Cyber Ranges and TestBeds for Education, Training, and Research

Abstract

In recent years, there has been a growing demand for cybersecurity experts, and, according to predictions, this demand will continue to increase. Cyber Ranges can fill this gap by combining hands-on experience with educational courses, and conducting cybersecurity competitions. In this paper, we conduct a systematic survey of ten Cyber Ranges that were developed in the last decade, with a structured interview. The purpose of the interview is to find details about essential components, and especially the tools used to design, create, implement and operate a Cyber Range platform, and to present the findings.

CYRA: A Model-Driven CYber Range Assurance Platform

“…The theory is rarely utilised to explain what factors are affecting users' compliance with security policies or even provide empirical evidence from their actual application. In general, it is suggested that training programmes should make use of methods and contents that are actively engaging trainees and motivate them to undergo systematic cognitive processing of the taught information [17,20]. Apart from modern technological tools (e.g., simulation, serious games), the continuous communication of the trainer with the learners is vital to improving users' security compliance [12,17,20].…”

“…A simplified illustration of the training transfer model is depicted in Figure 1. However, it is estimated that around 10-40% of all training experiences will be transferred to the workplace [7,17,18]. Moreover, as time passes from the completion of the training programme, employees usually becoming less motivated to retain the new operational behaviours (e.g., after one year).…”

“…Surveys for cybersecurity training in critical infrastructures, such as aviation, transportation, healthcare, energy, and nuclear sectors, are presented in [17][18][19][20]. In the last few years, there has been an increasing demand for cybersecurity professionals, which is expected to continue to grow [17]. Cyber Ranges are a promising solution for advanced training that can fill the gap by incorporating educational courses with hands-on experience.…”

“…Based on our first iterations of the overall security monitoring and adaptation of training for the accomplishment of the designed KPIs, the authors observed similar trainees' behaviours as in the literature (see Section 2.1). For instance, the fact that a trainee completed the "password management" content and successfully covered the learnt material, does not mean that he/she is going to adopt the working behaviour and update the password-related habits right away [17,18].…”

“…Regarding cyber-security training, although there is an increasing demand for modern Cyber-Range platforms with advance technical features (e.g., emulation, simulation, serious gaming), the transfer of the learned skills and the adjustment of the organisation's operation has been completely overlooked in almost all cases [17][18][19].…”