Cyber security research is quintessential to secure computerized systems against cyber threats. Likewise, cyber security training and exercises are instrumental in ensuring that the professionals protecting the systems have the right set of skills to do the job. Cyber ranges provide platforms for testing, experimentation and training, but developing and executing experiments and training sessions are labour intensive and require highly skilled personnel. Several cyber range operators are developing automated tools to speed up the creation of emulated environments and scenarios as well as to increase the number and quality of the executed events. In this paper we investigate automated tools used in cyber ranges and research initiatives designated to augment cyber ranges automation. We also investigate the automation features in CRATE (Cyber Range And Training Environment) operated by the Swedish Defence Research Agency (FOI).

/pdf/cyber-range-automation-overview-with-a-case-study-of-crate-12miwuyl52.pdf

Cyber Range Automation Overview with a Case Study of CRATE

The growing dependency on computerized systems in society causes an increased need for a high level of cyber security competence among the professionals tasked with operating and protecting such systems. Cyber defense exercises are important for experience-based learning to train professionals working with critical computer systems. However, arranging realistic exercises require skilled instructors and technicians with the right set of tools. In this paper, we describe an exercise management and support tool called CRATE Exercise Control (CEC). The tool was developed by the Swedish Defence Research Agency (FOI), based on empirical experiences from arranging cyber defense exercises in the cyber range CRATE (Cyber Range And Training Environment), and best practices published by other organizations. We also share experiences made while using CEC during cyber defense exercises, as well as recommendations to consider when designing exercise management and support tools.

CRATE Exercise Control – A cyber defense exercise management and support tool

Digital technologies are facilitating our daily activities, and thus leading to the social transformation with the upcoming 5G communications and the Internet of Things. However, mainstream and sophisticated attacks are remaining a threat, both for individuals and organisations. Cyber Range emerges as a promising solution to effectively train people in cybersecurity aspects. A Training Programme is considered adequate only if it can adapt to the scope of the attacks they cover and if the trainees apply the learning material to the operational system. Therefore, this study introduces the model-driven CYber Range Assurance platform (CYRA). The solution allows a trainee to be trained for known and new cyber-attacks by adapting to the continuously evolving threat landscape and examines if the trainees transfer the acquired knowledge to the working environment. Furthermore, this paper presents a use case on an operational backend ICT system, showing how the CYRA platform was utilised to increase the security posture of the organisation.

CYRA: A Model-Driven CYber Range Assurance Platform

This paper describes a situation awareness framework, Frankenstack, that is the result of a multi-faceted endeavor to enhance the expertise of cybersecurity specialists by providing them with real-time feedback during cybersecurity exercises and verifying the performance and applicability of monitoring tools during those exercises. Frankenstack has been recently redeveloped to improve data collection and processing functions as well as cyberattack detection capability. This extensive R&D effort has combined various system and network security monitoring tools into a single cyberattack detection and exercise feedback framework.Although Frankenstack was specifically developed for the NATO CCD COE’s Crossed Swords exercise, the architecture provides a clear point of reference for others who are building such monitoring frameworks. Thus, the paper contains many technical descriptions to reduce the gap between theoretical research and practitioners seeking advice on how to implement such complex systems.

Frankenstack: Real-time Cyberattack Detection and Feedback System for Technical Cyber Exercises

Traditional risk management produces a rather static listing of weaknesses, probabilities and mitigations Large share of cyber security risks realize through computer networks These attacks or attack attempts produce events that are detected by various monitoring techniques such as Intrusion Detection Systems (IDS) Often the link between detecting these potentially dangerous real-time events and risk management process is lacking, or completely missingThis paper presents means for transferring and visualizing the network events in the risk management instantly with a tool called Metrics Visualization System (MVS) The tool is used to dynamically visualize network security events of a Terrestrial Trunked Radio (TETRA) network running in Software Defined Networking (SDN) context as a case study Visualizations are presented with a treelike graph, that gives a quick easily understandable overview of the cyber security situationThis paper also discusses what network security events are monitored and how they affect the more general risk levels The major benefit of this approach is that the risk analyst is able to map the designed risk tree/security metrics into actual real-time events and view the system's security posture with the help of a runtime visualization view

Combining real-time risk visualization and anomaly detection

We present a new situation awareness visualisation tool, the Events Visualisation Environment (EVE), and its internal events aggregator module, the Advanced Data Aggregation Module (ADAM), which have been successfully used during the most recent cyber exercises (i.e., Locked Shields and Crossed Swords) organised by the NATO Cooperative Cyber Defence Centre of Excellence (NATO CCDCOE). The functional requirements for EVE and ADAM were based on the unique cyber exercise needs for analysis and game development, and were finalised after we had completed a state-of-the-art review to look for suitable tools that could meet our requirements. The main purpose of EVE is to visualise security alerts on any given network map. ADAM, the supporting events aggregation module, processes, combines and filters incoming notifications from various types of sensors, and makes them ready to be visualised by EVE. EVE offers an intuitive and real-time visualisation that is easily understandable at first glance by both technical and non-technical staff. It also allows for recording and playback, and considers attack types, game phases, attack sources, and targets. The information required by EVE is obtained from different sensors operating on the network. EVE allows for a very simplified communication channel with them, based on JSON formatted messages sent over an HTTP POST request. The sensors used during the cyber exercises to test the tools are also described here. The tools have provided an enhanced situation awareness experience over previous cyber exercises organised by NATO CCDCOE, and can be used in other exercises or, more generally, in real-life, production-ready environments. EVE (with ADAM included) is published as an open source tool, which is freely available on the GitHub page of the NATO CCDCOE.

Francisco Jesús Rubio Melón

Papers

EVE and ADAM: Situation Awareness Tools for NATO CCDCOE Cyber Exercises