Thisisthehtmlversionofthefilehttp://nipper.titania.co.uk/contrib/nipper20080412.pdf. Googleautomaticallygenerateshtmlversionsofdocumentsaswecrawltheweb.
Page1
AuditingNetworkDevices
Nipper
IanVenturaWhiting 12 th April2008
with
Nipper
Page2
AuditingNetworkDevices
withNipper
Overview
NipperBackgroundInformation
12
Overview
NipperBackgroundInformation AuditingCiscoSecurityAppliances AuditingCiscoSwitchesAndRouters AuditingCheckPointVPN1/Firewall1 DevicesSupportedByNipper WhatNipperDoesNotDo TheFutureOfNipper
IncludesDemonstrationsWithCiscoEquipment AndANokiaIPFirewallConfiguration
Copyright2008IanVenturaWhiting
http://nipper.tit
Page3
Nipper
AuditingNetworkDevices
withNipper
12
TheBackgroundInfo...
StartedInMay2006 OriginallyCalledCiscoParse DecodedCiscoType7Passwords
DevelopingFurther...
AddedMoreChecks AddedSupportForJuniperNetScreenFirewalls RenamedAsNipper(NetworkInfrastructureParser)
Now...
PerformsSecurityAudits
Now...
PerformsSecurityAudits GeneratesAConfigurationReport
Copyright2008IanVenturaWhiting http://nipper.tit
Page4
Nipper
AuditingNetworkDevices
withNipper
12
Whydevelopersshouldselectindustrystandardencryption example:CiscoType7Passwords
thepasswordhash
ThesecretCiscokey
NOTvery
thecalculation
cleve
Copyright2008IanVenturaWhiting
http://nipper.tit
Page5
Nipper
ThingsToCheck:
NetworkFiltering
AuditingNetworkDevices
withNipper
SecurityAuditing
12
CiscoSecurityAppliance
WhatNipperAudits:
NetworkFiltering
ThingsToCheck:
NetworkFiltering ProtocolAnalysis AdministrativeServices AuthenticationConfiguration VPNConfiguration RoutingProtocols OperatingSystemVersion OtherDeviceSettings
WhatNipperAudits:
NetworkFiltering ProtocolAnalysis AdministrativeServices AuthenticationConfiguratio VPNConfiguration RoutingProtocols OperatingSystemVersion OtherDeviceSettings
Copyright2008IanVenturaWhiting
http://nipper.tit
Page6
Nipper
AuditingNetworkDevices
withNipper
12
AuditingCiscoSecurityAppliances...
Demonstration
Copyright2008IanVenturaWhiting
http://nipper.tit
Copyright2008IanVenturaWhiting
http://nipper.tit
Page7
Nipper
ThingsToCheck:
RoutingProtocols
AuditingNetworkDevices
withNipper
SecurityAuditing
12
CiscoSwitchesAndRouters
WhatNipperAudits:
RoutingProtocols SwitchPort&VLANConfigu AdministrativeServices AuthenticationConfiguration NetworkFiltering DeviceServices OperatingSystemVersion OtherDeviceSettings
SwitchPort&VLANConfiguration AdministrativeServices AuthenticationConfiguration NetworkFiltering DeviceServices OperatingSystemVersion OtherDeviceSettings
Copyright2008IanVenturaWhiting
http://nipper.tit
Page8
Nipper
AuditingNetworkDevices
withNipper
12
AuditingCiscoSwitchesAndRouters...
Demonstration
Copyright2008IanVenturaWhiting
http://nipper.tit
Page9
Nipper
SoftwareFirewall
AuditingNetworkDevices
withNipper
SecurityAuditing
12
CheckPointVPN1/Firewall1
RunsOnGNU/Linux,SunSolarisAndMicrosoftWindows ThirdPartyProducts,e.g.NokiaIPFirewalls SupportsOtherManufacturersFirewalls,e.g.Cisco ManagementAndFirewallModules PolicyIsConfiguredOnManagementModule PolicyIsDeployedToFirewallModulesAndOtherFirewalls NoSingleConfigurationFile NotStoredInASingleLocation LookForconfOrdatabaseDirectories
Copyright2008IanVenturaWhiting
http://nipper.tit
Page10
Nipper
AuditingNetworkDevices
withNipper
12
Copyright2008IanVenturaWhiting
http://nipper.tit
Page10
Nipper
AuditingNetworkDevices
withNipper
SecurityAuditing
12
CheckPointVPN1/Firewall1
Copyright2008IanVenturaWhiting
http://nipper.tit
Page11
Nipper
AuditingNetworkDevices
withNipper
12
AuditingCheckPointVPN1/Firewall1...
Demonstration
Copyright2008IanVenturaWhiting
http://nipper.tit
Page12
Nipper
CiscoASAFirewalls CiscoCatOSBasedCatalysts
AuditingNetworkDevices
withNipper
12
Nipper0.11.6SupportsAllTheseDevices
BayNetworksAccelar CheckPointVPN1/Firewall1 JuniperNetScreenFirewalls NokiaIPFirewalls NortelPassport SonicWALLFirewalls
CiscoContentServicesSwitch CiscoFirewallServicesModule CiscoIOSBasedCatalysts CisocIOSBasedRouters CiscoNMPBasedCatalysts CiscoPIXFirewalls
Copyright2008IanVenturaWhiting
http://nipper.tit
Page13
Nipper
AuditingNetworkDevices
withNipper
WhatNipper0.11.6
12
DoesNotDo...
withNipper
WhatNipper0.11.6
DoesNotDo...
IdentifyClearTextProtocolsInFilterConfiguration IdentifyDestinationServiceRangesInFilters VPNConfiguration ProtocolAnalysis WirelessRoutingConfigurations BruteForceStrongEncryptionPasswords DeviceSupportVaries
Copyright2008IanVenturaWhiting
http://nipper.tit
Page14
Nipper
AuditingNetworkDevices
withNipper
TheFutureof
12
Nipper
IdentifyMoreNetworkFilteringIssues AuditProtocolAnalysis AuditVPNConfigurationSettings AuditEncryptionSettings ConsistancyAcrossDeviceTypes SupportForMoreDevices CompliancyChecking
ImprovedEfficiency NipperLibrary NipperGUI(Linux,Windows&O InternationalisationReady(i18n) ImprovedHTMLOutput ImprovedLatexOutput ImprovedReportContent
CompliancyChecking
ImprovedReportContent
Copyright2008IanVenturaWhiting
http://nipper.tit
Page15
Nipper
Example:Improvementsto
AuditingNetworkDevices
withNipper
12
SNMPAuditing
Nipper0.12.0 ClearTextSNMPInUse Nipper0.11.6 SNMPVersion1/2cInUse WeakCommunityString DictionaryBasedCommunityString WeakCommunityString DictionaryBasedCommunityString DefaultCommunityString SNMPConfiguredWithoutFiltering SNMPWriteAccessEnabled SNMPSystemShutdownEnabled SNMPTFTPListNotConfigured SNMPViewNotConfigured
Copyright2008IanVenturaWhiting http://nipper.tit
Page16
Nipper
CiscoASAFirewalls CiscoCatOSBasedCatalysts
AuditingNetworkDevices
withNipper
12
BayNetworksAccelar CheckPointVPN1/Firewall1
CiscoContentServicesSwitch
CiscoCatOSBasedCatalysts CiscoContentServicesSwitch CiscoFirewallServicesModule CiscoIOSBasedCatalysts CisocIOSBasedRouters CiscoNMPBasedCatalysts CiscoPIXFirewalls
BayNetworksAccelar CheckPointVPN1/Firewall1 JuniperNetScreenFirewalls NokiaIPFirewalls NortelPassport SonicWALLFirewalls EntrasysSwitches&Routers
3ComSuperStackSwitches NortelAlteonFirewall NortelBayStackSwitches NortelContivityVPNRouter
FoundrySwitches FortinetFortigateFirewalls HPProcurveSwitches WatchGuardFirewalls
Copyright2008IanVenturaWhiting
http://nipper.tit
Page17
Nipper
AuditingNetworkDevices
