Titania Joins the Briefing Sessions at Security & Policing 2014

The Security & Policing event hosted by the Home Office at the Farnborough FIVE expo site is a unique opportunity to showcase sensitive cutting edge technologies and confidential products and solutions to police services, governmental departments and agencies from the UK and overseas.

This year’s event will focus on the expansion of an international delegate program, aiming to improve the UK’s export activities. The visitor delegation program will include top decision makers in key areas of the UK’s Security and Defence sector.

The high security standards and strict criteria for visitors and participants ensure a safe environment for sensitive products not available otherwise to the general public. For relevant audiences, Security & Policing offers first-hand access to classified information. 

Source: Security & Policing2014 Exhibitor Brochure

Following the talk from James Quinault, the Director of Cyber Security and Information Assurance, from the Cabinet Office, Andy Williams, Head of International Development at Titania will be speaking on the 11^th of March 2014. The presentation will focus on the innovative use of UK technology across US governmental institutions and the mutual benefits to network security and compliance auditing.

Titania comes with extensive experience in the cyber security field and Andy will also talk about Titania's membership of the Malvern Cyber Cluster and its commitment to supporting the development of cyber innovation and skills. 

Titania’s cybersecurity solutions Nipper Studio and Paws Studio are network security and compliance auditing tools already popular among military and governmental departments, in the US as well as UK, Germany, France and Australia.

Andy will talk about how to begin with, Nipper Studio was trialed by one U.S. Army unit. Subsequently the software was assessed and approved for use on the networks of the armed forces. Later, Paws Studio emerged as an answer to their compliance requirements. It was not long before both tools were shared across a wide variety of government departments and and by organisations in Financial, Communications, Retail and Technology sectors.

The advantage of Nipper Studio is that it can be installed in minutes, it does not store any configuration data and it audits network devices without the need to connect to the network, hence it does not introduce any additional security issues to the organisation. Whilst Paws Studio is a tool that answers today’s requirements for compliance, in line with established policies such as PCI, SANS and DoD STIG. 

click here for details

These tools have been developed with consideration for sensitive data; which is why their security focus makes them attractive to the audience present at Security & Policing. 

                                      click here for details                                                           

If you are attending the show, be sure to visit the briefing sessions. Plenty of relevant information for the cyber community.  

For more information on our cyber security tools, please get in touch at enquiries@titania.com or visit www.titania.com 

Nipper Studio Review

By Jim Halfpenny 

About the Author 

Jim is an experienced IT practitioner with 14 years experience in both academia and industry, working with renowned companies including British Airways, Oracle, BSkyB and Cloudera. 

There’s no shortage of vulnerability assessment tools out there and this time I’m looking at one that’s a little bit different. Nipper Studio from Titania offers a means to audit that often forgotten part of your network: the network itself. Routers, switches, firewalls and other network appliances are the fabric of your network and should definitely be in scope for any rigorous information security program. I've given Nipper Studio a test drive to see how it performs and how it differs from other tools out there.

Firstly it’s worth pointing out that Nipper Studio is not a traditional vulnerability scanner that trawls your network looking for weak spots. Instead you feed Nipper Studio the configuration files from your network devices and it audits them, producing a detailed report. This offline auditing means no traffic is generated by the audit and there’s no need to plug anything into your network, a definite plus for those working in high-security environments. Working from the inside out provides a totally different insight compared to traditional network-based scanners.

Nipper Studio offers good cross-platform support with packages available for Fedora, OpenSuSE, CentOS and Ubuntu flavours of Linux as well as Windows and Mac OS X. I’ve been testing out the version for Ubuntu, which is supplied as .deb packages for 32-bit and 64-bit systems. There is a good range of supported devices with all the usual players such as Cisco, Juniper and Checkpoint represented as well as some of the rising stars like SonicWALL on the list. As well as a GUI tool for generating reports Nipper Studio includes a command line version, very useful for scripting and automating audits.

Some of the wide range of network devices supported are shown above

Fire it up and Nipper Studio starts with a clean UI showing your reporting, configuration options and built-in documentation. Creating a report is as simple as clicking on the new report link and telling it the location of your configuration files. You can add multiple devices to a single report and load previous reports for comparison. Human readable full and summary reports can be generated in several formats including HTML, PDF, PostScript and LaTeX. Additionally you can create CSV, SQL and XML outputs enabling you to further process, report and archive your results.

The Nipper Studio GUI is simple and straightforward to use

The reports may appear on the surface very similar to vulnerability assessment reports from other tools but it is the level of detail that really shows off the benefits of this method of security auditing. Nipper Studio will report on firmware version, timeouts, routing and VLAN configuration, service banners, authentication and other configuration best practice which external scanners may miss. Exposing the internal configuration of the device exposes potential issues that simply cannot be seen from the outside or may be time consuming to evaluate such as weak authentication.

Reports on each finding are very detailed and include a severity level, ease of exploitation and recommendations on how to remedy the issue as well as CVSS v2 scores where applicable. Audits can be customised to include your organisation’s name and logo and to report based on your security organisation’s security policy such as password age and strength. You can also include your own notes and control which sections of the report to include so you can tailor it to the intended audience.

Reports drill down from high-level summary to detailed vulnerability breakdown

An important feature worth mentioning again is the ability to compare the results from previous reports. This enables you to see what has changed between audits and helps you to gauge the progress you’re making in improving the security posture of your network environment as well as highlight new threats. You will also be able to detect unauthorised or unplanned changes to your network outside of your change control process. It’s all too easy to make an ad-hoc change and not document it, with unpleasant consequences further down the line. This is not a tool solely for point-in-time inspection of your network.

Nipper Studio is licensed on a per-device basis starting at $1000 for 25 licenses, working out at $40 per device. As you would expect discounts are available for larger purchases; 1000 or more licenses will set you back $8.50 per device. Compare this to the cost of a manual check by an experienced auditor and you’ll get a figure an order of magnitude less for Nipper Studio as well as the benefit of rapid and repeatable reporting. Is there anything that this product would miss that a trained auditor would catch? Quite possibly, but using this tool for your initial baseline and regular testing means you can cover off the majority of common issues and better spend your remaining security budget more effectively.

Using Nipper Studio for Penetration Testing

by Peter Wood

About the Author

Peter Wood, CEO at First Base Technologies

Pete has worked in the electronics and computer industries for over forty years and founded First Base in 1989. He is a world-renowned security evangelist, speaking at conferences and seminars on ethical hacking and social engineering. He founded First Base Technologies in 1989, providing information security consultancy and security testing to commercial and government clients.  In this case study Pete explains how he came across Nipper Studio security auditing software and why he thinks it is one of the best tools of its kind on the market.




The first time I heard about Nipper Studio was back in 2009 when the product was very new to the market and still in its first version, Nipper One. I received an industry newsletter which featured Nipper and outlined the basic features of the tool. It sounded interesting but at that time it wasn’t a tool that I felt we needed and didn’t take it any further.


Why did you decide to use Nipper Studio?

We first evaluated Nipper Studio in July 2012 when we had a requirement to audit several routers and switches for a large client. After running a few reports I realised the tool was exactly what we were looking for, as all our previous reviews of network devices were done entirely manually. Nipper Studio was the only product we could find that provided this level of detailed configuration audit review. The reports generated from Nipper Studio were easy to read and thorough and it saved us hours of manual work. We have continued to use Nipper Studio to assist with network security audits for our clients and also in-house to audit our own network security devices.

How do you use Nipper Studio at client sites?

One of the great things about Nipper Studio, from a Penetration Tester’s point of view, is that the software can be downloaded onsite and installed in minutes, without causing any disruption to their networks. Furthermore, because Nipper Studio does not store any configuration information and, unlike scanning tools, does not need to connect to the network, using it poses no additional security issues to the organization. 

Once we have Nipper Studio installed it enables us to automate much of the review process without compromising the quality and accuracy of our results. During an engagement we can use the tool to help find vulnerabilities in the device in a fraction of the time it would take us to do manually.

As a result of the extensive amount of devices supported, Nipper Studio enables us to provide a more consistent and accurate set of results, irrespective of the manufacturer or model of device under review. Also because we can install Nipper Studio on multiple machines we are able to use the license for various different customer engagements throughout the year. 

How have your customers benefited from you using Nipper Studio?

It became obvious to us that our clients were facing a problem. They would often come to us asking for us to review the configuration and security of their switches, routers and firewalls. However it is a lengthy and painstaking process to manually audit every network device in a system, especially in the larger organizations. As a result, it was not cost effective to review more than a small sample of an organization’s infrastructure.

Using Nipper Studio means that our clients can now afford to have the security of all their  infrastructure devices checked, rather than just a sample.

How has using Nipper Studio benefited First Base Technologies as a business?

Using Nipper Studio has presented us the opportunity to expand our security reviews at a realistic price. This means our clients expectations have been exceeded while still staying on time and in budget. This gives us an advantage in the market and ultimately helps retain our existing customers and attract new ones.

Nipper Studio 2.3 Now Released

Update now or download a free 30 day evaluation and benefit from the new enhancements such as PCI DSS 3 auditing, software vulnerability analysis, full Unicode support and more…

NipperStudio 2.3 is now available and contains both new features and advancements to the underlying audit technology, providing updates that will benefit all users.

Existing Users: Next time you run Nipper Studio and perform a software update check you will be prompted to download the new version. The latest version can also be manually downloaded by logging on to your Titania account.

New Users: Log on to your Titania account and download the latest version from the Titania web site.

New and Improved Features in Nipper Studio 2.3

·         PCI DSS 3 reporting, using the latest version of the PCI DSS compliance standards. To help make the PCI DSS process simpler, interactive options are available to step the auditor through the process of checking any non-automated elements (e.g. is the documentation up to date?)

·         Vastly improved software vulnerability analysis with the inclusion of the NIST (National Institute of Standards and Technology) NVD (National Vulnerability Database). Plus integration of the vulnerability analysis with OVAL (Open Vulnerability and Assessment Language) templates.

·         STIG improvements with better reporting of findings, the collating of results, better interactive options and more automation of some findings.

·         Improved selection of date formatting including the addition of ISO 8601 date formats.

·         Improved HTML reporting with support for themes using CSS (Cascading Style Sheets). The old reporting theme is also included as the “Classic” theme.

·         Vastly enhanced remote connectivity capabilities using XML-based definitions, enabling the easy expansion of the capability by both users and Titania. Additionally, remote connectivity is now also available from the command line.

·         A new resource manager to enable the ease of updating the resources such as NVD, STIG and OVAL templates. So if a new STIG is released, or an internal version is maintained, then it can easily be imported in to Nipper Studio for immediate use.

·         Improvements with extended characters within device configurations and reports with the full adoption of Unicode throughout.

If you have any questions or would like more information about any of the new  or existing features in Nipper Studio then please don’t hesitate to get in touch.