CYBER RANGE ORGANIZATION AND DESIGN

Large-scale Testbed and Cyber Range
Organiza6on and DesignRazvan Beuran, Ken-ichi Chinen

Outline
1. Mo9va9on & overview
2. Making use of StarBED
3. Case studies
4. Summary2

Mo9va9on• People have become more and more reliant
on the Internet– A world in which devices and people are allconnected together: the Internet of Things (IoT)• Network communica9on makes life moreconvenient, but it also exposes users tocybersecurity risks, such as malware, phishing– It is necessary to conduct cybersecurity educa9on
and training as we perform at JAIST
3

Cyber range• Environment for cybersecurity training– Facilitates learning and use of prac9cal skills
Security
training

Securityawarenesstraining

High-levelskills
Mid-level skills

Low-level skills

Security experts

IT specialists

End users
4

Cyber Range Organiza9on and Design• NEC endowed chair at JAIST– 3 year period star9ng in FY 2015

• Two main direc9ons– Cyber range architecture and design• Develop technologies and frameworks– Cybersecurity educa9on programs and courses• Develop curriculum, training materials

5Making use of StarBED• Implementa9on and execu9on of cyberranges, experiments, etc.

6For IT & security professionals• Use cyber ranges to acquire the prac9cal skills
for properly handling security incidents
UserInput

Cyber Range
Conﬁgura6on

Cyber Range
Instan6a6on

CyberRange

Incident
Database

CYBER RANGE CREATION FRAMEWORK
7

For regular computer users• Use ac9ve educa9on to gain awareness ofpoten9al cybersecurity risks

E-learning

Prac9calskills

Role-playinggames

Preven9onreadiness8

Network emula9on• Use network emula9on to assess applica9ons
and protocols from the perspec9ve ofcybersecurity risks

Network emula3on framework: NERVF
9

IoT experiments• Thorough experiments are required to makesure IoT technologies are opera9ng safely

FPGA-based propaga3on emulator: StarWave
802.15.4 support (ongoing development)
10Case studies• SANS NetWars Con9nuous– Online training program of SANS Ins9tute– 5 levels to be tackled during 4 months– Topics• Vulnerability Assessment• Packet Analysis• Penetra9on Tes9ng• System Hardening• Malware Analysis• Digital Forensics and Incident Response11

Levels 1 & 2: Summary• Level 1– Analyze the conﬁgura9on of a local machine to ﬁnd security ﬂaws
– Evaluate browser forensic ar9facts, command shell history, document
metadata, and malware to discover crucial evidence– Analyze packets for evidence of aeacks– Determine how an aeacker pivoted through the network to gain
access to a target machine• Level 2– Analyze and isolate persistent, evasive malware– Analyze a system to determine and thwart aeackers' techniques– Reconstruct network topologies and aeack evidence from packet
capture ﬁles
– Crack local passwords and wireless crypto keys
– Work with SQL databases to ﬁnd security ﬂaws and evidence

12Levels 1 & 2: Break down
30

SANS NetWars Continuous -- Level 1OSNetwork

40
35

2530
20

SANS NetWars Continuous -- Level 2OSNetwork
Cryptography
Image
Database
Programming

25
20

15

15
1010
50

5

# of Questions

Total Ques9ons: 23
Total Points: 58

Points0# of Questions

PointsTotal Ques9ons: 18
Total Points: 77

Security awareness training• Design security awareness training plahorm– Test basic security skills in a prac9cal manner– Focus on social engineering aeack preven9on• Use concept of gamiﬁca9on (serious games)– Engage users through emo9ons, compe99ve
behavior, etc.
– Incorporate social and reward aspects of games– Make educa9on and training more eﬀec9ve
14hep://www.social-engineer.org/socialengineering/social-engineering-infographic/
April 28, 201415

Game idea
• Example storyline (fragment)– Go to oﬃce
– Meet person in elevator– He/she drops USB memory– Inves9gate USB memory• Tested skills– Pick up USB memory? Insert it in PC?
– Open ﬁle on USB memory?
– Click on link in email from person?
16

Implementa9on tool
• Twine: open-source tool for telling interac9ve,nonlinear stories (hep://twinery.org/)– Stories can be extended with variables,
condi9onal logic, images, CSS, and JavaScript– Publish directly to HTML– Stand-alone orbrowser interface– Used by RPG researchers forgame prototyping
17Summary• We address the need for cybersecurity educa9on
and training through cyber ranges– Cyber Range Organiza9on and Design (NEC endowedchair) @ JAIST– Architecture and design of cyber ranges– Educa9on programs and courses• StarBED is the infrastructure for theimplementa9on and execu9on of cyber ranges– Already used by CYDER, SecCap and Hardening
training programs– Also used for network emula9on experiments

18

THANK YOU!

razvan@nict.go.jp
19