# Design of Platforms for Experimentation in Industrial Cybersecurity
## 3 Objectives and Design Criteria  
Among the approaches listed in the previous section, the one presented in this paper can be framed as a physical replication approach for experimentation. The aim is to provide realistic environments for cybersecurity in critical infrastructures, based on the use of real equipment along with physical and virtualized computational resources. Virtualization should not be understood in this case as a simulation of those resources, since virtual machines are completely functional hosts and servers that run on top of a hypervisor instead of directly on the physical machine. Virtualization of hosts and network management allows a more efficient use of computational resources and makes it easier to deploy a machine to a certain subnetwork. The deployment of new hosts might be necessary in different scenarios. The characteristics that are considered more important are fidelity, diversity, flexibility and ability to monitor:* Fidelity or the ability to reflect the real nature of the system is a challenge that is addressed through the use of a physical replication approach. It is necessary to enable some of the proposed usage objectives. * Diversity is addressed through a wide coverage of sectors but also of the specific technologies that are commonly found in each sector. In this sense, the proposed laboratory covers four different domains (industry, buildings, energy and wireless sensors), including their architectural and technological differences. Although control systems in different areas follow common principles, some of their elements are domain-specific and are interconnected using particular architectural patterns. For instance, ignoring non-routable serial protocols would hide the complexity of fieldbus networks, hampering a deep understanding of their vulnerabilities. The platform also covers the usual elements, software and communication protocols that are commonly used in the lower levels of the automation pyramid for each sector. * Flexibility is needed to adapt to different usage scenarios. The use of virtualization makes reconfigurability possible, enabling the evaluation of different network architectures and the rapid deployment of elements needed for operation of the control system, security enforcement, information gathering or attack emulation. Regarding the control system, the arrangement of a certain subset of hosts can be used to create different automation schemas. These schemas can be designed from the perspective of complexity (e.g., monitoring a subprocess with a stand-alone SCADA or the whole process with a networked structure), security (in terms of network segmentation and host-based or perimeter security measures) or communication protocols (e.g., Ethernet/IP instead of Modbus TCP for communication in the control network). * The ability to monitor the system operation involves the acquisition of security-related data (such as network traffic, logs or system artifacts) or process data (such as those recorded by the operational historian software). It allows the online monitoring or offline analysis of any research activity performed in a testbed. This characteristic is critical for experimentation since, in some cases, it is a key stage. That would be the case for the validation of proposed security mitigations, such as IDSs. It is also necessary to define the main usage objectives for the laboratory:
* The development and assessment of demonstrations used for operator training, which address both the technical and pedagogical challenges to train professionals with different backgrounds in the interdisciplinary topic of industrial cybersecurity;
* Identification of vulnerabilities and experimental validation of the feasibility of threats that can affect control systems and their networks;
* Assessment of the efficacy of mitigations and countermeasures. It includes on one hand the evaluation of procedures for prevention, detection and response to incidents.