# CYRA: A Model-Driven CYber Range Assurance Platform
## 5 Cyber Threat and Training Models and Programmes Adaptation Tool
### Adaptation Based on Sphynx's Security Assurance Platform
#### 5.1.2 Adaptation Based on Vulnerable Assets
As for the waiting times, all the participants either agreed or strongly agreed that the waiting times were acceptable (see Figure 17b). In general, it took an experienced participant around 8 min to fully define a training programme. Figure 16: CTTP models and programmes editor’s usage. (**a**) and (**b**) presents the participants response regarding the Editors’ Ease of access and user-friendliness respectively. Figure 15: Participant roles (**a**) and cyber-security expertise (**b**). Following, the participants were asked about the scope of each CTTP model and the difficulty of creating a training programme through the CTTP model editor (see Figure 18). For the former, most of the participants (10 out of 12) either agreed or strongly agreed that the scope of CTTP models is well defined, while 2 out of 12 kept a neutral stance (see Figure 18a). As for the latter, 11 out of 12 found it either easy or normal to create a training programme, whereas one participant found it difficult (see Figure 18b). Succeeding, the participants were asked if the CTTP model and programmes editor can sufficiently model (a) existing working system's security aspects (see Figure 19a), (b) professional training programmes' educational scope ((see Figure 19b) and (c) the typical application environment in the participants' domain (see Figure 19c). The participants seemed to form a common view for all three questions as they either agreed or strongly agreed that the CTTP model and programmes editor has sufficient modelling capabilities. Lastly, almost all the participants were extremely satisfied with their interaction with the CTTP models and programmes editor (see Figure 20). Figure 11:0 Participants response to the usefulness of the Virtual Tour feature (**a**) and level of acceptance for the Editor’s waiting times (**b**). Figure 11:1 Participants response to the CTTP Model’s clear Scope (**a**) and the Training Programme’s creation difficulty (**b**). ## 8 Conclusions and Future Work

This paper presented our novel model-driven Cyber Range approach by introducing CYRA, a Cyber Range assurance platform that includes: (a) the CTTP models and programmes editor, a tool that supports the specification of CTTP models and programmes that are at the core of the platform's model-driven cyber range training approach, (b) Sphynx's security assurance platform that enables customised and continuous assessment of the security and privacy of a cyber system and comprehensive risk management and (c) the CTTP models and programmes adaptation tool, a tool that covers primary forms of analysis of the impact that specific changes in some parts of the programme have on other parts and checks about the completeness (coverage) and consistency of the entire specification of CTTP models and programmes when some parts of it change. In addition to the above, the manuscript included a validation of CYRA in an operational backend ICT system of a THREAT-ARREST pilot. The results presented in the use case shows the organisation increased its security posture by utilising (a) the CTTP models and programmes editor to create organisation-specific training programmes, (b) Sphynx's security assurance platform to enable customised and continuous assessment of the organisation's backend ICT system and (c) the CTTP models and programmes adaptation tool to adapt to the newly identified threats. In general, the overarching objective of these efforts is to create a platform that would allow an organisation to increase its security posture or maintain it at the highest possible level by: (a) creating training programmes that would enable its personnel to understand the continually intensifying threat landscape regardless of the personnel's security background, (b) continually assess the security and privacy of the organisation's cyber systems and (c) adopt to the threat landscape and trainee's skills by creating new training programmes or modifying existing ones.