Titania has been recognized by CIOReview Magazine as the recipient of “20 Most Promising Compliance Technology Solution Providers - 2017,” based on our proprietary methodology, reflecting its position in the industry. This profile has been developed by the CIOReview research and editorial team based on insights from an interview with Nicola Whiting, COO.

Titania
The future is “self-healing” systems

Nicola Whiting, COO

As a CIO, you’re spending more on cyber security than ever before, but are you any more confident when facing your peers on the board?

Last year there was a 164 percent increase in cyber-attacks and global cyber security spend will reach $86.4 billion in 2017. Yet successful attacks continue to grow and the cyber skills gap, continues to widen.

We spoke to Titania, a leading expert in the field of security and compliance automation, who are helping organizations such as the Department of Defense, NATO and FBI introduce granular accuracy to their security and compliance processes.

What emerges is the belief that many companies are pouring money into technologically advanced versions of doing what they’ve always done. Some of these systems, like scanners, provide a ‘helicopter view’ of an organization’s defenses by bombarding networks with data and analyzing their responses. Others, such as monitoring systems, sit on a network and provide a live picture of network activity. Yet even with the “best of breeds” in these technologies, companies are still getting what they’ve always got – breaches are increasing. It seems something is missing.

Nicola Whiting, COO at Titania, says: “The world’s most secure networks leverage the combined strength of multiple technologies. Their goal is to create a combined solution which is stronger and more resilient than its individual components. Our clients have realized that to be effective this solution needs two complementary security perspectives, we’re global leaders in one of them.”

So, what’s missing?

Whiting talks about security systems being out of balance. “There are lots of “helicopter view” technologies. They create multiple queries and generate mass network traffic which is then extrapolated into the big picture view that’s essential for large enterprises. What’s missing is the “granular accuracy” needed to balance those systems.”

The strength of intelligent configuration auditing is in its accuracy and depth of detail. Internal systems data provides factual information that you can rely on. Autonomous audits can be performed by connecting over the network to the systems (online) or reading in configuration backups (offline). You can support air-gapped, remote or supply chain systems with the same solution, it’s highly flexible.

Through working with leading organizations, Titania have found that many security breaches come about through issues such as out-of-date software, misconfiguring devices or using weak passwords. These errors are very visible when analyzing internal system data, but difficult or even impossible to spot using external attacks or interrogations.

Organizations traditionally filled that gap with pen testers and audit teams, who provided line-by-line build reviews of internal system configuration & O/S data. It was highly accurate, but time consuming and costly (which typically meant only testing a small percentage of devices and on an infrequent basis). Titania’s goal was to free their pen-testing colleagues from boring but essential build reviews – and they developed was the world’s first ‘virtual auditor’.

We deliver the granular accuracy needed for organizations to meet their system compliance mandates and provide them the bedrock of specific information,that future autonomous “self-healing” systems will depend on

Titania found that they could help clients with huge complex infrastructures by supplying technology that can go ‘under the hood’ of their networked systems and deliver granular analysis at unprecedented scale. The same kind of accuracy, risks and remediation actions as human penetration testers deliver, but on an almost instant continual basis.

Crucially, it builds a virtual model of each device and then uses built-in human intelligence to analyze the interactions between different configuration options with the skills and inquisitiveness of a human pen-tester. Marrying the ‘Ying & Yang’ of ‘autonomous auditors’ and scanning technology creates a multi-layered solution combining external and internal analysis.

Effective security is about using the most applicable technologies– for many CIO’s this means advanced monitoring & scanning tools, intelligent configuration auditing systems and market leading SIEM solutions. There are two types of configuration auditing technologies, “find and match” text string analysis (grep) tools and solutions like Titania’s, with built-in AI / virtual modelling intelligence.

Grep configuration auditing is often available as a “bolt-on” module to supplement other technologies such as scanning or monitoring. Unfortunately, it’s prone to false positives and negatives. A recent independent lab test benchmarked Titania’s Nipper Studio against the market leading “text match” (grep) tool. The test was conducted using a Cisco router and industry standard compliance policy, the results were manually verified. The grep tool proved only 16.4% accurate (under the same conditions, Titania’s technology proved 100% accurate).

Titania believe that they, and their partners, will soon deliver autonomous mitigation solutions, a large step to finally giving companies fully self-monitoring, self-healing defense systems. This could reduce the cost of security and compliance and free up cyber experts from much of the time-consuming security ‘housekeeping’, allowing focus on other priorities.

Ensuring consistent security & compliance, including granular intelligence tools from companies like Titania makes a sound strategy for today and tomorrow.

Titania

Latest Titania Nipper Release Simplifies Federal Agencies’ Ability to Prioritize and Remediate NIST SP 800-53 Non-Compliances Based on Risk to Network

Tuesday, October 03, 2023

Titania’s software solution equips agencies with a critical capability lacking in more than 80 percent of federal government organizations.

Titania, a company specializing in continuous network security and compliance assurance solutions, has introduced a new reporting feature aimed at simplifying and expediting the evaluation of NIST SP 800-53 security compliance for the entire network infrastructure of federal organizations. This enhancement also facilitates the swift remediation of non-compliance issues by offering prioritized remediation guidance.

This release is timely, given the prevailing recommendation among regulators for adopting a zero-trust approach to network segmentation. This approach entails the continuous validation of all network devices, including routers, switches, and firewalls, to ensure compliance with policies and control frameworks such as DISA STIGs and NIST SP 800-53.

The newly implemented software capability empowers federal organizations to:

• Delve into NIST SP 800-53 controls and control enhancements, providing automated pass/fail evidence of compliance.

• Automate the assessment of configuration risks accurately, prioritize them, and align them with NIST SP 800-53, drawing on DISA STIG risk categories and control correlation identifiers.

• Prioritize remedial actions for each identified non-compliance, potentially automating trouble-ticketing processes.

• Proactively re-evaluate risks to confirm their mitigation and verify that devices comply with NIST SP 800-53 standards.

“We’re working closely with GRC and Security Operations providers to close the automation gap even more, so that our risk-prioritized remediation advice is linked to automated trouble-ticketing and remediation orchestration, and then proactively checked in Nipper Enterprise to ensure the changes have addressed the compliance issue, without opening up any further network gaps,” stated Ian Robinson, Chief Architect at Titania. “Closing the remediation loop has always been our aim, and our new evidence-based reports demonstrate how compliance posture can be significantly improved in significantly less time, with this approach.”

The newly released NIST SP 800-53 report is accessible through both the Nipper Enterprise solution, commonly utilized by security operations centers (SOCs) for continuous compliance assurance, and Titania's on-demand solution, Nipper, employed by internal and external auditors and assessors.

Availability: Titania Nipper and Nipper Enterprise are currently available. Furthermore, Nipper and Nipper Enterprise will soon offer additional evidence-based reports, including DISA STIGs, PCI DSS 4.0, CMMC, and NIST SP 800-171 in the upcoming months.

Notably, Nipper Enterprise also provides MITRE ATT&CK-based incident prevention, forensics, and response automation to enhance attack surface management capabilities.

Titania Launches Evidence-based PCI DSS 4.0 Compliance Reporting

Wednesday, November 08, 2023

New capability prevents unauthorized access to cardholder data environments

ARLINGTON -- Titania, announces the launch of a solution that revolutionizes Payment Card Industry Data Security Standard (PCI DSS) compliance reporting against the new 4.0 standard. The new PCI DSS 4.0 Compliance Report is available in both Nipper, Titania's on-demand solution for configuration management, compliance, and control, and Nipper Enterprise, for delivering PCI DSS compliance assurance at network scale.

The new capability provides an automated way for commercial critical national infrastructure (CNI) organizations to embed the risk-focused evidence and implement best practices necessary to deliver greater security from PCI DSS compliance. Automating ready-mapped network device checks, with drill-down access to testing procedures, the compliance report demonstrates how routers, switches and firewalls ‘pass or fail’ to meet relevant PCI DSS 4.0 requirements, as well as providing a risk-prioritized view of any non-compliances that Nipper detects. The solution comes at a time when recent research reveals that only 37% of U.S. CNI organizations could 'very effectively' categorize and prioritize compliance risks that undermine the security of their networks.

“Historically, achieving PCI DSS compliance involved laborious manual mapping of network infrastructure device checks to specific requirements. This time-consuming and error-prone process is now a thing of the past with the new compliance report available in Nipper solutions,” said Ian Robinson, Chief Architect of Titania.

“But perhaps more importantly for internal security teams, the solutions also provide the capability to accurately prioritize the remediation of non-compliances based on risk, which is fundamental to improving PCI DSS compliance posture. This is only possible because Nipper’s risk analysis of each non-compliance harnesses networking know-how to determine the ease of exploit and potential impact to security, as well as the ease of fix,” continued Robinson.

Jeff Man, NSA Certified Cryptanalyst, NSA Red Team, PCI SME, PCI QSA, INFOSEC Curmudgeon, Sr. Information Security Consultant at Online Business Systems recently evaluated the new PCI DSS 4.0 compliance reporting capability and states:

“I’ve worked in the payment card industry for 20 years, and I have rarely encountered any vendor that seems to know or care about PCI and how it relates to the products and services they sell. Titania not only shows an interest in PCI with its release of Nipper v3.0 but also demonstrates that it understands the data security requirements that Nipper impacts and/or could measure in terms of how well an entity is meeting the expectations of the requirements. I’ve used Nipper off and on for over 10 years, and this new version is the most focused on PCI yet. It’s a tool that I will recommend to all my clients.”

Titania, renowned for its proactive security and compliance assurance for network infrastructure, now offers an unprecedented solution that automates evidence-based PCI DSS compliance reporting against the new 4.0 standard. The new report is available in both the Nipper Enterprise solution which is used by security operations centers (SOCs) to continuously assure compliance, and Titania’s on-demand solution, Nipper, which is used by ISAs and QSAs globally.

20 Most Promising Compliance Technology Solution Providers - 2017

Company
Titania

Management
Nicola Whiting, COO and Ian Whiting, CEO & Founder

Description
A global security software firm providing fully automated device configuration and O/S vulnerability auditing tools that delineate precise risks and effective remediation actions

Titania The future is “self-healing” systems