Paws Studio Walkthrough

by Alen Damadzic (Software Developer, Titania)

About the Author

Alen is a key member of the technical team and is the lead developer of Paws Studio compliance auditing software. Since joining Titania as a computing graduate three years ago, Alen’s knowledge of software development and cyber security has grown with the company and he now uses this knowledge to support and train new members to the ever growing development team.

Paws Studio is a compliance auditing tool for servers, workstations and other Windows or Linux based systems. At a basic level, creating a compliance report in Paws Studio can be as simple as selecting an audit policy and clicking go. However, behind the scenes, Paws Studio is performing a number of different processes in order to determine what needs to be checked, collecting the data, comparing the collected data against a policy and finally creating a report. This article provides a walkthrough of those processes to enable you to create truly effective and thorough custom policies to audit against.

Figure 1. Paws Studio audit process

A typical Paws Studio audit is a two-step process. The initial step is to collect the data for the audit and the second is to create the report by comparing that data against a compliance list (see Figure 1).

Collecting Audit Data

Data, such as password policy settings, are collected using a data collector. On Windows, the data collector is a small native program that reads the registry, file permissions and so on. The data collector does not require installing on the system that is being audited and does not require anything to be installed. On Linux systems the data collector is a shell script.

The data collector only collects what is required to create the report. Those audit parameters are specified in a policy file, which we will come back to later.

Figure 2. Report creation methods

When you select to create a new report in Paws Studio (see Figure 2), it will give you the option to add all the systems that you want to audit (local and remote). Paws Studio will then deal with executing the data collector for you and retrieve the results. It is important to note that during this process, Paws Studio will tidy up after itself, so no audit files will be left on the audited system.

Figure 3. Manual data collector option

It is also possible for you to run the data collector yourself on various systems and provide Paws Studio with the collected data; this is shown as the “Manual” option (see Figure 3).

To obtain the latest data collector so that you can perform the audit yourself, select the “Export Collector” option from the “Utilities” menu. You will also need a copy of the audit policy file for the data collector. By default on a Windows system the policy files are stored in “C:\Program Files\Paws Studio\XML”. You will find policy files for PCI, STIG, SANS, and others.

The data collector can be executed from the command line on both Windows and Linux systems. This gives you the ability to script the software so you can automate the audit data collection process.

The Audit Policy

Figure 4. Audit policies

When you create a compliance audit report in Paws Studio you have to select an audit policy that you want to check compliance with. It could be a PCI policy, STIG or others. The policy that you check compliance against when producing a Paws Studio report is stored in a specially formatted XML file.

Although Paws Studio is supplied with a number of pre-defined audit policies, you can create your own. You could use your favourite XML editor to create an audit policy file but Paws Studio includes a policy editor.

The audit policy editor has two modes of operation, a wizard mode and editor mode (see Figures 5, 6). The wizard mode is designed to easily enable you to create your own new audit policy, or edit an existing one, and guide you through the process. The editor mode is more suited for advanced users and editing existing policies.

Figure 5. Policy editor: editor mode

Figure 6. Policy editor: wizard mode

Figure 7. Paws Studio Settings

Customizing an Audit Report

Your audit reports can be customized to change the company name, logo, classification and so on. If you want to override the default Cascading Style Sheet (CSS) there is even an option to do that.

Some key customization options such as the “Policy Editor” “Authorized Software” and “Authorized Startup Items” contain the lists of what is determined to be authorized or not during those particular checks.

The “Reporting” options include an “Interactive Mode” setting that will cause Paws Studio to potentially ask you some questions during an audit. For example, some checks may require a physical analysis, such as “is the server room door locked?”.

An Audit Walkthrough

Figure 8. Paws Studio main frame

Now that we have highlighted the key components of a Paws Studio audit, the simple process of performing a report with all the available options is straight forward.

Select the “Create Report” option (see Figure 8).

Figure 9. Report creation methods

Select what you want to audit (see Figure 9).

“Local” will enable you to perform an audit of your local machine.

“Network” will enable to audit other computers on the network. You many need to specify a username and password.

“Manual” will allow you to add manually collected audit data.

Figure 10. Audit policies

Select the audit policy report that you are interested in. You can select multiple audit policies or specify your own using the “Import Policy” button (see Figure 10).

Click on “Create Report”.

Then you can read your report and save it out to a number of different formats such as HTML, Word, PDF, CSV and others.

Conclusion

This article has delved into what goes on behind the scenes of Paws Studio. By walking you through the key processes involved in creating your own compliance reports, it will enable you to get the most out of the software.

Advanced Nipper Studio Configuration

Ian Whiting and Edwin Bentley

About the Authors

Ian Whiting, Titania CEO and Creator of Nipper Studio
Ian has been working with leading global organizations and government agencies to help improve computer security for more than a decade. He has previously been accredited by CESG for is security and team leading expertise for over 5 years. In 2009 Ian Whiting founded Titania with the aim of producing security auditing software products that can be used by non-security specialists and provide the detailed analysis that traditionally only an experienced penetration tester could achieve.

Edwin Bentley, Software Developer at Titania
Edwin joined Titania in 2011 and has since become a key member of development team, having primary involvement in advancement of both the Nipper Studio and Paws Studio software. He has a keen interest in Information Security and the role that the industry will play in the future advancement of technologies.


Nipper Studio contains a wealth of configuration options to modify and customize the audits that are produced. This article covers how to access and modify those settings to enable you to fine tune your own audit reports.

To start, it is worth mentioning that Nipper Studio settings are “sticky” by default. Therefore if you set an option in the graphical environment, that option will remain set next time you run Nipper Studio. This is also true of the command line version, setting an option in the graphical environment will set the option for the command line as well.

To access the settings on Windows you select “Options” from the “Tools” menu (on Linux this is called “Settings” and on the Mac it is called “Preferences”; see Figure 1). 

Figure 1. Nipper Studio main frame

Due to the number of different customization and configuration options available, the settings window categorizes the settings in to the following groups (see Figure 2):

• Global – These settings affect all areas of Nipper Studio and contain options such as changing the company name used in the report, the formatting of dates and whether passwords should be shown in the output. This section also contains an option labelled “Auto Save Settings”. This is the option that makes Nipper Studio settings sticky.

• Devices – Nipper Studio supports over 100 different network devices and some devices have options that modify how they process a configuration. For example, Check Point configurations can contain multiple policies and options are available to determine how multiple policies are handled.

• Reports – You can create a number of different audit report types in Nipper Studio, with more report types coming soon. These report options enable you to configure the settings for each of the report types. For example, you may want to modify the audit password length checked during a security audit.

• Saving – As with report types, Nipper Studio also supports a wide variety of different file formats that a report can be saved as. For example, the HTML report fonts, colors or entire Cascading Style Sheet (CSS) can be modified using these settings.

Figure 2. Nipper Studio setting options

The best practice security audit report is the most common type of report created in Nipper Studio, so I will guide you through the configuration of those options. These can be accessed by selecting the “Reports” icon on the left and then selecting the “Settings” button next to the “Security Audit” entry. 

On platforms that include the “?” icon in the window title, you can gain additional help on the various options by selecting the “?” icon and then clicking on the option that you would like more information on. Additionally, the options also include “tool tip” help that appears when you hover your mouse over an option.

Coverage

Due to the large number of different configuration options available for each report type, they have been sectioned into tabs to make them easier to navigate. First off there is the “Coverage” tab, this is where you can select or deselect the different categories of configuration settings that you would like included within your audit report. For example, you may only be interested in auditing firewall rules, so you could deselect everything except the “Audit Network Filtering” option (see Figure 3).

Figure 3. Setting audit areas

Reporting

On the reporting tab you can select various options relating to how the security audit is reported. For example any identified security audits issues can be scored using one of two different rating systems. The Nipper v1 (default) rating system is a best-practice rating system. Alternatively you could select the industry standard CVSS v2 rating system that is a vulnerability scoring system (see Figure 4).

Figure 4. Reporting

If you choose to select the CVSS v2 rating system you can enter your own environmental metrics so that the scores are modified to take in to account your own environment. You can find out more information on the CVSS v2 rating system at: http://www.first.org/cvss/cvss-guide.html

Filtering

The filtering tab includes options to modify how firewall rules and objects are checked. These include options to enable checks against certain categories of firewall rules, rule complexity and more (see Figure 5).

Figure 5. Filtering (firewall rules modifications)

You can enable the filter rules to be audited even if filter rules have been disabled on a particular device. Your own environment may separate functionality between different classes of device, so you can also prevent firewall rules from being processed on certain types of device (such as print servers and application switches, see Figure 6).

Figure 6. Filtering (devices)

Nipper Studio contains a number of black lists. If a firewall rule is identified which permits traffic that matches a black list entry, an issue is reported. The black lists include unencrypted clear text services, administrative services and hosts. You can modify each of those black lists by clicking on the “Define…” button next to each one (see Figure 7).

Figure 7. Filtering (black lists)

As briefly mentioned earlier, Nipper Studio includes a number of rule complexity checks. These checks are disabled by default as they add to the time taken to create the audit. If you are interested in identifying firewall rules that contradict or overlap with other firewall rules, then this functionality can be enabled here. On large and complex rule bases, especially those from Check Point devices, the complexity checks can add a number of minutes to the audit process.

User Policy and Passwords

Although not all network devices include all the functionality that is checked during the security audit, where an insecure configuration is identified it is reported. The user policy tab includes options for password retention, account lockout and timeouts (see Figure 8).

Figure 8. User policy

Nipper Studio includes a number of advanced high performance crypto routines that are able to reverse passwords that have been encrypted using a number of different algorithms. These deciphered passwords can then be assessed against the password policy. Any non-reversed passwords can be saved out to a file for brute-forcing using a tool such as John the Ripper (http://www.openwall.com/john/). 

The passwords tab includes options for determining how the password complexity checks are performed against the known passwords. For options where a numerical value is specified, help text will also offer a guide as to what is considered more secure. For example the greater the number of characters in a password, the more secure it will be (see Figure 9).

Figure 9. Passwords

Vulnerability and Misc

The vulnerability tab enables you to configure the software version vulnerability analysis performed against a particular device. Generally the vulnerability analysis performed compares the version information contained within the configuration against the version detailed in the device configuration. However the software version can only be partially detailed in the configuration and sometimes not detailed at all. In those cases Nipper Studio makes a guess as to the version. This can lead to the reporting of false positives, so the wording in the reported issue is suitably adapted to highlight those details (see Figure 10).

Figure 10. Vulnerability

You can specify the version details when processing a configuration in order to filter out some false positives, and you could include the “show version” (or equivalent) output in the configuration. Additionally there is a “Vulnerability Filtering” option that helps to filter out the vulnerability list further based on the services and protocols configured. So if the vulnerability is specific to SSH and you have disabled that service then it is not reported.

Finally, the misc tab includes options to set the logging severity level and any words that should not be contained within logon banner messages (see Figure 11).

Figure 11. Misc

Conclusion

I hope that this article has provided you with sufficient information about how you can use some of Nipper Studio’s advanced settings to start customizing your own network audits. There are many other options for configuring Nipper Studio, for more information about these you can visit the Titania website at www.titania.com or contact us directly at enquiries@titania.com