# CYRA: A Model-Driven CYber Range Assurance Platform
## 5 Cyber Threat and Training Models and Programmes Adaptation Tool
### Adaptation Based on Sphynx's Security Assurance Platform
#### 5.1.2 Adaptation Based on Vulnerable Assets
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Content** & **CTTP Models** & **Covered Threats/Vulnerabilities and Defence Techniques** \\ \hline Introduction to Cyber Security & Main lecture and educational material & Introductory knowledge of general security-related issues and the aspects of confidentiality, integrity, availability, authentication, authorization, non-repudiation, and privacy. \\ \hline Password management & -Main lecture and educational material -Emulation of a virtual lab for the installation and utilisation of a password manager (i.e., KeePass) & Password management issues, including the problems from weak or easily guessed ones and password cracking, as well as aspects of creating strong passwords, password ageing and update policies, and practical and user-convenient practices for password maintenance. \\ \hline Phishing and social engineering & -Main lecture and educational material -Emulation of a virtual lab with an email phishing scenario and the use of OpenPGP software (Kleopatra) -Serious game for targeted social engineering on system administrators with the PROTECT game [37] & The everlasting effects of social-engineering with a focus on phishing attacks, as well as email security authentication, integrity, and confidentiality. \\ \hline Malicious software and patching & -Main lecture and educational material -Emulation of a virtual lab for malicious software analysis and the examination of malware samples with relevant static binary analysis tools (e.g., PEView, EDx, TUBS library analysis [42], etc.) & Software flaws, vulnerabilities, and attacks, as well as relevant protection mechanisms, the need for regular patching, and analysis tools of malicious software and attacker’s tactics. \\ \hline Network monitoring and security & -Main lecture and educational material -Emulation of a virtual lab for secure network configuration and monitoring of networking traffic with the tool Head(er) Hunter [43] & Networking manipulation and attacks, as well as secure configuration, administration, and operation, with a focus on continuous traffic monitoring and classification. \\ \hline Digital (CTF) & Forensics & -Main lecture and educational material -Emulation of a virtual lab for the examination of a performed attack on the server (i.e., data breach, crypto-mining, or ransomware based on the activated CTTP model) and the utilisation of forensics software (e.g., glogg, volatility, Wireshark, Nmap, etc.) & Advance attacker’s tactics and familiarisation with actual malware and emulated attacks, including tools and methodologies to conduct a digital forensics analysis as a first-responder to security-related incidents. \\ \hline Attacks on the backend system (Red/Blue team scenario) & -Main lecture and educational material -Emulation of a virtual lab with a vulnerable server that the blue team has to defend (the populated vulnerabilities are defined in the selected CTTP model and are correlated with the defined KPIs) -The red team can be either performed by the trainees via a similar emulated setting or can be completely simulated and triggered automatically or activated manually by the trainer \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Backend security manager training programme. ### Training and Compliance

Based on our first iterations of the overall security monitoring and adaptation of training for the accomplishment of the designed KPIs, the authors observed similar trainees' behaviours as in the literature (see Section 2.1). For instance, the fact that a trainee completed the \"password management\" content and successfully covered the learnt material, does not mean that he/she is going to adopt the working behaviour and update the password-related habits right away [17; 18]. On the other hand, it could take several weeks or even months for the event captors to capture events regarding password updates that should have been performed by the trainees for organisation-critical services (as presented on the learnt password policy).