# Down the Rabbit Hole: Fostering Active Learning through Guided Exploration of a SCADA Cyber Range
## 3 Development of the Cyber Range Environment
### The CANVAS Laboratory  
The complete cyber range environment is supported on top of the CANVAS (Composition Assembly of Validation Ambient Scenarios) laboratory environment (see Figure 1), which follows a three-tier design, encompassing asset, infrastructure and laboratory environment layers.  
An asset layer provides physical (real equipment) and virtualized computing resources, intellectual property (models and procedures contributed by end users) and data repositories. Assets may be flexibly allocated to build real and emulated scenarios for specific use cases. The infrastructure layer further develops the scenarios built from the assets, both real and emulated, available in the lab inventory. Finally, the topmost layer corresponds to the laboratory environments hosting the supporting domains for the use cases, integrated to provide the realistic conditions required for development, testing and validation of use cases or specific environments.  
CANVAS constitutes a flexible framework enabling the development, refinement and implementation of a wide array of scenarios. The specific laboratory organization is arranged along a metastructure, with each functional block providing a set of coherent resources and services, which may be leveraged to build use case scenarios by means of composition. CANVAS was designed from scratch as a flexible environment composed of several assets such as equipment (process-related, as well as computing capabilities), processes and/or models, allowing to develop hybrid scenarios ranging from isolated cyber-physical testbeds to complete end-to-end environments, to test and validate concepts and solutions in a controlled, high-fidelity environment.  
The benefits of this approach are manifold:  
* Safeguard infrastructure integrity, avoiding the deployment of components in production environments (and risking associated liabilities), providing a safe environment for teaching, pen testing and security analysis procedures (among which the latter two are known to be especially risky in production environments--NIST SP800-82 [19] provides such examples, also describing the potentially damaging outcomes). As such, these procedures could be safely developed and evaluated in a controlled environment, using real equipment, potentially providing invaluable data to the security community.
* Avoid loss of time and effort in dealing with security clearances, authorization procedures and other unforeseen aspects (such as the lack of authorization from specific OEM providers for vulnerability assessment procedures).
* Allow for the creation of custom environments with different specifications, replicating processes and procedures used in production environments using hybrid topologies, composed of real equipment and processes, together with emulated/simulated parts, along the lines of an evolved digital twin.
* Develop effective testing methodologies for defense against attacks on specific equipment, networks and systems, to measure the cyber resilience of a given scenario with different types of attacks/severity.
* Develop experiments to obtain a deeper understanding of different types of attacks, new techniques and defense technologies through the evaluation of different test scenarios and use/abuse cases.  
Moreover, CANVAS was designed to be integrated with existing testbeds from other partners, by means of federation, enabling the development of more elaborate use cases. Such federated cyber range testbeds and/or pilot sites may be designed to support training, development and evaluation efforts, by providing an environment for deployment and testing. Moreover, federation may be used for scenario composition, eventually creating interdependencies which could cause cascading effects.