v3.10.0

New Features

New Features

• Nipper 3.10.0 includes expanded support for Sophos SFOS 21.0.1 MR-1-Build277. This version focuses on the core areas that provide the most immediate value in terms of security and configuration analysis. For this initial release, the plugin will deliver full coverage of the following sections:

Administration

• • Analysis of system administration settings and controls.
  • Identification of default or weak administrator accounts.
  • Checks on privilege assignments, session management, and secure management protocols.

Authentication

• • Review of user authentication methods and password policies.
  • Assessment of local, remote, and multi-factor authentication configuration.
  • Detection of potential weaknesses in account security and authentication fallback options.

Filtering

• • Comprehensive auditing of firewall and filtering rules.
  • Detection of overly permissive or redundant rules, with context on security impact.
  • Analysis of filtering object groups, ordering, and rule complexity.

Interfaces

• • Inventory and analysis of configured network interfaces.
  • Checks on unused or misconfigured interfaces.
  • Verification of IP addressing and administrative access restrictions.

Logging

• • Evaluation of logging configuration and retention policies.
  • Checks for logging of security-relevant events.
  • Verification of external log forwarding (e.g., syslog, SIEM integration).

General Configuration

• • Assesses core system services such as FTP, SSH, SNMP, and backup credentials.
  • Identifies insecure or legacy services and validates that sensitive data is not exposed in stored configurations.

Banners

• • Checks login banners for compliance and consistency across management interfaces.
  • Highlights missing or non-compliant legal notices that may affect policy adherence.

• NTP

  • Evaluation of Network Time Protocol (NTP) configuration for accuracy and reliability.
  • Verification of secure NTP server sources and use of authentication where supported.
  • Assessment of time synchronization across systems to ensure consistency for logging and security auditing.
  • Identification of potential risks related to unauthenticated or external time sources.

Future Expansion
Additional sections beyond those listed above will be introduced in subsequent releases, expanding coverage to match the depth of analysis provided for other supported device types.

• Added support up to the latest manufacturers’ recommended versions of the following devices:
  • • Firepower NGFW 7.4.2 and NGFW 7.6.2
    • Juniper EX Series Switches JunOS 23.4R2.13

• Filtering Complexity Report

The Filtering Complexity Report provides a comprehensive overview of a device's object and rule base, identifying potential issues such as duplicate, unused, or contradictory rules. This report helps uncover inefficiencies and hidden risks within filtering configurations, enabling more effective rule optimization, enhanced security posture, and streamlined management and auditing.

Continual Improvements

• Resolved a Check Point R80 Source Object Parsing issue whereby source and destination objects were incorrectly displayed as ‘any any’ in the filtering list, even when explicit sources were configured. Source and destination definitions now reflect accurately in the filtering list.
• Resolved an issue where FortiGate firewalls in HA Active-Active mode incorrectly reported additional VDOMs, resulting in increased license consumption. The problem, caused by misinterpreting mirrored VDOM names in HA configurations, has been fixed, ensuring accurate VDOM detection and proper license allocation.
• Resolved an issue that prevented certain findings from being excluded from the Best Practice Security report.