Configuration Auditing: The Hygienist You've Always Wanted

by Nicola Whiting (COO, Titania)

About the Author

Nicola Whiting is Titania Ltd’s Chief Operating Officer and has a solid reputation for increasing revenues and profitability within technology based SME environments. She joined the team in 2011 has overseen a period of intense growth and change. Now Nicola’s focus is on extending the organizational capabilities and workforce skills, in order to continue to embrace innovation.



For many, configuration security ranks about the same as dental hygiene.

Critical infrastructure devices such as firewalls, switches and routers need to be secured against external hackers and internal threats, but it’s not seen as exciting and does not rank highly on boardroom agendas.

Source: evlad.com 

The most common result is to use a dual approach, combining scanning or agent based software, with annual penetration test reviews – to use the same analogy, daily brushing and an annual trip to the dentist.

This two-layer response does offer some advantage, it’s great for regular big-picture analytics (the ones that boardrooms like) and the annual penetration testers do a thorough job of analysing vulnerabilities and providing a detailed report.

Unfortunately as anyone with a mouthful of fillings can testify, it also often lets the rot set in!

The Dual Response Issue

Network scanners send huge numbers of network probes to a device and can impact performance. Only exposed vulnerabilities are identified, this potentially misses many issues that would be found with a detailed manual audit.

Agent-based audit software requires software to be installed on the audit devices and this is not possible for all devices. Furthermore, the required agent software can introduce additional security vulnerabilities.

Penetration testing requires expert level knowledge and is one of the most widely used and trusted forms of detailed security analysis. The process involves simulating an attack on your network systems through active exploitation of security vulnerabilities. To the resident network team, it can feel like the equivalent of lining up for a root canal….

Typically your primary goal is to test the operational capability of your network defenses to successfully detect and respond to attacks. Depending on the agreed scope of the test, reported elements may include: hardware and software vulnerabilities, poor or improper system configuration and suggested improvements to operational processes.

Part of the testing process may involve a manual configuration review.

Examining individual device configurations is highly time-consuming with significant manpower costs. Typically this results in point in time audits, extrapolating results from a sample of devices and potentially leaving vulnerabilities on non-assessed devices.

The Third Option

Early in his career as a Penetration Tester and CHECK team leader, Ian Whiting (CEO of Titania Ltd) realized there was a third option that was not being provided within the security marketplace. He realized that by automating the detailed configuration vulnerability analysis he could improve auditing speed, accuracy and return on investment.

His initial requirements were to:

• Flatten the security assessment process
• Achieve significant cost savings on current audit practices
• Improve the productivity of the audit process
• Reduce human error factor through automation
• Provide instant, device-specific expertise to non-specialist auditors

Through many years of hard work he developed a configuration auditing solution, that is now a “go to” tool in both SME and global Penetration Testers tool kits and has grown far past its original brief.

The “Configuration Hygienist” 

Whilst penetration testers are typically both highly skilled and adaptable, you cannot be expected to have in depth knowledge of every system you come across! The same is also true of the network administrators who manage those systems, they may not have the in-depth security background required to identify potential weaknesses in their systems.

Typically your penetration tester’s toolkit is not something you can pass on, but as a “cyber hygiene” professional, it makes sense to look for ways to reduce the likelihood of vulnerability cavities developing between visits.

The interim use of a cost effective configuration auditor widens the potential for detailed device analysis and on-going identification of potential security weaknesses. Return visits can then be less about finding conflicting rules and compliance failures and allow more focus on operational improvements and higher level security issues.

Nipper Studio - Configuration Auditing Tool

Nipper Studio’s early growth was entirely by word of mouth and Titania is very grateful to the penetration testing community. Thanks to you, Nipper Studio is now a multi-award winning, global solution used in over 60 countries and on every continent.

Nipper Studio quickly performs a thorough security assessment of multiple complex network devices, providing a detailed audit report, typically unachievable with scanning based technologies. The audit report can be used in a variety of ways and includes recommendations and commands to mitigate the issues.

It requires no additional services on the device or any agents to be installed and can audit the devices without either scanning or connecting to them (ideal for high security clients!).

Figure 1. Scanning in Nipper Studio

It is designed to be both flexible and easy to use. Functionality can be extended through plugins and allows for custom integration into bespoke systems e.g. for use in continuous monitoring. 

The device configuration can be read in by loading a saved configuration file obtained from the device or by connecting to the device over the network.

Figure 2. Reading a configuration in Nipper Studio

Once a device’s configuration has been processed by Nipper Studio a wide range of report types can be created, such as a penetration tester grade security audit, configuration reporting, compliance analysis, change reporting and more.

An extensive range of options enable you to fine tune and customise your reports with no expert knowledge required.

So if you’re looking at what configuration auditors could do to improve your own ROI, or a tool to aid your clients monitor their internal controls then you can refer to our Nipper Studio overview above.

Other products in the marketplace now have some overlap, but it’s a good guide for what to expect your configuration auditor to deliver.

For more information or to arrange a free trial please contact sales@titania.com

FOSE 2014 - Highlights from Titania

Ian Whiting introduces the FOSE audience to Titania's flagship
product Nipper Studio

On the first day of FOSE, the leading annual event in Washington DC for technology providers to meet with government, Titania CEO, Ian Whiting presented to an audience of delegates among the 8000+ attendees on Titania's flagship network security and compliance audit suite Nipper Studio. 

US government agencies in defense, homeland security and law enforcement, who are already users of Nipper Studio, were able to learn about the many new features included in the latest version of Nipper Studio which has just been released.

Visitors to Titania's stand at the FOSE Expo were also able to learn how the company's suite of audit software solutions will be able to help the US government move to a Continuous Diagnostics and Mitigation (CDM) posture across all federal agencies, which is the subject of a $6 bn budget allocated over the next 5 years, via the Department of Homeland Security. Released by the DHS, the CDM program is intended as a shift from the current static safeguarding of network security in favor of a more dynamic, constant monitoring policy. 

Titania #727 stand

Many visitors to Titania's stand commented favorably on Titania's remarkable record as a small, specialist UK software company in successfully acquiring as valued clients so many of the largest federal government agencies within the US military and civil government communities. 

The second day at FOSE saw many US government officials stopping by at the Titania booth to learn about our innovative solutions for network security and compliance auditing. 

Ian Whiting explaining how the product he created works

Representatives from the Navy, DHS, the State Department and NOAA, among others, were able to hear about the latest updates to current Titania products as well as learning about a major new product launch coming soon.

Nicola Whiting networking at FOSE

Automating Nipper Studio Audits

by Edwin Bentley

About the Author

Edwin Bentley, Software Developer at Titania

Edwin joined Titania in 2011 and has since become a key member of development team, having primary involvement in advancement of both the Nipper Studio and Paws Studio software. He has a keen interest in Information Security and the role that the industry will play in the future advancement of technologies.

Nipper Studio is typically used by security specialists using the graphical interface from their testing desktop environment. However the Nipper Studio system integrators make use of the equally powerful command line interface to integrate the report output into their own setup. This article provides a glimpse in to the integration possibilities by showing how Nipper Studio can be run from the command line and scheduled on Linux and Windows systems.

Running from the command line

Although Nipper Studio has a huge number of different configuration settings, in its most basic form you want to provide it with a configuration to audit and give it a filename to save the report to. So from the command line you could create a report using the following:

nipper --input=router.txt --output=report.html

The above example would make use of the current processing, reporting and save settings. Since the settings are maintained between the command line and graphical interfaces, those settings could be changed using the graphical interface.

To list all the possible configuration settings available on the command line you can use the built-in help system:

nipper --help=all

On Linux systems you could also look at the help using the UNIX man system.

Figure 1. Nipper man page

Nipper Studio includes a variety of different report formats; the ones system integrators are most familiar with are XML and CSV. To write a report out in XML format you can use the following command:

nipper --input=router.txt --xml --output=report.xml

Scheduling on Linux

On Linux I am going to demonstrate using Cron to schedule a job to create a Nipper Studio report. I will assume that you already have a grasp on using command line and Linux utilities, rather than provide a tutorial on the shell and editors.

Typing the command crontab -e will open the crontab file for the current user and will make use of the currently defined command line editor for your shell (see Figure 2).

Figure 2. ‘crontab -e’ command

I am then going to add a line that will schedule a job to run Nipper Studio to process a configuration stored in /configs/myconfig.txt, and save the report to /configs/report.html at 15 minutes past 3 each day.

15 3 * * * nipper --input=/configs/myconfig.txt --output=/configs/report.html

Once you save and exit the editor the changes to your scheduled tasks will take effect, so as to include the new task. If you aren’t comfortable using command line editors, you can just list out the current scheduled task for your user by running the following:

crontab -l >scheduled-tasks.txt

You can then edit this file using a GUI text editor such as Kwrite or Gedit, or whichever your preferred editor is (see Figure 3).

Figure 3. Task scheduling in GUI text editor

Once you have saved the file, running the following command will add it to the schedule:

crontab scheduled-task.txt

I have just used a basic example of processing a single file but Nipper Studio has many other, more advanced capabilities. Cron also has many other scheduling options that I haven’t covered in this article. Using these capabilities, together with other tools, it is possible to automate complete audits, integrate them with bespoke systems, email updated reports and much more.

Scheduling on Windows

As with Linux, Windows also has a task scheduler. This can be found by going to the “Control Panel” then “System and Security”, then “Administrative tools” and finally “Task Scheduler” (see Figure 4).

Figure 4. Task scheduler on Windows

To create a new task, select the “Create Basic Task” from the “Actions” pane or the “Action” menu (see Figure 5).

Figure 5. Creating a new task

A new task wizard will be shown. In the first step I am calling my task “Nipper”. You can also enter a description for the task (see Figure 6).

Figure 6. Wizard task creation

The next page will then allow you to set the frequency of the schedule, with the usual options of daily, weekly, monthly etc. I have selected daily, the same as the Linux example (see Figure 7).

Figure 7. Task frequency options (a)

The next page then allows you to fine tune your selection, for instance if you chose the monthly option, you would be able to select the specific days of the month. You can also set the time that you want the task to run. I am going to set it to 15 minutes past 3 (see Figure 8).

Figure 8. Task frequency options (b)

On the next page I will choose what type of task it is I want to perform. I am going to select the “Start a Program” option. I am then going to specify the Program or script that I want to run. This will be the “nipper. exe” executable that will be found in the installation directory for Nipper Studio, the default is “C:\Program Files\NipperStudio\nipper.exe”.

In the “Add Arguments” I am going to add the options to pass to the command line. This is in the same format as for Linux, so I have entered --input=c:\configs\myconfig.txt --output=c:\configs\report.html (see Figure 9).

Figure 9. Adding arguments

The last page will just show a review of the task that I have created. Clicking on “Finish” will add the task to the scheduler (see Figure 10).

Figure 10. Complete task

Conclusion

There is a broad range of integration possibilities in Nipper Studio, this article set out to provide an insight into just a few. Features such as scheduling and being able to run Nipper Studio from the command line are included to make the software as useful as possible for network managers and auditors.