More partners needed as the cyber range evolves

Learning to defend by attacking

Anders Skaar has worked in IT security since 1997, mainly with protective security and security requirements for systems in the public and private sectors. Before joining Cyber Campus, he worked with CRATE, the cyber training environment of the Swedish Defence Research Agency (FOI), where crisis management teams and cyber defence teams practise responding to an attacker.

The cyber range takes a different approach. Here, participants break into systems themselves, solve challenges and find so-called flags.

“By being on the other side and trying to get into a system, you also get good at knowing how to protect yourself and how to think when you design a defence,” says Anders Skaar.

The range is mainly used to train students who will work in cybersecurity in industry and the public sector, but companies and agencies also buy the training for their own staff.

A range that keeps up

The cyber range was developed at NSE, the Division of Network and Systems Engineering at KTH. It has now moved to Cyber Campus, which is responsible for providing, operating and maintaining it. Among other things, Anders Skaar has mapped out the components the range consists of and what it takes to run it.

He stresses that a cyber range is never finished.

“The software we build systems from today is not the same as three, five or ten years ago. Software and operating systems change all the time, and that is why the cyber range has to change with them,” he says.

That makes the range valuable even for people who have already worked a few years in industry or at an agency and need to update their knowledge of new attacks and vulnerabilities.

A forum for developing the range together

To keep the range up to date while lowering operating costs, Cyber Campus is launching a developer forum where participants meet in breakout sessions on different topics. Several universities have already joined, along with the companies Nrdsnipe and Cparta. An application has also been submitted to Vinnova to develop the range together with industry.

“We want to bring in more players, for example other agencies and more of industry, so that we can collaborate on this,” says Anders Skaar.

The collaboration is built on a four-layer model. The first layer is a shared library of vulnerabilities and services, which are then built into ready-to-run machines, assembled into scenarios with flags and finally run in an operating environment. Each organisation chooses which layers it wants to use and can replace the rest with its own tools. The library is the main focus of joint development, and everything is designed to work whether the range runs in the cloud or in an organisation’s own data centre. KTH currently runs its range in Google Cloud, while others can connect their own environments.

Those who join have a lot to gain. The forum is developing a common Swedish definition of what a cyber range is, and a shared language makes it easier to help each other when problems arise. Participants also share flags, which makes the training more varied than if every university built its own. And when more organisations work in similar ways, technology and resources can be shared, making operations cheaper.

Breadth is a strength in itself. Different universities, companies and agencies bring different perspectives, and that shows in the exercises.

“With universities from different parts of the country, and with industry and business on board, we get new angles,” says Anders Skaar.

How to join

The developer forum is open to Cyber Campus partners and other organisations that want to contribute. Fill in the form below with what type of organisation you are and who your contact person is. We will then get back to you with more on what taking part involves, what you are expected to contribute and what you get in return.

Register your interest here