# Design of Platforms for Experimentation in Industrial Cybersecurity
## 4 Description of the Laboratory  
To fulfill the requirements exposed previously, a laboratory for industrial cybersecurity in critical infrastructures has been developed at the University of Leon [9], the Critical Infrastructure Cybersecurity Laboratory (CICLab). In Figure 2, a photography of the laboratory is shown. This section provides an extensive description of the laboratory oriented to extract design guidelines that can be applicable by other researchers in similar environments.  
CICLab includes four subsystems covering different areas: industrial control systems, building management systems, electric energy management systems and wireless sensor networks. The architecture was designed according to ISA95 automation pyramid, although connections with other elements can be established as required to perform possible experiments. Computing equipment consists of administration servers that are able to deploy virtual machines easily to perform particular tasks such as programming, monitoring, database management or collecting data.  
Figure 1: Laboratory architecture.  
There is one virtual LAN (VLAN) for each system, which represents the first levels (0-1) of the ISA95 automation pyramid and includes several components such as instrumentation or PLCs. These networks are separated using firewalls, such as Tofino Xenon or Hirschmann Eagle, which allow for establishing specific rules for industrial communication protocols and, in some cases, deep packet inspection. Level 2 contains SCADA systems whose networks are segmented according to the requirements of experimentation. A demilitarized zone (DMZ) is created in level 3 between operational and business information systems using firewalls. The DMZ protects the network from unauthorized traffic in both directions and contains auxiliary services such as web servers. The business information systems are located in level 4, where several virtual machines run typical IT and management software.  
From the point of view of computer hardware, CICLab is formed by a storage area network (SAN) with a storage capacity of 48 TB, five servers with dual Intel Xeon processors of eight cores, 128 GB of RAM, and managed switches and routers. The first three servers allow for deploying configurations of heterogeneous machines in a simple way corresponding to the different levels of the ISA95. The fourth one deploys virtual machines for laboratory management and cybersecurity-oriented software. The last server is used as firewall, with a pfSense distribution and connected to 12 network interfaces. Finally, the managed switches are used to reconfigure the network architecture, with it being possible to adjust the segmentation strictness.  
In Figure 3, a schema of the network architecture of the laboratory and the main virtual machines is shown. It can be seen that the second digit of the IP address indicates the subsystem (0: management, 1: industrial control, 2: building management, 3: electric energy management and 4: Wireless sensors). The third one indicates the ISA95 level and the last one the specific device or host. The right part of the figure shows the virtual machines with the software corresponding to the different levels of the pyramid, whereas the left part of the figure shows the virtual machines used to manage the laboratory and to perform the cybersecurity experiments. It should be noted that VLANs might be further segmented or interconnected to generate different training and research scenarios that are common in the industrial world.  
Electric supply for the four systems is provided through four power lines (two single-phase of 16 A, another single-phase of 32 A and one three-phase of 32 A) that are duplicated to ensure safety for the elements of the laboratory, and managed by electric cabinets with devices that can be operated remotely.  
Figure 2: Photography of the laboratory.