Introduction to the Cyber Ranges

205 Pages·2022·13.055 MB·English

by  Bishwajeet Pandey, Shabeer Ahmad

Introduction to the
Cyber Ranges
Chapman & Hall/CRC Cyber-Physical Systems
Series Editors:
Jyotir Moy Chatterjee
Lord Buddha Education Foundation, Kathmandu, Nepal
Vishal Jain
Sharda University, Greater Noida, India
Cyber-Physical Systems: A Comprehensive Guide
By: Nonita Sharma, L K Awasthi, Monika Mangla, K P Sharma, Rohit Kumar
Introduction to the Cyber Ranges
By: Bishwajeet Pandey and Shabeer Ahmad
For more information on this series please visit: https://www.routledge.com/Chapman-
HallCRC-Cyber-Physical-Systems/book-series/CHCPS?pd=published,forthcoming&pg=1
&pp=12&so=pub&view=list?pd=published,forthcoming&pg=1&pp=12&so=pub&view=list
Introduction to the
Cyber Ranges
Bishwajeet Pandey
Shabeer Ahmad
First edition published 2022
by CRC Press
6000 Broken Sound Parkway NW, Suite 300, Boca Raton, FL 33487-2742
and by CRC Press
4 Park Square, Milton Park, Abingdon, Oxon, OX14 4RN
CRC Press is an imprint of Taylor & Francis Group, LLC
© 2022 Bishwajeet Pandey and Shabeer Ahmad
Reasonable efforts have been made to publish reliable data and information, but the author and publisher can-
not assume responsibility for the validity of all materials or the consequences of their use. The authors and
publishers have attempted to trace the copyright holders of all material reproduced in this publication and
apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright
material has not been acknowledged please write and let us know so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted,
or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, includ-
ing photocopying, microfilming, and recording, or in any information storage or retrieval system, without writ-
ten permission from the publishers.
For permission to photocopy or use material electronically from this work, access www.copyright.com or con-
tact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. For
works that are not available on CCC please contact [email protected]
Trademark notice: Product or corporate names may be trademarks or registered trademarks and are used only
for identification and explanation without intent to infringe.
ISBN: 9781032072401 (hbk)
ISBN: 9781032251424 (pbk)
ISBN: 9781003206071 (ebk)
DOI: 10.1201/9781003206071
Typeset in Palatino
by KnowledgeWorks Global Ltd.
Contents
Preface ..............................................................................................................................................xi
About the Authors ......................................................................................................................xiii
List of Abbreviations ....................................................................................................................xv
Glossary ......................................................................................................................................xxiii
1 Introduction .............................................................................................................................1
1.1 CSA ..................................................................................................................................1
1.2 Definition........................................................................................................................3
1.3 Need of CRs ...................................................................................................................5
1.3.1 Use Cases of CRs ..............................................................................................5
1.3.2 Merits of CRs Training ....................................................................................6
1.4 CRaaS ..............................................................................................................................7
1.5 On-Premise CR ..............................................................................................................7
1.6 Types of CRs ..................................................................................................................8
1.7 Conclusions ..................................................................................................................10
References ...............................................................................................................................11
2 Architectural Design and Tools of Cyber Ranges .........................................................13
2.1 Architectural Modules and Their Functions ..........................................................13
2.1.1 Portal ................................................................................................................13
2.1.2 Run-Time Environments ...............................................................................15
2.1.2.1 Emulation-Based Tools ..................................................................15
2.1.2.2 Simulation-Based Tools .................................................................19
2.1.2.3 Traffic Generation Tools ................................................................22
2.1.2.4 Management Tools .........................................................................24
References ...............................................................................................................................25
3 Motivations for Construction of Cyber Ranges .............................................................27
3.1 IT and OT Infrastructures .........................................................................................27
3.1.1 Cybersecurity Challenges to OT/IT Systems ............................................29
3.1.2 Cybersecurity Implementations in OT/IT Systems ..................................30
3.1.2.1 Asset Management .........................................................................30
3.1.2.2 Governance .....................................................................................30
3.1.2.3 Risk Assessment .............................................................................31
3.1.2.4 Cyber-Risk Awareness ...................................................................31
3.1.2.5 Cybersecurity Maintenance ..........................................................31
3.1.2.6 Cyber-Risk Detection .....................................................................32
3.1.2.7 Mitigation of Cyber Risk ...............................................................32
3.1.2.8 Cyber-Risk Analyses ......................................................................33
3.1.3 Need of CRs for WSS .....................................................................................33
3.1.4 Need of CRs for Logistic Systems ...............................................................34
v
vi Contents
3.1.5 Need of CRs for Maritime Systems .............................................................36
3.1.6 Need of CRs for O&G Industries .................................................................37
3.1.7 Need of CRs for Power Systems...................................................................38
3.2 Cyberattacks ................................................................................................................39
3.2.1 Cyberattacks on Critical Infrastructures ....................................................41
3.2.2 Cyberthreats to Critical Infrastructures .....................................................42
References ...............................................................................................................................43
4 Types of Cyber Ranges ........................................................................................................47
4.1 Hybrid CRs ..................................................................................................................47
4.1.1 EVA ..................................................................................................................47
4.1.2 DIATEAM CR .................................................................................................49
4.1.3 CRATE .............................................................................................................52
4.2 Physical CRs .................................................................................................................53
4.2.1 SCADA Testbeds ............................................................................................54
4.2.2 SWAT ...............................................................................................................56
4.2.3 WADI ...............................................................................................................57
4.3 Virtual CRs...................................................................................................................59
4.3.1 CYRA ...............................................................................................................60
4.3.2 GISOO ..............................................................................................................62
4.4 CRaaS ............................................................................................................................63
References ...............................................................................................................................65
5 Roles of Cyber Ranges: Testing, Training, and Research ............................................67
5.1 CRs for Testing ............................................................................................................67
5.1.1 Penetration Testing ........................................................................................67
5.1.2 Software Testing ............................................................................................68
5.1.3 Security Testing ..............................................................................................70
5.1.3.1 Threat Model Testing .....................................................................70
5.1.3.2 Web Security Testing .....................................................................70
5.2 CRs for Training ..........................................................................................................72
5.2.1 How to Use CRs for Trainings .....................................................................74
5.2.2 Cybersecurity Awareness Trainings ...........................................................74
5.2.3 Incident Response Trainings ........................................................................75
5.3 CRs for Research .........................................................................................................76
References ...............................................................................................................................77
6 Cybersecurity Exercises and Teams Definition .............................................................79
6.1 Need of CEs .................................................................................................................79
6.2 Life Cycle of a CE ........................................................................................................82
6.3 Steps in Designing of a CE ........................................................................................83
6.4 Different Kinds of Approaches .................................................................................86
6.5 Common Features of a CE .........................................................................................89
6.6 Types of CEs .................................................................................................................89
6.6.1 Examples of CEs .............................................................................................91
6.7 Teams Definition .........................................................................................................92
6.8 Conclusions ..................................................................................................................93
References ...............................................................................................................................93
Contents vii
7 Simulation and Emulation Environments.......................................................................95
7.1 Emulation Environment .............................................................................................95
7.1.1 Need for Emulation Environment ...............................................................95
7.1.2 Types of Emulation Models ..........................................................................97
7.1.3 Emulators ........................................................................................................98
7.1.3.1 Dummynet ......................................................................................98
7.1.3.2 NetEm ..............................................................................................98
7.1.3.3 NIST Net ..........................................................................................99
7.2 Simulation Environment ..........................................................................................100
7.2.1 Need for Simulation Environment ............................................................101
7.2.2 Simulators .....................................................................................................101
7.2.2.1 NS ..................................................................................................102
2
7.2.2.2 NS ..................................................................................................102
3
7.2.2.3 OMNET++ ......................................................................................103
7.2.2.4 QualNet .........................................................................................104
References .............................................................................................................................105
8 Designing a Cyber Range .................................................................................................107
8.1 Planning Phase ..........................................................................................................107
8.1.1 Security Challenges Supported by the CR ...............................................107
8.1.2 Components for CR .....................................................................................109
8.1.3 Defining CR Teams ......................................................................................109
8.2 Architectural Considerations ..................................................................................110
8.3 Implementation Phase ..............................................................................................111
8.3.1 IaC ..................................................................................................................112
References .............................................................................................................................113
9 Military Cyber Ranges ......................................................................................................115
9.1 Need of MCRs............................................................................................................115
9.2 Simulation-Based MCRs ..........................................................................................116
9.2.1 SIMTEX..........................................................................................................116
9.2.1.1 Introduction ..................................................................................116
9.2.1.2 Origin .............................................................................................116
9.2.1.3 Architecture ..................................................................................117
9.2.1.4 Evolution ........................................................................................118
9.2.2 CAAJED .........................................................................................................119
9.2.2.1 Introduction ..................................................................................119
9.2.2.2 Origin .............................................................................................119
9.2.2.3 Architecture ..................................................................................120
9.2.2.4 Evolution ........................................................................................122
9.2.3 SAST ...............................................................................................................122
9.2.3.1 Introduction ..................................................................................122
9.2.3.2 Origin .............................................................................................122
9.2.3.3 Architecture ..................................................................................123
9.2.3.4 Evolution ........................................................................................125
9.2.4 StealthNet ......................................................................................................126
9.2.4.1 Introduction ..................................................................................126
9.2.4.2 Origin .............................................................................................126
viii Contents
9.2.4.3 Architecture ..................................................................................126
9.2.4.4 Evolution ........................................................................................128
9.2.5 Comparison of Simulation-Based MCRs ..................................................129
9.3 Emulation-Based MCRs ...........................................................................................130
9.3.1 NCR ................................................................................................................130
9.3.1.1 Introduction ..................................................................................130
9.3.1.2 Origin .............................................................................................131
9.3.1.3 Architecture ..................................................................................131
9.3.1.4 Evolution ........................................................................................132
9.3.2 JIOR ................................................................................................................133
9.3.2.1 Introduction ..................................................................................133
9.3.2.2 Origin .............................................................................................133
9.3.2.3 Architecture ..................................................................................134
9.3.2.4 Evolution ........................................................................................134
9.3.3 DoD CSR........................................................................................................135
9.3.3.1 Introduction ..................................................................................135
9.3.3.2 Origin .............................................................................................135
9.3.3.3 Architecture ..................................................................................136
9.3.3.4 Evolution ........................................................................................136
9.3.4 Comparison of Emulation-Based MCRs ...................................................137
9.4 MACRs ........................................................................................................................138
9.4.1 USMA IWAR ................................................................................................138
9.4.1.1 Introduction ..................................................................................138
9.4.1.2 Origin .............................................................................................138
9.4.1.3 Architecture ..................................................................................138
9.4.1.4 Evolution ........................................................................................140
9.4.2 Estonian CR ..................................................................................................140
9.4.2.1 Introduction ..................................................................................140
9.4.2.2 Origin .............................................................................................140
9.4.2.3 Architecture ..................................................................................141
9.4.2.4 Evolution ........................................................................................142
9.4.3 KYPO Czech .................................................................................................142
9.4.3.1 Introduction ..................................................................................142
9.4.3.2 Origin .............................................................................................142
9.4.3.3 Architecture ..................................................................................143
9.4.3.4 Evolution ........................................................................................143
9.4.4 Comparison of MACRs ...............................................................................144
References .............................................................................................................................144
10 Existing Cyber Ranges in Academic Sector ..................................................................147
10.1 Simulation-Based ACRs ...........................................................................................147
10.1.1 SECUSIM .......................................................................................................147
10.1.1.1 Introduction ..................................................................................147
10.1.1.2 Terminologies ...............................................................................148
10.1.1.3 Architecture ..................................................................................149
10.1.2 RINSE ............................................................................................................150
10.1.2.1 Introduction ..................................................................................150
10.1.2.2 Architectural and Business Influences .....................................151
10.1.2.3 Architecture ..................................................................................151
Contents ix
10.1.3 netEngine ......................................................................................................152
10.1.3.1 Introduction ..................................................................................152
10.1.3.2 Architecture ..................................................................................153
10.1.4 OPNET CR ....................................................................................................154
10.1.4.1 Introduction ..................................................................................154
10.1.4.2 Architecture ..................................................................................155
10.1.4.3 Simulation Workflow ...................................................................156
10.1.5 Concordia Consortium................................................................................157
10.1.5.1 KYPO CR .......................................................................................158
10.1.5.2 TELECOM Nancy CR ..................................................................158
10.1.5.3 RISE CR ..........................................................................................158
10.1.5.4 Airbus CR ......................................................................................159
10.1.5.5 CODE CR .......................................................................................159
10.1.6 Comparison of Simulation-Based ACRs ...................................................159
10.2 Emulation-Based ACRs ............................................................................................161
10.2.1 VCSTC ............................................................................................................161
10.2.1.1 Introduction ..................................................................................161
10.2.1.2 Architecture ..................................................................................161
10.2.2 LARIAT .........................................................................................................162
10.2.2.1 Introduction ..................................................................................162
10.2.2.2 Architecture ..................................................................................163
10.2.3 Emulab ...........................................................................................................163
10.2.3.1 Introduction ..................................................................................163
10.2.3.2 Architecture ..................................................................................164
10.2.4 DETER ...........................................................................................................165
10.2.4.1 Introduction ..................................................................................165
10.2.4.2 DETERlab ......................................................................................166
10.2.4.3 Architecture ..................................................................................167
10.2.5 Virginia CR ...................................................................................................168
10.2.5.1 Introduction ..................................................................................168
10.2.5.2 Architecture ..................................................................................168
10.2.6 Comparison of Emulation-Based ACRs ...................................................170
References .............................................................................................................................171
Index .............................................................................................................................................175