hangar bay. When escaping, the ship manages to evade the Death Star, but at this point it carries a tracking device which enables Tarkin and Darth Vader to monitor them all the way back to Yavin 4.

Network defence approaches focused on threat identification and event management (SIEM) would at this stage identify a breach and trigger security alerts. An alert system would provide the CISO with the choice of further monitoring or ignoring the threat. We see that the Tarkin and Vader choose to monitor the Falcon and track it back to base. Yet, without a comprehensive risk management view of the Death Star’s vulnerabilities, they ignore the possibility that the rebels would “dare” target the core of the Star and fail to secure the ports.

4. The attack vector

The Falcon finally reaches its destination and they hand the plans over for analysis. The examination reveals a vulnerability in the exhaust port that connects to the station’s main reactor. Once the weakness was identified, an attack mission is set up and Luke joins the assault squadron.

In 2014, The Mask (El Careto) was revealed as one of the “elite” APTs. Its deployment against carefully selected targets included monitoring infrastructure, shutting down operations, avoiding detection by wiping instead of deletion of log files and others. Its purpose was cyberespionage, but the attack vector was a combination of social engineering and rare exploits for Java, Chrome, Firefox and other browsers.

Campaigns like The Mask show us that the wide range of tools and the extensive pre-planning work conducted before setting up the attack vector remain the most unpredictable part of the threat. Security and risk managers are often unaware of the “open ports” and struggle to discern between critical and minor threats.

An auditing process with clear flags for threat level is the only way to ensure that malicious actors do not achieve a more efficient assessment of your network than you.

 5. Exploit

After a number of battles, Luke assisted by the Force and under Obi-Wan’s spiritual advice is able to fire proton torpedoes into a small thermal exhaust port along the Death Star’s equatorial trench. This leads to the memorable image of the Death-Star exploding into space.

The BlackPOS family that ultimately led to the breach imposed on Target is a good example to the destructive effects that an undetected vulnerability can have to the security of a network, and finally to the reputation of an organisation. It is now known that the BlackPOS campaign operated through 3 different strains of malware, all following a similar behaviour: infiltration, memory scraping and exfiltration.

Target did have a security team in place to monitor its systems around the clock. Hackers managed to avoid detection while setting up their malware, but when they proceeded to the final stage – uploading the exfiltration malware – alerts went off in Target’s security department and then…nothing happened. The alarm was triggered early enough, before any data got leaked, yet the security operations centre chose to ignore it at that stage. The reasoning has never been disclosed.

 As we see earlier in the film, despite being aware of the thermal exhaust port, the Empire decidedly had not taken steps in securing it. The reasoning can be inferred from their conversations: too insignificant and too dangerous for the rebels to target it.

There is an important point to make here that regardless of a networks security system and even quarantine or counter-attack measures, there is also a great need for a healthy auditing practice, in order to identify your weaknesses before attackers get chance to exploit them. The final facilitator that led Princess Leia and then Luke Skywalker to succeed in their mission was the Empire having failed to design a correct risk management framework.

The accounts of many breaches provide sobering lessons in how organisations can have wide ranging “big picture, big budget” defences but leave vulnerabilities in everyday housekeeping. With the Death Star it was an exhaust vent, with your organisation it might be an out of date firewall, or a default password that had not been reviewed during your last pen-test. Monitoring the details can make the difference between a secure empire and an embarrassing and very public explosion.

 The words of General Dodonna, upon analysing the smuggled plans, can be the words of any hacker assessing the entry points of your network: “Well, the Empire doesn’t consider a small one-man fighter to be any threat, or they’d have a tighter defence.”

Cybersecurity: What the U.S. Can Teach Europe

Article originally published in FCW magazine.


By Edwin Bentley (Senior Software Developer, Titania) 

About the Author

Edwin joined Titania in 2011 and has since become a key member of development team, having primary involvement in advancement of both the Nipper Studio and Paws Studio software. He has a keen interest in Information Security and the role that the industry will play in the future advancement of technologies.


Having attended two reputable information security conferences this year, one on each side of the Atlantic, a few observations emerged on the differences and similarities of opinion on cybersecurity issues in the U.S. and Europe.

Although similar questions were raised at both conferences, the response manner was notably different. Europe took a reactive stance by signaling problems and bringing them to the attention of government agencies and legislators. The U.S., however, had a top-down approach, with industry searching for viable solutions in response to already adopted government directives.

The first event was Infosecurity Europe. The 2014 edition was hosted in London and attended by more than 11,000 information security professionals. With a 20-year tradition, the event is considered a reference point for the cybersecurity industry to find out about the latest trends and tools and keep up-to-date with European laws and compliance policies.

This year, the discussion focused on big data, the accelerated increase in organized cybercrime, the need to stay ahead of threats and an honest admission from Europol that cybercrime is best mitigated or disrupted because law enforcement lacks the resources to prosecute all crime. Staying ahead of threats was high on the agenda. Finally, there were comments on security issues in the cloud, which just like the bring-your-own-device trend, needs to be accommodated in its own right from a protection point of view.

Similar points were made at FOSE. (Editor's note: FOSE is owned and produced by FCW's parent company, 1105 Media.) As an industry event, FOSE is recognized as an official source for voicing the latest concerns in government IT. Among the issues discussed at the conference, cybercrime and cyber terrorism figured high on the agenda for defense and policy.

Continuous Diagnostics and Mitigation

In terms of security tools and trends, automation and continuous monitoring were held in high regard at the U.S. conference. The conversation on the FOSE floor focused on the Department of Homeland Security's Continuous Diagnostics and Mitigation (CDM) program. It comes on the heels of the National Institute of Standards and Technology's Cybersecurity Framework and is part of achieving the last step of that directive: monitoring security on an ongoing basis with the use of automation tools.

Released as a best-practice guidance document, the framework was embraced by the federal sector. After the latest high-profile breaches in the retail industry, a wide range of other companies have started to look at the framework as a template for assessing security practices.

In order to understand why CDM is seen as the best solution by IT professionals, below are a few well-debated problems it answers:

• Top of the agenda for information security experts is how best to integrate security with business processes. Reducing user disruption and enabling business innovation will be more easily addressed with the introduction of automated security.
• Although CDM does not guarantee that its users will stay ahead of threats, it does offer a near-real-time state of security with risk-based assessments reported and analyzed at network speed to ensure ongoing awareness and protection.
• A challenge for chief information security officers and CIOs everywhere is the compliance versus security conundrum. CDM implies moving away from layer upon layer of compliance in favor of perpetual alertness and security.
• The other issue in compliance is log aggregation and reporting. Continuous monitoring would produce automated event logs that can be filed for audits or analyzed for patterns in forensic investigations.

Continuous monitoring does not promise to answer every cybersecurity problem, but it offers a practical way forward. The voluntary adoption within the U.S. business community reflects that its advantages have been recognized.

Cyber directives in Europe and U.K.

Source: fcw.com

Meanwhile, that shift in security perception has yet to happen in Europe. The latest European Union cyber directive -- Network and Information Security (NIS) -- has been taken with a pinch of salt by the industry, and some organizations fear that the stick of compliance will come down hard on their budgets while doing very little for the state of their security.

In a similar way to the NIST framework, the U.K. government released a Cyber Essentials Scheme as a best-practice guide for organizations. Operating in a less intrusive manner with smaller, more practical steps, the scheme has been received with cautious but definite approval by the business spectrum.

Although a promising start, neither the Cyber Essentials Scheme nor the NIS directive alone is sufficient to bring forward the visionary changes the industry needs. The European efforts are moving in the right direction, but compared to the older, more experienced industry in the U.S., they need further development. The Cyber Essentials Scheme might be too small, while NIS could be seen as too complicated and faces an uncertain fate amid changes to the European Parliament.

If the cybersecurity industry is to address the issues raised at Infosecurity Europe 2014 such as staying ahead of threats, mitigating cyber crime, transforming security into a business enabler and dissipating the predicament of compliance versus security, then Europe needs to continue to move in the right direction and could be inspired by the top-down approach to security in the U.S.

Cyber Security at the NATO 2014 Summit

Titania delegate, Andy Williams attended the NATO Briefing to the Industry yesterday at the Farnborough International Airshow.

Source: bbc.co.uk

FIA 2014 is a great opportunity for a day out with the family. The acrobatic demonstrations from renowned aircrafts such as the Breitling Wing Walkers, Aerostars and the RAF Red Arrows, made for a memorable spectacle.

Source: gov.uk

However, Farnborough is not only hosting a public airshow for aviation enthusiasts, but also one of the most recognised trade exhibitions for the aerospace and defence industries. In the run up to the NATO Summit taking place in Wales in September 2014, ADS and UKTI Defence and Security Organisation have jointly offered UK industry the opportunity to connect and engage with the Alliance’s two main agencies: NATO Communications and Information Agency (NCIA) and NATO Support Agency (NSPA).

Source: rocketroute.com

The purpose of the briefing was to showcase the NATO market to the UK industry by bringing together the two agencies involved in budget spending and strategic operational activities, together with the UK defence and intelligence industry. The event is consistent with a previous declaration, by President Barack Obama, where he along with NATO’s Secretary General Fogh Rasmussem would identify the host country for the 2014 Summit, which will look at building up NATO’s ability to address cyber threats and “lock in” commitments by members. The “lock in” reference is a reminder of the message that US has sent before to NATO members, that cyber security is a shared responsibility.

Currently the agenda for the Summit revolves around: Afghanistan troop withdrawal; adapting the Alliance’s existence in the 2014 post era to respond to emerging threats - where cyber defence, intelligence cooperation and special op forces are discussed; budgetary concerns.

Previous meetings establishing the agenda have increasingly discussed cyber issues as an emerging challenge which should enter NATO’s defence strategy. So does this mean will see a grounded cyber security strategy at the 2014 Summit, in Wales? According to Chatham House, inside sources have been quoted saying to expect ‘more of the same’ – a focus on exercises, enhanced training, standard and greater work with partners.

The Alliance is confronting serious criticism from within. The first question on cyber issues has been about the defence of the organisation itself before taking over more ambitious projects. In response, the Alliance has hired Finmeccanica and Northrop Grumman to install cyber security equipment and Incident Response Capability programs across NATO headquarters, in 28 countries. In addition, the organisation also set up two Rapid Reaction Teams to protect its networks against cyber attacks.

Another discussion concerns whether the Alliance should leave cyber security policies to the EU. An enhanced long-term dialogue is needed in order to avoid duplicating efforts with the European Union and this seems to be a recognised concern for NATO leaders this September.

Source: nato.int

Finally, the most pressing question of all is who foots the cyber security bill and from that perspective, the members appear to be fairly reluctant to an offensive cyber strategy, which would put further strain on the already undercut budget. But as indicated in this research paper published by the NATO Defence College, Rome, ultimately there is pressure for the Alliance to justify its presence in the post 2014 era. Perhaps the answer lies in different prioritization over what constitutes a threat in 2014, with new budgets reflecting it appropriately. The Farnborough ‘Briefing to the Industry’, involving the relevant bodies of NATO and emphasizing strategic capacity and budget allocation, indicates the Alliance is already taking steps in the right direction. 

Titania at the Official Cyber Essentials Scheme Launch

Andy Williams (Titania's CSO) was present yesterday, at the invite of the office of Rt. Hon. David Willetts MP, Minister of State for Universities and Science, for the official launch of the Cyber Essentials Scheme. The event was hosted by the ICAEW (Institute of Chartered Accountants for England and Wales) and it was aimed to educate companies on the benefits of adopting the scheme and how best to apply it to businesses. 

Cyber Essential Scheme Launch. Credits: @ICAEW

The scheme, which stands as a guidance and certification reference point, will work alongside other cyber security accreditation bodies (such as the Information Security Forum or British Standards Institution). As such, businesses will be granted the opportunity to qualify for badges that would display how security conscious they are. 

Although the government announced it does not intend to impose legal requirements, it has stated that starting on October 1st, all suppliers bidding for information that handles personal and sensitive contracts in the public sector will need to be Cyber Essentials certified. Early adoption by a few high-profile names such as BAE Systems, KPMG and Barclays show that the scheme was received with enthusiasm. Also, the insurance industry is keen to support the integration of the scheme into their standards.

The scheme is overseen by CREST, the not-for-profit organisation that represents and certifies the information security industry, who collaborated alongside CESG to develop the assessment framework for the scheme. For those interested, badges are already accessible: IASME offers self-assessment path and CREST has a 2-level accreditation available. 

Among information security professionals reactions were positive, but at times reserved. The general consensus was that while the scheme is great for getting the basis of cyber security into place, sustained efforts are needed. 

Peter Wood observes that this is certainly ‘better than nothing at all’ as it addresses the lack of cyber security education for small to mid-sized businesses, which could really benefit from governmental help. Other experts agree that while it is a good starting measure, it shouldn't be seen as a complete solution and as in order to achieve noticeable results, the scheme needs continuous refinement in the long-term. 

Andy Williams thinks that "building on the government's '10 Steps to Cyber Security' launched in 2012, the Cyber Essentials Scheme is an useful next step in raising awareness of basic cyber hygiene standards that, if met, can help businesses protect themselves against cyber attacks. It will be interesting to see how many companies pursue the certification. The government's stated intention to ultimately require all of its suppliers to be CES certified will certainly help to encourage the adoption of the scheme across the UK."

It has been reported that the framework does not yet include guidance around business orientated issues such as business management, IT governance or employee awareness. Organisations would find it useful to have one source that is trusted to be up to date and reliable in these areas to help curb confusion. 

The Cyber Essentials Scheme lays down a good basic foundation and the legislative side gives it a more determined approach, suggesting that the Government is starting to recognise cyber security as a major national issue. The Queen’s Speech in the Houses of Parliament saw the proposal of 11 new laws, including a ‘Serious Crime Bill’ which suggests appropriate jail sentences for cyber crime in order to fully reflect the damage inflicted by a cyber attack. 

CEO in the Spotlight: Interview with Ian Whiting

by PenTest Team

Ian has been working with leading global organizations and government agencies to help improve computer security for more than a decade. He has been accredited by CESG for his security and team leading expertise for over 5 years. 

In 2009 Ian Whiting founded Titania with the aim of producing security auditing software products that can be used by non-security specialists and provide the detailed analysis that traditionally only an experienced penetration tester could achieve. Today Titania’s products are used in over 60 countries by government and military agencies, financial institutions, telecommunications companies, national infrastructure organizations and auditing companies, to help them secure critical systems.

Hello Ian, please tell us few words about Titania.

Titania was founded with the aim of developing easy to use security auditing software that performs a detailed analysis of systems that otherwise would require specialist knowledge. The software that we have released to date has assisted both government and leading businesses in better securing their networks. In the process, Titania has gained critical acclaim from leading industry analysts and several awards.

Since opening our first office in December 2010, Titania has experienced considerable growth. We now supply our products directly, and through a network of global partners, to organizations in over 50 countries worldwide. Our customers tend to be those that are security conscious, in sectors such as finance, defence, telecommunications, auditing and manufacturing.

What is it like leading a company like Titania and what are some of the challenges you face?

There are of course many technical and development challenges to running a business like Titania that specializes in cyber security auditing. However, as soon as we started trading our largest problem was responding to our customers’ requests to purchase the software and keep up with the demand for new features and functionality. In fact our largest challenge to date has been to manage the growth of the company. 

We are always looking to keep ahead of the competition and we have decided on a plan to achieve that goal through the technical capabilities of our products rather than through our company's marketing arm. So although we sometimes have a difficult time communicating our message, our products speak for themselves.

Do you offer any professional services?

We do not provide any professional services at present, though we are always continuing to review that situation. So we may add professional services at a later stage, both directly and through our network of global partners.

Users of our software do not require training services as one of our development goals was always to make our products as easy to use as possible. I believe we have succeeded in that goal. I have personally seen non-technical people produce detailed and complex security audit reports using our software with no previous experience with the tool. This being said, we are not resting on our laurels and we continue to look at ways to further improve user interaction with our products.

How often do you refresh (update) your products to meet the latest security challenges and threats?

Our products are continually being updated and are evolving to meet the requirements of our customers and the new issues that emerge in the industry. Typically each of our products has a short release cycle with updates being made available monthly.

Can you mention some of your top-selling products?

Nipper Studio is our company’s flagship product. It takes the manual process of reviewing how network switches, routers and firewalls have been configured and automates it. This is not done using the intrusive method of scanning a network device, which would not give you the full picture of how the device has been setup, but by analysing their native configuration.

The reports that are produced by Nipper Studio can contain security audit findings, compliance reporting, configuration reporting and more. The reports produced are equally detailed and specific, they were designed with technology that writes the report just like a human would. This is in contrast to traditional computer report writing technology that simply joins pre-written paragraphs of text together and rarely accurately describes how something specific has been configured.

Our most recent product, Paws Studio, is a Windows and Linux compliance product for servers, workstations and cloud-based systems. It was developed based on very specific security requirements of our customers who work in highly secure environments, with very sensitive information. They needed a solution that could be run without installing software on the audited system. Therefore we built Paws Studio to be able to run over the network, on the local system or offline with no connection to the audited system.

Although we have pre-configured Paws Studio with a number of different compliance check lists, you can define your own compliance checklist within the product. We have developed a Policy Editor that enables you to either modify one of the pre-defined compliance lists or create one of your own from scratch.

All of our products have been designed to be integrated with bespoke and third-party systems, including continuous monitoring setups. They can easily be integrated using a scriptable interface and you can export the report data in a variety of different formats. We also release our products with multi-platform support covering Microsoft Windows, Apple Mac OS X, Red Hat Linux, Ubuntu, Fedora and so on.

Our customers are very important to us and their needs play a key role in the development of all of our products. We base a lot of our development plans around their feedback and requests.

Where do you see network security heading in next few years? What are some of your predictions?

I see that security compliance is going to play an ever larger role within the industry than it does today. It is great to see progress towards an ever improving security baseline, but it also saddens me to see many organizations depending solely on compliance as the means to being secure. It is why I believe it is important that the security industry, in addition to enhancing security compliance lists, highlights the fact that being compliant does not mean you are secure. Unfortunately I can see there will continue to be security breaches in organizations who manage security risks with compliance instead of striving to ensure a truly
secure environment. You can almost picture the victim company’s statement now. It would read something along the lines of: “The company had met their compliance standards and we are now reviewing our current operating practices to ensure how best future breaches could be avoided”. 

Nipper Studio is fairly popular in the network security industry; can you give us some historical background on that product?

I have a background as a penetration tester and regularly performed manual assessments of various network devices. A proper assessment of a network device is not a five minute task, each aspect of how a device can be configured needs to be properly analysed and any potential security risks highlighted. Anyone who is simply reviewing firewall rules is not doing a thorough job. It is also a task that requires a high level of knowledge about the device being reviewed. It seemed by me that this is exactly the type of task that is suitable for automation.

***** It is worth noting that although penetration testers are typically both highly skilled and adaptable, they cannot be expected to have in-depth knowledge of every system they come across. The same is also true of the network administrators who manage those systems, they may not have the in-depth security background required to identify potential weaknesses in their systems. Nipper Studio is exactly the type of solution that could help each side. Giving penetration testers, device specific assistance and helping network administrators identify potential security weaknesses. *****

Although Nipper Studio originally started life simply identifying a limited number of security weaknesses with Cisco configurations, it soon grew by adding support for more devices, identifying more security weaknesses and eventually writing the security audit report for you.

At Titania, how do you strive to achieve top-quality software? What kind of quality control do the products go through?

This is a very challenging aspect of developing a product such as Nipper Studio. The number of moving variables involved with the development process is huge. We support a large number of different devices, the manufacturers of which are constantly updating and revising their platforms. Plus the vulnerabilities in each platform are forever evolving.

We maintain a growing test environment that includes the different devices that we support, plan to support and some others that may never get added to Nipper Studio. These are all used during the development and testing process, together with different firmware versions. To help manage the development plan for this we employ a development and tracking system that enables us to manage all these variables together with improvements suggested by our customers. Each developer and tester knows from our tracking system what tasks they need to be working on next.

Nipper Studio supports various Cisco devices and some people may be under the impression it only supports Cisco devices. What would you like to say about that?

Nipper Studio does support a wide range of Cisco devices, it was originally developed with only Cisco support and it is used by Cisco. So it is easy to understand how historically Nipper Studio could be mistaken for supporting only Cisco devices. However, the latest versions of Nipper Studio support over 100 different devices from different manufacturers and are used internally by a growing number of those manufacturers. Even a network that predominantly uses devices made by a single manufacturer will undoubtedly have a number of network devices made by someone else. We are often approached by customers asking for us to add support for unusual systems and devices. The network devices that we see deployed in data centers has evolved over time with increasing deployments of some devices and the reduction in others. We have developed a plugin-based architecture for Nipper Studio to help us adapt to those changes, enabling us to quickly develop, test and deploy support for new devices.

Very often clients complain that they are not offered good product/customer support. How do you ensure good customer support?

It was important for us to achieve our ISO 9001 accreditation as it helps us to ensure that every customer receives the same high standard of support from the point that they first engage with the company to when they receive the product and the subsequent support process that follows. We believe that every customer deserves great customer service and technical support and we offer these services free of charge to every one of our customers. Our ISO 9001 conformance not only ensures that all of our staff deliver the highest level of support but also promotes continuous improvement throughout the company. We achieve this through collecting and reviewing customer feedback and auditing our customer care processes.

Thank you for the interview

'A Day In The Life Of ' a Penetration Tester - Interview with Ian Whiting

What do you know about the career of an ethical hacker?

Source: ianhsutherland.com

SANS institute holds penetration testing at no. 2 in their top 20 coolest jobs in information security, along with the tagline: “You can be a hacker, but do it legally and get paid a lot of money”. It is not surprising that this career path is becoming more and more attractive as the cyber world becomes more developed. The need for good infosec professionals is even more acute nowadays, but this career is still tucked away on techie boards, or discussed over hack forums in technical jargon; little is understood of it by the general public.

Once in a while, stories surface outside geeky magazines about this elusive career. Portrayed as veritable digital ninjas, we see the cyber security guys in cellar-like environments, surrounded by a few machines and devices, talking about APTs, 0-day exploits and a number of acronyms that mean nothing outside of the industry. Is this the wrong image of a penetration tester? Not necessarily, but it is certainly not the only aspect of it.

CREST, the certifying body for the penetration testing industry, came up with an initiative to better acquaint people with a career in information security. Taking advantage of the wide range of infosec professionals gathered for the CRESTCon & IISP Congress 2014, CREST interviewed a number of industry representatives and put together a series of ‘A Day In The Life Of’ videos. With interviewees finding themselves at various stages in their career, the CREST videos provide a comprehensive overview of the job.

The interview below is a recount from Titania’s CEO, Ian Whiting; how he started in cyber security, where it has brought him today and what advice would he offer to those looking to enter the industry:





More episodes from the CREST series on information security careers: A Day In The Life Of'. 

Plaudits for the PCI Audits

First published in Computing Security magazine


By Ian Whiting (CEO, Titania) 

About the Author 

Ian has been working with leading global organizations and government agencies to help improve computer security for more than a decade. He has previously been accredited by CESG for his security and team leading expertise for over 5 years. In 2009 Ian Whiting founded Titania with the aim of producing security auditing software products that can be used by non-security specialists and provide the detailed analysis that traditionally only an experienced penetration tester could achieve.

Non-compliance is no longer an option, yet conflicting views still exist upon compliance and security, and what they mean for an organisation. After numerous high-profile breaches (Target, Neiman Marcus), PCI DSS has come heavily under the spotlight. The full extent of these attacks is yet to be revealed, but the compliance industry is already changing to cater to the ever-increasing threats and vulnerabilities that affect the card payment protection industry.

PCI DSS 3.0, which was announced in November 2013, will remain under 'best practice' guidelines until 30 December 2014. The new version addresses some of the issues reported by the industry, such as education, awareness, securing cardholder data and inconsistency in assessments, which have led to poor security practices and compliance failures.

CHANGES TO PENETRATION TEST REQUIREMENTS 
According to Verizon's 2014 PCI Compliance Report, Requirement 11 'was the least complied-with requirement […]. Just 23.8% of companies met all the controls between 2011 and 2013'. Requirement 11 concerns vulnerability scanning and penetration testing, and 11.3 in particular specifically deals with the demands of penetration testing. Outlined below are three major changes to Requirement 11:

1. External and internal penetration testing is to be carried out at least annually. This also requires tests to be performed after significant infrastructure or application upgrades. Recommendations include the tests to be performed by a qualified internal resource or a qualified external third-party, according to a defined methodology. In this case, the tester is not required to be a QSA or ASV (Approved Scanning Vendor).

2. Fix exploitable vulnerabilities found during penetration testing and repeat testing to verify corrections. The tests should be undertaken at least annually and after significant changes to the environment - eg, an operating system upgrade or web server additions.

3. Annual penetration tests that verify segmentation is used to isolate the Cardholder Data Environment (CDE). PCI DSS 3.0 guidance advises that penetration testing is to be used to assess how effective the segmentation that isolates CDE from other networks is. It specifies that the testing methodology should be reviewed to ensure all segmentation methods are covered, as well as verifying there is no connectivity between in-scope and out-of-scope networks. The tests should be performed annually and in light of any changes to segmentation controls or methods. These changes outline that, in order to combat the increasing threat, the detail and frequency of internal and external audits needs to increase (especially after system upgrades).

Although some worry that this will put extra time and financial pressures on companies meeting the PCI DSS standard, the reality is that the quality and frequency of tests is often sacrificed by companies for the sake of 'ticking the box'. The refined recommendations for defined methodologies and specified frequency should, in fact, help level the market and provide a fair deal to organisations shopping around for the best pen testing solutions.

Although some PCI requirements are such that no tool can truly perform a fully automated assessment, there is a plethora of cost-effective auditing tools that can help increase speed and accuracy of PCI audits. These can not only be used to ease the cost of internal audits, but also by pen testers to offer more thorough assessments without significantly impacting costs.