# Down the Rabbit Hole: Fostering Active Learning through Guided Exploration of a SCADA Cyber Range
## 1 Introduction  
Despite the evolving nature of the cybersecurity field, as well as the progress achieved over the past years, the ever-changing landscape of threats, vulnerabilities and attack vectors means that there is still much work to be done, with new issues being disclosed on a regular basis. As the demand for specialized cybersecurity professionals grows [1], we have reached the point where the industry needs exceed the output of the educational establishment--including academies and other specialized training organizations, corporate training, universities and, in some cases, the military. This situation is aggravated by the fact that, for most computer science undergraduate students, cybersecurity is just another specialization field that faces stiff competition from alternatives such as data science or software engineering. Moreover, because cybersecurity is an orthogonal topic to many roles and specialization profiles within the CS and IT domains, there is also the need to promote awareness for a broader public. This calls for a differentiated educational offer, both in terms of quality and didactic approach, focused on recruiting, engaging and preparing students to become capable professionals with a mindset geared towards excellence. Unarguably, the investment in updating and promoting good pedagogical practices can be one of the potentially differentiating aspects of a good instructor. On the organizational level, such efforts must be matched by appropriate investment in resources and infrastructures, way beyond the implementation of supervisory methodologies or survey-based quality management policies that often do little more than providing evidence to reinforce a diagnosis that has long been known: traditional teaching methods are often inadequate when it comes to motivating students. Is this perspective, differentiation emerges as a key ingredient of a successful training strategy: with a wealth of online contents available, it is up to instructors to add value beyond the often passive nature of such resources, promoting proximity and accessibility, regardless of the learning model that is adopted. Over the past years of pedagogical practice, the authors were able to recognize a set of clues that characterize the most common dysfunctions and imbalances in trainee groups--impatience and lack of prerequisite knowledge are among the most frequent. This calls for the adoption of selective scaffolding procedures in order to make content accessible, preparing and encouraging trainees to become involved in hands on activities as quickly as possible. When it comes to cybersecurity training, hands-on exercises and contact with high-fidelity environments play a vital role in promoting active learning--such exercises may range from Capture-The-Flag (CTF) challenges, self-contained within Virtual Machines, to working with emulated or simulated environments, for pentesting, vulnerability assessment or to provide practical experience on dealing with various simulated attacks and threats. The ability to develop the latter on a safe environment is crucial for the implementation of a comprehensive organizational cybersecurity framework, helping teams to develop much needed preparedness and incident response skills. Nevertheless, designing and deploying use case scenarios tailored for training purposes, such as the ones used on cyber ranges, requires both access to an adequate support infrastructure as well as a high degree of flexibility in terms of resource management--this is no easy task, regardless of opting for in-premises or cloud-based hosting model. This paper addresses the aforementioned aspects by presenting a comprehensive, end-to-end, take on the subject:  
* First, it presents a flexible framework for the creation of laboratory and testing environments for training purposes, detailing the design and development of a cyber range environment based on a Supervisory Control and Data Acquisition System (SCADA) process, conceived for a cybersecurity course taught at the University of Coimbra.