Introduction to the Cyber Ranges

Bishwajeet Pandey, Shabeer Ahmad

• Publisher: Chapman and Hall/CRC
• Year: 2022
• Print ISBN: 9781032072401
• eBook ISBN: 9781000572292
• Topic: Computer Science
• Subtopic: Computer Networking
• Index: Computer Science

Introduction to the Cyber Ranges provides a comprehensive, integrative, easy-to-comprehend overview of different aspects involved in the cybersecurity arena. It expands on various concepts like cyber situational awareness, simulation and emulation environments, and cybersecurity exercises. It also focuses on detailed analysis and the comparison of various existing cyber ranges in military, academic, and commercial sectors. It highlights every crucial aspect necessary for developing a deeper insight about the working of the cyber ranges, their architectural design, and their need in the market. It conveys how cyber ranges are complex and effective tools in dealing with advanced cyber threats and attacks.

Enhancing the network defenses, resilience, and efficiency of different components of critical infrastructures is the principal objective of cyber ranges. Cyber ranges provide simulations of possible cyberattacks and training on how to thwart such attacks. They are widely used in urban enterprise sectors because they present a sturdy and secure setting for hands-on cyber skills training, advanced cybersecurity education, security testing/training, and certification.

Features:

• A comprehensive guide to understanding the complexities involved with cyber ranges and other cybersecurity aspects
• Substantial theoretical knowhow on cyber ranges, their architectural design, along with case studies of existing cyber ranges in leading urban sectors like military, academic, and commercial
• Elucidates the defensive technologies used by various cyber ranges in enhancing the security setups of private and government organizations
• Information organized in an accessible format for students (in engineering, computer science, and information management), professionals, researchers, and scientists working in the fields of IT, cybersecurity, distributed systems, and computer networks

1Introduction

DOI: 10.1201/​9781003206071-1

1.1 CSA

In everyday context, SA can be defined as being alert and having information of the happenings in one's surrounding. The notion of SA is not constricted to any domain. For example, the corporations covet to be responsive of the susceptibilities that may be present in their business models or assets with the purpose of overcoming any kinds of manipulations of its vulnerabilities. Endsley gave a more sophisticated definition of situational awareness. According to her, SA involves perceiving physical elements of an environment, comprehending their meanings and predicting how they developed.. The four focal elements of SA that make it advantageous for decision-making are:

• Perception encompasses the awareness of the individual's own locus concerning the setting of additional entities and environmental factors.
• Comprehension of the causes, impacts, and consequences of the external influences to the systems with analyzing the changes in the situations/surroundings over time.
• Projection or predictions of the likely developments from the existing to approaching situation.
• Resolution includes the recovery and repair of the damage caused to the system.

CSA is a novel and emergent methodology used to tackle sophisticated cyberattacks and exploitation of existing weaknesses in computer networks, CPSs, and companies’ infrastructures. In the academic, military, and commercial arenas, CSA is regarded as the leading edge to deal with cybersecurity issues (Onwubiko 2016). It tries to apply the focal elements of SA in context of cyberspace and cybersecurity. SA proves to be an essential constituent of cybersecurity to deal with threat exchanges for everybody like individuals, businesses, and response teams (Gutzwiller et al. 2020). The following examples emphasize the significance of SA in cyber systems:

1. Managing e-commercial enterprises
   Nowadays, a lot of transactions on e-commerce websites (like eBay and Amazon) are being processed on daily basis. For smooth flow of business, it is crucial to monitor and analyze all kinds of possible cyber threats and the vulnerabilities in the cyber infrastructure and components.
2. GSA
   GSA monitor millions of a country's citizens’ assets, national critical infrastructures, as they are accountable for protecting the citizens within the country as well as overseas. The security of the database containing every citizen's record should not be compromised.

CSA incorporates people (operator/team), technology, and processes required for obtaining knowledge over time of all situations in cyber systems with earlier described factors of situational awareness:

1. Network components such as IDs, firewalls, monitoring systems, and scanners collect the data, report alerts, and generate logs. Security operator/team uses this data to perceive the situation and keep track of potential cyber threats.
2. Next, the security operator/team uses technology and processes to combine, evaluate, integrate, and compare the perceived data to comprehend the current situation and update the knowledge-base as well.
3. After this step, based on the data perceived and comprehended, the security operator/team can now put forth accurate predictions of the patterns of cyberattacks. They can now answer the questions like, what kind of cyber scenarios are probable, what are the feasible methods by which the current susceptibilities can be manipulated or worsened, and what measures can be implemented?
4. Lastly, the security operator/team is able to propose and employ the required sequence of action and countermeasure controls for resolving in-built risks or cyberattacks in cybernetworks.

CSA provides overall as well as a specific vista of cyber threats and liabilities in the systems, conceding organizations the proficiency for identifying, processing, and comprehending this information in instantaneously. CR platforms and testbed tools incorporate the CSA factors and help security analysts introduce a detailed insight of the advancement of a cyberattack and the techniques to implement highly impactful countermeasure controls to impede breaches. A CSA system must comprise test environments for delivering simultaneous sensor data, languages for describing the environment at various stages of abstraction, and integration of adversarial narrative with the setup (Okolica et al. 2009). CSA and cybersecurity also concern reliable risk management assessments that may be based on susceptibilities found in data, network, systems, or applications affecting mission assurance (Matthews et al. 2016).

Following is the list of some of the uses cases of CSA systems:

• Data source: the CSA system can be used for generating complete and high-quality data. This ensures the authenticity of the data for other users, stakeholders, and other systems.
• Assets organization and interconnectivity: the system is a common platform for assets sharing and organizing. Organizing assets and their dependencies and associations makes them easily identifiable by the users. They can be shared between the physical and the logical units of the network. New components and CSA scenarios can also be developed from the knowledge and usage of preexisting assets of the network.
• Assessing risks: situation comprehension and projection, both can be achieved by assessing the potential impact of a network threat scenarios. This assessment can be performed using scenario simulations or by using data on previous cyberattacks. This may help the system to better adapt measures for cyber defense.
• System monitoring: the users can observe the performance of the various components of the system and means of a virtual environment or visualization. This may be useful for detecting and analyzing any suspicious activities.
• Incident handling: for appropriate response actions, it is important to comprehend the current scenario by either spotting any issues or inspections which may elucidate any possible cyber incidents. This may help the user in drawing an in-depth analysis of the situation like identifying the sources of any attacks or the later possible consequences of an attack.

1.2 Definition

CRs are intricate virtual setups that provide a prototype of complexities of cybersecurity situations (like cyberattacks, cyberwarfare) in the real-world and execute utmost quality training in cybersecurity, deliver an environment for research as well as for the study of diverse schemas, and teach practical incident management as well as response expertise. An ideal CR as shown in Figure 1.1 provides instantaneous feedback with reliable simulation, a virtual setting where different teams can participate for training, a research environment where various teams can test their strategies, and a performance-based evaluation metrics (Urias et al. 2018).

FIGURE 1.1 CR environment.

Long Description for Figure 1.1

One edge of the triangle depicts the learning type of relation between Cyber Labs and CR exercises. Second edge of the triangle depicts the training typ...

Table of contents

• Cover Page
• Half-Title Page
• Series Page
• Title Page
• Copyright Page
• Contents
• Preface
• About the Authors
• List of Abbreviations
• Glossary
• 1 Introduction
• 2 Architectural Design and Tools of Cyber Ranges
• 3 Motivations for Construction of Cyber Ranges
• 4 Types of Cyber Ranges
• 5 Roles of Cyber Ranges: Testing, Training, and Research
• 6 Cybersecurity Exercises and Teams Definition
• 7 Simulation and Emulation Environments
• 8 Designing a Cyber Range
• 9 Military Cyber Ranges
• 10 Existing Cyber Ranges in Academic Sector
• Index