Cyber Ballistics

Scope

In the workforce training mode, Cyber Range provides a powerful and adaptable platform where the students learn Cybersecurity techniques, such as attacks, defenses, incident mitigation, or forensics. Cybersecurity concepts are taught and practiced in a secure environment but with actual production tools and cyber weaponry and are applied to real-world cyberinfrastructure scenarios.

For Cybersecurity professionals, Cyber Range serves as a workbench where new equipment - both physical and digital - can be tested, calibrated, and benchmarked.

Functionality

- design and rapid deployment of arbitrary cyberinfrastructures mirroring the functionality of their physical-world equivalents

- isolated in secure environments

- a single user or a multi-user, replicated modes

- a wide range of secure accessibility options (from the classroom, lab, or a remote location

- training environments ranging from a simple practicum designed to illustrate a Cybersecurity concept, to a full-scale, complex system such as a hospital, a power plant, or a government facility

NOTES:

• cyberinfrastructure: a collection of various elements such as routers, computers, firewalls, networks, or storage arrays orchestrated into a functional system. In most of the cases, the deployed cyberinfrastructure components are identical to those of their real-world equivalents.
• environment: a secure, isolated, and independent enclave containing a cyberinfrastructure. An environment is deployed either as a single instantiation or replicated to support simultaneous exercises and practicums.

We use our own, in-house developed software to orchestrate the range and to run exercises, practicums, and events. We have a large portfolio of cybersecurity curricula and practicums addressing everything from Attack Tools and Techniques to Network Security and Operating Systems Defenses. These resources were developed during our previous workforce training engagements and helped hundreds of students acquire advanced cybersecurity knowledge.

Our platform of choice is an on-premises, bare-metal deployment. Such an environment allows for arbitrary configuration of network, storage, and computational resources thus providing the most optimal and flexible substrate for the desired scenarios. In addition, it makes it possible to include actual cyber-physical components such as ICS PLCs, or medical devices. The downside of this approach is its large, upfront cost both in equipment, collocation, and expertise. Typically, we deploy OpenStack running on top of Cisco UCS platform integrated with the ceph storage clusters.

A potentially cheaper alternative is an instantiation of the range in Public Cloud environments such as AWS or Azure. Its downside is the scope of the exercises or toolsets allowed by the underlying cloud infrastructure. Having their own cybersecurity in mind, the limitations imposed by the cloud could be severe. Last but not least, when used intensively - e.g., ~500 virtual machines per class - and at a high duty cycle, the cost would rise very rapidly and match the cost of the on-premises, bare-metal systems.

Scope

First and foremost, Industrial Control Systems are the most critical components of the national infrastructure. Yet, its cybersecurity has always been an afterthought resulting in somewhat haphazard approach to its deployment and integration with other commodity cyberinfrastructures. To evaluate it correctly is a challenging task, especially because of the wide range of technologies hiding behind the label.

ICS is a general term that encompasses several types of control systems, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations that are often found in the industrial sectors and critical infrastructures, such as programmable logic controllers (PLC). An ICS consists of combinations of control components (e.g., electrical, mechanical, hydraulic, pneumatic) that act together to achieve an industrial objective (e.g., manufacturing, transportation of matter or energy).

Components of an ICS system - SCADA, PLCs, sensors, and actuators - employ a multitude of interfaces and communication protocols. Some are common and widely used (e.g., Bluetooth, USB, Ethernet) while others, such as modbus, profinet, or RJ485 are proprietary or legacy ones. Often, in order to integrate with modern communication infrastructures, the proprietary and legacy protocols are encapsulated in the current, commodity ones. A good example would be modbus over TCP/IP, profinet over Ethernet, or RJ485 over an arbitrary network protocol.

We focus is on the evaluation of these interfaces and communication protocols in the context of their cybersecurity posture with respect to the interaction with general cyberinfrastructures from the perspective of cybersecurity.

Scope

The problem space is very similar to that of ICS. Like in the ICS case, IoT uses a wide variety of interfaces and communication protocols. Unlike ICS, these devices are ubiquitous and their lowest-common-denominator communication protocols and interfaces use cheap commodity components. Quite often, cybersecurity of these devices has never been addressed. Even though IoT devices tend not to play critical roles in the national infrastructure directly, they do provide a large attack surface and can be exploited to gain control of systems that are much more important.

Scope

We focus on delivering and deploying accreditation-eligible infrastructures.

Environments: Cloud (AWS, Azure), on-premises (bare-metal, OpenStack, or their combination (hybrid)

Standards: HIPAA, CUI, FISMA, NIST SP 800 family

Because some organization-specific controls lie outside of the scope of what can be addressed externally, we can assist the client with the accreditation process but are not able to complete it independently

Scope

For projects that explore new approaches to cybersecurity of ICS or IoT, we can design project-specific embedded devices to the client's specification and prototype them. Whenever necessay, we will write drivers for these devices.

We have a limited capacity to design electronic circuitry based on client's specifications, produce the corresponding PCBs, assemble and test the resulting prototypes. In general, we limit ourselves to simple circuits with microcontrollers, embedded processors, SoC, and their corresponding interaces.