Titania at Interop 2014 - Coming to America

Source: internetworld.com

… Except unlike Eddie Murphy, we’re not coming to get a bride. We’re coming to show off Nipper Studio and Paws Studio – the network security software, that gained praise all over the world from government agencies and departments like the FBI, Department of Defense, The Treasury, the Department of Energy as well as corporate giants (Cisco, HP, Verizon to name just a few).

Penetration testers in over 60 countries have chosen us and have not been disappointed, why don’t you visit us at booth 962 to find out why? We’ll be there from Tuesday (1st April 2014) to Thursday (3rd April 2014).

Why Interop?

It’s a chance for you to meet the team, find out what we do and trial our cyber security solutions. It is also a chance for us to meet with interesting people, future clients and keep up with the latest trends in the world of networks, security, auditing and compliance. We would also like to take part in thought-provoking discussions and strengthen our relationships across the Atlantic. With 60% of our business taking place in the United States, we are sure to meet some familiar faces for a good catch up over those famous American pancakes.  

Source: interop.com

What do we expect?

As we put the finishing touches to the preparations for the show, there’s a tinge of excitement over what the experience will be like. There’s no doubt this is one of the biggest independent IT conferences of the year.  So many infosec professionals all in one place; it’s bound to be a buzzing atmosphere, filled with BYOD, SDN, IoT all sprinkled with lots of LEDs. If there’s anything that won’t be missing that’s the flashing lights.

The expo floor has seen a lot of changes in the 28 years that it’s been running filled with weird and wonderful things from the flying monkeys, to cars and motorbikes, either as props or as giveaways. Yet, the infosec community still gets excited by the quality of the talks, the disruptive technology and the efficacy of the workshops. Striking the right balance between work and fun makes sense, doesn't it?

But we expect to see plenty of security conscious organisations and government representatives, to filter through the flash and glitz in search for the best cyber solutions. After all, it’s not for nothing that the US is at the forefront of cyber defence, is it? And it explains why Titania has thrived in the American information security market.  

What do we have for you?

Our very own CEO – Ian Whiting, an experienced infosec professional, previously certified by CESG (Communications-Electronics Security Group) - will be there to answer your questions. Plus we have an expert team ready to give you all the information you need and a tool which brings even more features to answer the ever-increasing demands of today’s CIO. Andy Williams, Titania's Head of International Development is experienced in liaising with companies across the ocean having worked for 6 years as an international trade advisor for the US Department of Commerce, at the American Embassy in London. Or in fewer words, he’s our go-to expert for those interested in a serious business relationship.

Aside from reading about our products, we suggest you also stop by for a quick demo and an evaluation license, so that you can take your time and try out our software, after the Interop party.

Titania Joins the Briefing Sessions at Security & Policing 2014

The Security & Policing event hosted by the Home Office at the Farnborough FIVE expo site is a unique opportunity to showcase sensitive cutting edge technologies and confidential products and solutions to police services, governmental departments and agencies from the UK and overseas.

This year’s event will focus on the expansion of an international delegate program, aiming to improve the UK’s export activities. The visitor delegation program will include top decision makers in key areas of the UK’s Security and Defence sector.

The high security standards and strict criteria for visitors and participants ensure a safe environment for sensitive products not available otherwise to the general public. For relevant audiences, Security & Policing offers first-hand access to classified information. 

Source: Security & Policing2014 Exhibitor Brochure

Following the talk from James Quinault, the Director of Cyber Security and Information Assurance, from the Cabinet Office, Andy Williams, Head of International Development at Titania will be speaking on the 11^th of March 2014. The presentation will focus on the innovative use of UK technology across US governmental institutions and the mutual benefits to network security and compliance auditing.

Titania comes with extensive experience in the cyber security field and Andy will also talk about Titania's membership of the Malvern Cyber Cluster and its commitment to supporting the development of cyber innovation and skills. 

Titania’s cybersecurity solutions Nipper Studio and Paws Studio are network security and compliance auditing tools already popular among military and governmental departments, in the US as well as UK, Germany, France and Australia.

Andy will talk about how to begin with, Nipper Studio was trialed by one U.S. Army unit. Subsequently the software was assessed and approved for use on the networks of the armed forces. Later, Paws Studio emerged as an answer to their compliance requirements. It was not long before both tools were shared across a wide variety of government departments and and by organisations in Financial, Communications, Retail and Technology sectors.

The advantage of Nipper Studio is that it can be installed in minutes, it does not store any configuration data and it audits network devices without the need to connect to the network, hence it does not introduce any additional security issues to the organisation. Whilst Paws Studio is a tool that answers today’s requirements for compliance, in line with established policies such as PCI, SANS and DoD STIG. 

click here for details

These tools have been developed with consideration for sensitive data; which is why their security focus makes them attractive to the audience present at Security & Policing. 

                                      click here for details                                                           

If you are attending the show, be sure to visit the briefing sessions. Plenty of relevant information for the cyber community.  

For more information on our cyber security tools, please get in touch at enquiries@titania.com or visit www.titania.com 

A Tool That Tells a Tale

Richard Hatch, IT Security Consultant at Portcullis

About the Author

Richard Hatch is a software engineering graduate who joined Portcullis in 2011. As an IT security consultant he carries out penetration testing, writes reports, develops tools and supports in-house capabilities. He has an interest in reverse engineering.

Portcullis is committed to providing a comprehensive IT security consultancy for our clients to ensure that their networks and websites are secure from threat of attack. As a leading UK service provider, we assist our clients through penetration testing, digital forensic services, incident response, training and bespoke consultancy services to ensure they have a true sense of security.

Portcullis can complete tests under the CREST and CESG CHECK schemes. www.portcullis-security.com

At Portcullis we understand the benefits of automating data gathering and parsing data with tools to quickly extract pertinent information. Such information can be used to automatically run additional targeted checks against certain network services for example. This enables a penetration tester to be quickly alerted about known security issues and provides references to related vulnerability information, e.g. matching Metasploit exploits to Nessus output.

When it comes to performing security assessments of network devices such as firewalls, routers or switches then Nipper Studio is the first tool we reach for.

After running a Nipper Studio audit, the report is presented (as HTML) within an embedded browser. Nipper Studio also allows the user to export that report in a number of easily selectable formats (CSV, txt, HTML, XML etc.). A nice feature of the presented report is the cross-linked references to issues, tables, etc. which enables the user to drill down in to logical names present in rules (such as object groups). Any passwords, some of which are decoded from the obfuscated forms, can either be displayed inside the report or masked.

Additionally, Nipper Studio reports on known software vulnerability issues for the device firmware version, without the need for an active Internet connection. This saves time that can then be spent reviewing the issues identified or considering the device within the business context. For example does the device adequately fulfill the role it is supposed to play, or should additional rules be present to address specific needs or concerns of our customer?

The options to perform checks against different compliance policies, as well as differential comparisons (a “before” and “after” review to highlight changes), makes what would be a time-consuming and challenging task a quick and straight-forward one.

The output formats supported by Nipper Studio enables our penetration testers to use bespoke tools to process the report output and process references such as CVE numbers. These are then imported in to our own custom reporting tools.

The explanation of the issue findings in Nipper Studio also serve as both an insight and a reminder when encountering some of the more obscure issues or features present on a device. For instance a configuration file command that starts “glbp” may not be immediately recognised by a tester as the Gateway Load Balancing Protocol, a proprietary Cisco protocol. The issue help text from Nipper Studio expands such acronyms and enables the tester to recall their understanding of the technology invoked by the “glbp” technology.

The benefits of using Nipper Studio for security analysts mirror those for the client: It offers a faster, potentially more in-depth review with more technical detail available. Furthermore is has the ability to determine if a device adheres to necessary compliance policies, documented design rules, or what configuration changes are present against a known baseline. For example, imagine a company detects that their internal network has been compromised, but are unsure if the attacker gained access to a router and changed the configuration (to breach network segregation). They can quickly compare the current
configuration against the Nipper Studio report of a known-good configuration that could not have been affected by a hacker, (e.g. stored on a backup CD that is held in a safe at another location).

In one case, a client had asked for a security assessment of a firewall, with specific consideration given to the protection of key network assets. The firewall had a large number of rules configured and there was a chance that the assessment could not have been completed in the time available. By using Nipper Studio to automate the time consuming process of manually identifying issues, the tester was able to take a “step back”. With the help of a network diagram they determined that, although access to key assets was prevented from the Internet, there were no such restrictions in place to prevent access from an internal network area. The client was then able to add additional filtering to prevent access to the sensitive data held within those key assets. The client commented that none of the previous firewall assessments undertaken had identified this issue which when pointed out seemed obvious.

In conclusion, Portcullis use Nipper Studio to quickly identify potential security concerns arising from the configuration of network devices, in a way that provides those findings in formats that can be processed by scripts. The consultants save time, allowing more in-depth assessments even in environments were internet access is not permitted. These assessments take into account the environment in which a device will operate, allowing better (and more detailed) information to be provided to clients. Any technical team that have a need to review, assess or compare the configurations of firewalls, routers or switches would do well to consider Nipper Studio.