Security B-Sides MSP 2014 - Automating Compliance

Last week, our team flew across the ocean, to Minneapolis to attend and present at Security B-Sides MSP 2014.





Security B-Sides is an information security event, that follows an "unconference" format and was setup by a few renowned security experts, in 2012, after large hacking conferences (BlackHat, DefCon) experienced a huge amount of subscriptions to their CfP (Call for Papers) and simply ran out of space to accommodate them all. 

Just discussed the #BSidesMSP 2014 documentary with the crew, this is going to be fantastic. May put it up at #Minnesota film festivals :-)

— Security B-Sides MSP (@BSidesMSP) August 27, 2014

#BSidesMSP 2014 Speaker Presentations Posted! https://t.co/Zx5CkTjvEv http://t.co/Pj47hcVwCu https://t.co/YRePLvQz0I @SecurityBSides

— Security B-Sides MSP (@BSidesMSP) August 26, 2014

#BSidesMSP would like to thank the amazing @TitaniaLimited again for being one of our #sponsors!

— Security B-Sides MSP (@BSidesMSP) August 20, 2014

Our team came to discuss Automating Compliance. Titania's founder, Ian Whiting, spoke about his background as a penetration tester, the concept behind creating the network security auditing and compliance tools, Nipper Studio and Paws Studio and why he thinks it is essential that software "should just work". 


My background is a penetration tester. I used to be one of those geeks, hackers that would sit in the corner of the room, and got the blame for everything that went wrong: "it must be the guy coming in doing the auditing that's causing all of these network problems today."

I used to have to run a wide variety of different kind of tools to do those jobs and it's very important to understand exactly what the software is doing, but also to understand the weaknesses of the software.

I was once given a job, many years ago, to audit some network switches and I think it's very important that auditors' time is best spent doing things that require a human to look at, while things that are fairly mundane and routine are excellent candidates for automation. I truly believe that. So I sat down and someone gave me 30 configs for different switches to go through manually. At this point I thought: "now is the time to start automating this kind of process. It's a very mundane task, computers are ideal at automating those very basic checks".

One of the things that being a penetration tester has led me very strongly to believe is that all software should be easy to use. I don't care if it takes the software developer an extra 6 months to code a bit of software. For the users it should be intuitive and easy to use. It should be there to help you and it should go hand in hand with the way you work, in order to reduce the amount of time that it takes you to audit. It should just work. I don't want a bit of software that I install on a system and then have to tweak  for the next half an hour, using Google to try and work out what's going wrong and fix it along the way. It's one of the founding principles of the software that we develop. 



We have a product called Nipper Studio which automates the auditing of firewalls, routers, switches and your various network infrastructure devices and another called Paws Studio, which does similar things for servers and workstations. Both products offer free evaluations, so that you can give it a go on your own platform. One of the things I think it's very important, is to be able to try these things for yourself. You shouldn't have to go and buy something blind, in the hope that what the sales person told you about the product is true and that it's going to do what they said it'd do. You have to try things out for yourself and that's why we provide evaluations for our software. 

Download your free evaluation license here. 

Although the first edition of the Minnesota chapter, the event was appreciated by the industry and praised by the media. 

Aside from numerous talks from cyber security experts (an overview of the talks can be found in this previous post), the keynote opening speech was delivered by a legend in the Chinese cyber warfare arena: Lt. Col. (ret) William Hagestad (@RedDragon1949). A very worthwhile talk to listen to and the Colonel is a very engaging presence on the scene. The talk can be found here and it is number 2 on the list, right after the Opening Ceremonies from Matthew J. Harmon, Bradley Ammerman and Tom O'Neill. You can also read the story in CSO Online: Why our lack of understanding on China may be the biggest risk 

An overview of all the talks can be found in our previous post, or viewed / downloaded
off the Security B-Sides wiki.



Video and images courtesy of @mjharmon

Configuration Auditing: The Hygienist You've Always Wanted

by Nicola Whiting (COO, Titania)

About the Author

Nicola Whiting is Titania Ltd’s Chief Operating Officer and has a solid reputation for increasing revenues and profitability within technology based SME environments. She joined the team in 2011 has overseen a period of intense growth and change. Now Nicola’s focus is on extending the organizational capabilities and workforce skills, in order to continue to embrace innovation.



For many, configuration security ranks about the same as dental hygiene.

Critical infrastructure devices such as firewalls, switches and routers need to be secured against external hackers and internal threats, but it’s not seen as exciting and does not rank highly on boardroom agendas.

Source: evlad.com 

The most common result is to use a dual approach, combining scanning or agent based software, with annual penetration test reviews – to use the same analogy, daily brushing and an annual trip to the dentist.

This two-layer response does offer some advantage, it’s great for regular big-picture analytics (the ones that boardrooms like) and the annual penetration testers do a thorough job of analysing vulnerabilities and providing a detailed report.

Unfortunately as anyone with a mouthful of fillings can testify, it also often lets the rot set in!

The Dual Response Issue

Network scanners send huge numbers of network probes to a device and can impact performance. Only exposed vulnerabilities are identified, this potentially misses many issues that would be found with a detailed manual audit.

Agent-based audit software requires software to be installed on the audit devices and this is not possible for all devices. Furthermore, the required agent software can introduce additional security vulnerabilities.

Penetration testing requires expert level knowledge and is one of the most widely used and trusted forms of detailed security analysis. The process involves simulating an attack on your network systems through active exploitation of security vulnerabilities. To the resident network team, it can feel like the equivalent of lining up for a root canal….

Typically your primary goal is to test the operational capability of your network defenses to successfully detect and respond to attacks. Depending on the agreed scope of the test, reported elements may include: hardware and software vulnerabilities, poor or improper system configuration and suggested improvements to operational processes.

Part of the testing process may involve a manual configuration review.

Examining individual device configurations is highly time-consuming with significant manpower costs. Typically this results in point in time audits, extrapolating results from a sample of devices and potentially leaving vulnerabilities on non-assessed devices.

The Third Option

Early in his career as a Penetration Tester and CHECK team leader, Ian Whiting (CEO of Titania Ltd) realized there was a third option that was not being provided within the security marketplace. He realized that by automating the detailed configuration vulnerability analysis he could improve auditing speed, accuracy and return on investment.

His initial requirements were to:

• Flatten the security assessment process
• Achieve significant cost savings on current audit practices
• Improve the productivity of the audit process
• Reduce human error factor through automation
• Provide instant, device-specific expertise to non-specialist auditors

Through many years of hard work he developed a configuration auditing solution, that is now a “go to” tool in both SME and global Penetration Testers tool kits and has grown far past its original brief.

The “Configuration Hygienist” 

Whilst penetration testers are typically both highly skilled and adaptable, you cannot be expected to have in depth knowledge of every system you come across! The same is also true of the network administrators who manage those systems, they may not have the in-depth security background required to identify potential weaknesses in their systems.

Typically your penetration tester’s toolkit is not something you can pass on, but as a “cyber hygiene” professional, it makes sense to look for ways to reduce the likelihood of vulnerability cavities developing between visits.

The interim use of a cost effective configuration auditor widens the potential for detailed device analysis and on-going identification of potential security weaknesses. Return visits can then be less about finding conflicting rules and compliance failures and allow more focus on operational improvements and higher level security issues.

Nipper Studio - Configuration Auditing Tool

Nipper Studio’s early growth was entirely by word of mouth and Titania is very grateful to the penetration testing community. Thanks to you, Nipper Studio is now a multi-award winning, global solution used in over 60 countries and on every continent.

Nipper Studio quickly performs a thorough security assessment of multiple complex network devices, providing a detailed audit report, typically unachievable with scanning based technologies. The audit report can be used in a variety of ways and includes recommendations and commands to mitigate the issues.

It requires no additional services on the device or any agents to be installed and can audit the devices without either scanning or connecting to them (ideal for high security clients!).

Figure 1. Scanning in Nipper Studio

It is designed to be both flexible and easy to use. Functionality can be extended through plugins and allows for custom integration into bespoke systems e.g. for use in continuous monitoring. 

The device configuration can be read in by loading a saved configuration file obtained from the device or by connecting to the device over the network.

Figure 2. Reading a configuration in Nipper Studio

Once a device’s configuration has been processed by Nipper Studio a wide range of report types can be created, such as a penetration tester grade security audit, configuration reporting, compliance analysis, change reporting and more.

An extensive range of options enable you to fine tune and customise your reports with no expert knowledge required.

So if you’re looking at what configuration auditors could do to improve your own ROI, or a tool to aid your clients monitor their internal controls then you can refer to our Nipper Studio overview above.

Other products in the marketplace now have some overlap, but it’s a good guide for what to expect your configuration auditor to deliver.

For more information or to arrange a free trial please contact sales@titania.com

First@FOSE 2014 Exhibitor Gallery

This year at FOSE, there is a healthy focus on the first time exhibitors at the show. Titania is delighted to present during the F1rst@FOSE sessions, along with other companies and government organizations, on Tuesday, the 13th of May 2014. 

Below, you can find a gallery of other exhibitors that will showcase new solutions on the F1rst stage over the next three days:

Infosec 2014 Highlights

A week after Infosec, we can look back and say it was a great show. Twenty years on, it still successfully delivers insights into the dynamic market of information security. With 340 companies, of which 80 were new exhibitors, special country pavilions for 24 international representatives and a great wealth of products, tools and services, there was plenty on offer. 

Source: @InfoSec_Joy

The discussions and panels were up to date with current changes to the economy, legislation and global trends in cybersecurity and experts, such as Peter Wood, Mikko Hypponen, Graham Cluley, Dr. Eric Cole, Rik Ferguson and James Lyne, attracted audiences with panel debates and thought-provoking updates on the industry. 

James Lyne (left) and Rik Ferguson (right) on a thought-provoking revelation Credits to @DanRaywood

      As cybercrime increases, cybersecurity will constitute a business driver in the future. 

Many speeches and presentations have brought fresh views for information security professionals, but the one we liked best was MP David Willetts’ keynote speech. The highlight of his keynote at Infosec has been the 2014 Cyber Security Breaches Survey launch. As he went through the highlights of the survey, he also reminded the audience of how the Cyber Growth Partnership "aims to increase the value of cyber security exports to £2bn a year by 2016". As cybercrime is a costly strain on UK business, cybersecurity can be a chance to boost the country’s economy. 

 Peter Wood moderates the debate. Source: scmagazineuk.com

  Meanwhile, Peter Wood, CEO at First Base Technologies, and a keen user of Nipper Studio, moderated a panel debate on "Security as a Business Enabler". The general consensus of the conversation was that while there's little evidence to support that information security actively brings in profits, global breaches have shown that they do drive away business. He also found time to drop by our stand for a quick catch up - Thank you, Peter!

   The Malvern Cyber Security Cluster is growing. 

   

      But for the cyber security companies trading from the “cyber valley”, there was good news as the Minister, David Willetts, congratulated the  7 winners of a total of £500 000 in investments for R&D from the Technology Strategy Board. 

      It was rewarding to see that the Malvern Cyber Security Cluster is taking centre-stage at an event such as Infosec Europe. D-RisQ Ltd, Montvieux Limited, PixelPin, C2B2, Infinite Precision Ltd, Babble IT Systems Ltd, Westgate Cyber Security Ltd deserve congratulations for their innovation and techniques in the cyber security industry. 

 Titania's software and updates proved attractive to visitors once again. 

Titania went to Infosec with great products, a relentless team, champagne and a lot of chocolate. We came back with fresh questions to answer, plenty of compliments and (sadly!) no more chocolate. 

    

Mark & Peter (Hedgehog Security) & Steve Penny (middle)

We saw an increased interest in compliance and security auditing this year, as well as answering a lot of questions on our upcoming product - TEC. We met lots of friends on the Malvern Cyber Cluster stand as we took turns to attend to the booth – Advent Security, Borwell, DeepSecure, UK Cyber Security Association, Sutcliffe & Co., Hedgehog Security.

 

At the end we bumped into Pen Test Partners when we went out for some well-deserved burgers. To our surprise the burgers did not come from their ad-hoc kitchen – apparently their “cooking” skills were a tad more sophisticated.  

Pentest's Kitchen... Cooking up some AV Source: pentestpartners.com

Finally, back in the office, our team celebrated with a bottle of champagne...

The team (from left to right): Neil, Charlotte, Ian, Nicola, Kelly, Nigel, Andy

Plaudits for the PCI Audits

First published in Computing Security magazine


By Ian Whiting (CEO, Titania) 

About the Author 

Ian has been working with leading global organizations and government agencies to help improve computer security for more than a decade. He has previously been accredited by CESG for his security and team leading expertise for over 5 years. In 2009 Ian Whiting founded Titania with the aim of producing security auditing software products that can be used by non-security specialists and provide the detailed analysis that traditionally only an experienced penetration tester could achieve.

Non-compliance is no longer an option, yet conflicting views still exist upon compliance and security, and what they mean for an organisation. After numerous high-profile breaches (Target, Neiman Marcus), PCI DSS has come heavily under the spotlight. The full extent of these attacks is yet to be revealed, but the compliance industry is already changing to cater to the ever-increasing threats and vulnerabilities that affect the card payment protection industry.

PCI DSS 3.0, which was announced in November 2013, will remain under 'best practice' guidelines until 30 December 2014. The new version addresses some of the issues reported by the industry, such as education, awareness, securing cardholder data and inconsistency in assessments, which have led to poor security practices and compliance failures.

CHANGES TO PENETRATION TEST REQUIREMENTS 
According to Verizon's 2014 PCI Compliance Report, Requirement 11 'was the least complied-with requirement […]. Just 23.8% of companies met all the controls between 2011 and 2013'. Requirement 11 concerns vulnerability scanning and penetration testing, and 11.3 in particular specifically deals with the demands of penetration testing. Outlined below are three major changes to Requirement 11:

1. External and internal penetration testing is to be carried out at least annually. This also requires tests to be performed after significant infrastructure or application upgrades. Recommendations include the tests to be performed by a qualified internal resource or a qualified external third-party, according to a defined methodology. In this case, the tester is not required to be a QSA or ASV (Approved Scanning Vendor).

2. Fix exploitable vulnerabilities found during penetration testing and repeat testing to verify corrections. The tests should be undertaken at least annually and after significant changes to the environment - eg, an operating system upgrade or web server additions.

3. Annual penetration tests that verify segmentation is used to isolate the Cardholder Data Environment (CDE). PCI DSS 3.0 guidance advises that penetration testing is to be used to assess how effective the segmentation that isolates CDE from other networks is. It specifies that the testing methodology should be reviewed to ensure all segmentation methods are covered, as well as verifying there is no connectivity between in-scope and out-of-scope networks. The tests should be performed annually and in light of any changes to segmentation controls or methods. These changes outline that, in order to combat the increasing threat, the detail and frequency of internal and external audits needs to increase (especially after system upgrades).

Although some worry that this will put extra time and financial pressures on companies meeting the PCI DSS standard, the reality is that the quality and frequency of tests is often sacrificed by companies for the sake of 'ticking the box'. The refined recommendations for defined methodologies and specified frequency should, in fact, help level the market and provide a fair deal to organisations shopping around for the best pen testing solutions.

Although some PCI requirements are such that no tool can truly perform a fully automated assessment, there is a plethora of cost-effective auditing tools that can help increase speed and accuracy of PCI audits. These can not only be used to ease the cost of internal audits, but also by pen testers to offer more thorough assessments without significantly impacting costs.

Titania at Interop 2014 - Coming to America

Source: internetworld.com

… Except unlike Eddie Murphy, we’re not coming to get a bride. We’re coming to show off Nipper Studio and Paws Studio – the network security software, that gained praise all over the world from government agencies and departments like the FBI, Department of Defense, The Treasury, the Department of Energy as well as corporate giants (Cisco, HP, Verizon to name just a few).

Penetration testers in over 60 countries have chosen us and have not been disappointed, why don’t you visit us at booth 962 to find out why? We’ll be there from Tuesday (1st April 2014) to Thursday (3rd April 2014).

Why Interop?

It’s a chance for you to meet the team, find out what we do and trial our cyber security solutions. It is also a chance for us to meet with interesting people, future clients and keep up with the latest trends in the world of networks, security, auditing and compliance. We would also like to take part in thought-provoking discussions and strengthen our relationships across the Atlantic. With 60% of our business taking place in the United States, we are sure to meet some familiar faces for a good catch up over those famous American pancakes.  

Source: interop.com

What do we expect?

As we put the finishing touches to the preparations for the show, there’s a tinge of excitement over what the experience will be like. There’s no doubt this is one of the biggest independent IT conferences of the year.  So many infosec professionals all in one place; it’s bound to be a buzzing atmosphere, filled with BYOD, SDN, IoT all sprinkled with lots of LEDs. If there’s anything that won’t be missing that’s the flashing lights.

The expo floor has seen a lot of changes in the 28 years that it’s been running filled with weird and wonderful things from the flying monkeys, to cars and motorbikes, either as props or as giveaways. Yet, the infosec community still gets excited by the quality of the talks, the disruptive technology and the efficacy of the workshops. Striking the right balance between work and fun makes sense, doesn't it?

But we expect to see plenty of security conscious organisations and government representatives, to filter through the flash and glitz in search for the best cyber solutions. After all, it’s not for nothing that the US is at the forefront of cyber defence, is it? And it explains why Titania has thrived in the American information security market.  

What do we have for you?

Our very own CEO – Ian Whiting, an experienced infosec professional, previously certified by CESG (Communications-Electronics Security Group) - will be there to answer your questions. Plus we have an expert team ready to give you all the information you need and a tool which brings even more features to answer the ever-increasing demands of today’s CIO. Andy Williams, Titania's Head of International Development is experienced in liaising with companies across the ocean having worked for 6 years as an international trade advisor for the US Department of Commerce, at the American Embassy in London. Or in fewer words, he’s our go-to expert for those interested in a serious business relationship.

Aside from reading about our products, we suggest you also stop by for a quick demo and an evaluation license, so that you can take your time and try out our software, after the Interop party.

Nipper Studio Review

By Jim Halfpenny 

About the Author 

Jim is an experienced IT practitioner with 14 years experience in both academia and industry, working with renowned companies including British Airways, Oracle, BSkyB and Cloudera. 

There’s no shortage of vulnerability assessment tools out there and this time I’m looking at one that’s a little bit different. Nipper Studio from Titania offers a means to audit that often forgotten part of your network: the network itself. Routers, switches, firewalls and other network appliances are the fabric of your network and should definitely be in scope for any rigorous information security program. I've given Nipper Studio a test drive to see how it performs and how it differs from other tools out there.

Firstly it’s worth pointing out that Nipper Studio is not a traditional vulnerability scanner that trawls your network looking for weak spots. Instead you feed Nipper Studio the configuration files from your network devices and it audits them, producing a detailed report. This offline auditing means no traffic is generated by the audit and there’s no need to plug anything into your network, a definite plus for those working in high-security environments. Working from the inside out provides a totally different insight compared to traditional network-based scanners.

Nipper Studio offers good cross-platform support with packages available for Fedora, OpenSuSE, CentOS and Ubuntu flavours of Linux as well as Windows and Mac OS X. I’ve been testing out the version for Ubuntu, which is supplied as .deb packages for 32-bit and 64-bit systems. There is a good range of supported devices with all the usual players such as Cisco, Juniper and Checkpoint represented as well as some of the rising stars like SonicWALL on the list. As well as a GUI tool for generating reports Nipper Studio includes a command line version, very useful for scripting and automating audits.

Some of the wide range of network devices supported are shown above

Fire it up and Nipper Studio starts with a clean UI showing your reporting, configuration options and built-in documentation. Creating a report is as simple as clicking on the new report link and telling it the location of your configuration files. You can add multiple devices to a single report and load previous reports for comparison. Human readable full and summary reports can be generated in several formats including HTML, PDF, PostScript and LaTeX. Additionally you can create CSV, SQL and XML outputs enabling you to further process, report and archive your results.

The Nipper Studio GUI is simple and straightforward to use

The reports may appear on the surface very similar to vulnerability assessment reports from other tools but it is the level of detail that really shows off the benefits of this method of security auditing. Nipper Studio will report on firmware version, timeouts, routing and VLAN configuration, service banners, authentication and other configuration best practice which external scanners may miss. Exposing the internal configuration of the device exposes potential issues that simply cannot be seen from the outside or may be time consuming to evaluate such as weak authentication.

Reports on each finding are very detailed and include a severity level, ease of exploitation and recommendations on how to remedy the issue as well as CVSS v2 scores where applicable. Audits can be customised to include your organisation’s name and logo and to report based on your security organisation’s security policy such as password age and strength. You can also include your own notes and control which sections of the report to include so you can tailor it to the intended audience.

Reports drill down from high-level summary to detailed vulnerability breakdown

An important feature worth mentioning again is the ability to compare the results from previous reports. This enables you to see what has changed between audits and helps you to gauge the progress you’re making in improving the security posture of your network environment as well as highlight new threats. You will also be able to detect unauthorised or unplanned changes to your network outside of your change control process. It’s all too easy to make an ad-hoc change and not document it, with unpleasant consequences further down the line. This is not a tool solely for point-in-time inspection of your network.

Nipper Studio is licensed on a per-device basis starting at $1000 for 25 licenses, working out at $40 per device. As you would expect discounts are available for larger purchases; 1000 or more licenses will set you back $8.50 per device. Compare this to the cost of a manual check by an experienced auditor and you’ll get a figure an order of magnitude less for Nipper Studio as well as the benefit of rapid and repeatable reporting. Is there anything that this product would miss that a trained auditor would catch? Quite possibly, but using this tool for your initial baseline and regular testing means you can cover off the majority of common issues and better spend your remaining security budget more effectively.

Using Nipper Studio for Penetration Testing

by Peter Wood

About the Author

Peter Wood, CEO at First Base Technologies

Pete has worked in the electronics and computer industries for over forty years and founded First Base in 1989. He is a world-renowned security evangelist, speaking at conferences and seminars on ethical hacking and social engineering. He founded First Base Technologies in 1989, providing information security consultancy and security testing to commercial and government clients.  In this case study Pete explains how he came across Nipper Studio security auditing software and why he thinks it is one of the best tools of its kind on the market.




The first time I heard about Nipper Studio was back in 2009 when the product was very new to the market and still in its first version, Nipper One. I received an industry newsletter which featured Nipper and outlined the basic features of the tool. It sounded interesting but at that time it wasn’t a tool that I felt we needed and didn’t take it any further.


Why did you decide to use Nipper Studio?

We first evaluated Nipper Studio in July 2012 when we had a requirement to audit several routers and switches for a large client. After running a few reports I realised the tool was exactly what we were looking for, as all our previous reviews of network devices were done entirely manually. Nipper Studio was the only product we could find that provided this level of detailed configuration audit review. The reports generated from Nipper Studio were easy to read and thorough and it saved us hours of manual work. We have continued to use Nipper Studio to assist with network security audits for our clients and also in-house to audit our own network security devices.

How do you use Nipper Studio at client sites?

One of the great things about Nipper Studio, from a Penetration Tester’s point of view, is that the software can be downloaded onsite and installed in minutes, without causing any disruption to their networks. Furthermore, because Nipper Studio does not store any configuration information and, unlike scanning tools, does not need to connect to the network, using it poses no additional security issues to the organization. 

Once we have Nipper Studio installed it enables us to automate much of the review process without compromising the quality and accuracy of our results. During an engagement we can use the tool to help find vulnerabilities in the device in a fraction of the time it would take us to do manually.

As a result of the extensive amount of devices supported, Nipper Studio enables us to provide a more consistent and accurate set of results, irrespective of the manufacturer or model of device under review. Also because we can install Nipper Studio on multiple machines we are able to use the license for various different customer engagements throughout the year. 

How have your customers benefited from you using Nipper Studio?

It became obvious to us that our clients were facing a problem. They would often come to us asking for us to review the configuration and security of their switches, routers and firewalls. However it is a lengthy and painstaking process to manually audit every network device in a system, especially in the larger organizations. As a result, it was not cost effective to review more than a small sample of an organization’s infrastructure.

Using Nipper Studio means that our clients can now afford to have the security of all their  infrastructure devices checked, rather than just a sample.

How has using Nipper Studio benefited First Base Technologies as a business?

Using Nipper Studio has presented us the opportunity to expand our security reviews at a realistic price. This means our clients expectations have been exceeded while still staying on time and in budget. This gives us an advantage in the market and ultimately helps retain our existing customers and attract new ones.

Automating Nipper Studio Audits

by Edwin Bentley

About the Author

Edwin Bentley, Software Developer at Titania

Edwin joined Titania in 2011 and has since become a key member of development team, having primary involvement in advancement of both the Nipper Studio and Paws Studio software. He has a keen interest in Information Security and the role that the industry will play in the future advancement of technologies.

Nipper Studio is typically used by security specialists using the graphical interface from their testing desktop environment. However the Nipper Studio system integrators make use of the equally powerful command line interface to integrate the report output into their own setup. This article provides a glimpse in to the integration possibilities by showing how Nipper Studio can be run from the command line and scheduled on Linux and Windows systems.

Running from the command line

Although Nipper Studio has a huge number of different configuration settings, in its most basic form you want to provide it with a configuration to audit and give it a filename to save the report to. So from the command line you could create a report using the following:

nipper --input=router.txt --output=report.html

The above example would make use of the current processing, reporting and save settings. Since the settings are maintained between the command line and graphical interfaces, those settings could be changed using the graphical interface.

To list all the possible configuration settings available on the command line you can use the built-in help system:

nipper --help=all

On Linux systems you could also look at the help using the UNIX man system.

Figure 1. Nipper man page

Nipper Studio includes a variety of different report formats; the ones system integrators are most familiar with are XML and CSV. To write a report out in XML format you can use the following command:

nipper --input=router.txt --xml --output=report.xml

Scheduling on Linux

On Linux I am going to demonstrate using Cron to schedule a job to create a Nipper Studio report. I will assume that you already have a grasp on using command line and Linux utilities, rather than provide a tutorial on the shell and editors.

Typing the command crontab -e will open the crontab file for the current user and will make use of the currently defined command line editor for your shell (see Figure 2).

Figure 2. ‘crontab -e’ command

I am then going to add a line that will schedule a job to run Nipper Studio to process a configuration stored in /configs/myconfig.txt, and save the report to /configs/report.html at 15 minutes past 3 each day.

15 3 * * * nipper --input=/configs/myconfig.txt --output=/configs/report.html

Once you save and exit the editor the changes to your scheduled tasks will take effect, so as to include the new task. If you aren’t comfortable using command line editors, you can just list out the current scheduled task for your user by running the following:

crontab -l >scheduled-tasks.txt

You can then edit this file using a GUI text editor such as Kwrite or Gedit, or whichever your preferred editor is (see Figure 3).

Figure 3. Task scheduling in GUI text editor

Once you have saved the file, running the following command will add it to the schedule:

crontab scheduled-task.txt

I have just used a basic example of processing a single file but Nipper Studio has many other, more advanced capabilities. Cron also has many other scheduling options that I haven’t covered in this article. Using these capabilities, together with other tools, it is possible to automate complete audits, integrate them with bespoke systems, email updated reports and much more.

Scheduling on Windows

As with Linux, Windows also has a task scheduler. This can be found by going to the “Control Panel” then “System and Security”, then “Administrative tools” and finally “Task Scheduler” (see Figure 4).

Figure 4. Task scheduler on Windows

To create a new task, select the “Create Basic Task” from the “Actions” pane or the “Action” menu (see Figure 5).

Figure 5. Creating a new task

A new task wizard will be shown. In the first step I am calling my task “Nipper”. You can also enter a description for the task (see Figure 6).

Figure 6. Wizard task creation

The next page will then allow you to set the frequency of the schedule, with the usual options of daily, weekly, monthly etc. I have selected daily, the same as the Linux example (see Figure 7).

Figure 7. Task frequency options (a)

The next page then allows you to fine tune your selection, for instance if you chose the monthly option, you would be able to select the specific days of the month. You can also set the time that you want the task to run. I am going to set it to 15 minutes past 3 (see Figure 8).

Figure 8. Task frequency options (b)

On the next page I will choose what type of task it is I want to perform. I am going to select the “Start a Program” option. I am then going to specify the Program or script that I want to run. This will be the “nipper. exe” executable that will be found in the installation directory for Nipper Studio, the default is “C:\Program Files\NipperStudio\nipper.exe”.

In the “Add Arguments” I am going to add the options to pass to the command line. This is in the same format as for Linux, so I have entered --input=c:\configs\myconfig.txt --output=c:\configs\report.html (see Figure 9).

Figure 9. Adding arguments

The last page will just show a review of the task that I have created. Clicking on “Finish” will add the task to the scheduler (see Figure 10).

Figure 10. Complete task

Conclusion

There is a broad range of integration possibilities in Nipper Studio, this article set out to provide an insight into just a few. Features such as scheduling and being able to run Nipper Studio from the command line are included to make the software as useful as possible for network managers and auditors.