The role of the cyber polygon in IS assurance

Ruslan Rakhmetov, Security Vision

An important task of any business is to maintain the necessary level of qualification, which is achieved by means of personnel training and coaching. In terms of information security, the issue of training is also acute - how to conduct it without disrupting basic business processes or weakening the current information security control? The answer is to train at a cyber firing range!

In recent years, the term ‘cyber firing range’ has become widespread. In essence, it is a platform for conducting exercises for information security specialists. The basic principle of work on such platforms is based on the competitive effect between teams. It has long been recognised that the game form of presenting information and practising skills is the most effective. Usually there are two sides to an exercise - the so-called red team and blue team. The first team is the attacking team and the second team is the defending team. Also, under certain conditions, it is productive to involve other employees who are responsible for ensuring basic business processes.

Thus, the cyber polygon allows you to:

• to practice attacks (penetration testing) on a ‘copy’ of the enterprise's IT infrastructure without creating threats to the main business processes;
  
• to get a cross-section of skills and knowledge; to determine what actions should be taken (in terms of employees) to build the most effective defence; to draw up competence development maps;
  
• provide direct training for both IT and IS employees and representatives of business units;
  
• test new approaches and IS tools;
  
• assess risks and the impact of the realisation of certain threats on the company's business processes.

I would like to mention the use of cyber polygons in the educational sphere, in particular, in universities when training specialists for the industry.

With regard to the internal structure of a cyberpolygon, experts usually distinguish the following typical subsystems/modules:

• cyberpolygon user interface - the shell of interaction between team members
  
• infrastructure on which the orchestration of services is performed and which, depending on the needs, has 3 main types of representation:
  
• physical emulation
  
• virtualisation/containerisation
  
• cloud technologies
  

• cyberpolygon application layer (modules):
  
• internet services simulation
  
• competence management
  
• attack simulation
  
• data collection and analysis
  
• user activity simulation
  
• evaluation and reporting
  
• scenario and content development
  
• trainer toolkit

Depending on the tasks and specifics, the cyberpolygon infrastructure usually includes some kind of application software/services that support the core business processes. It can also be not only software, but also specialised hardware solutions. Maximising the closeness to the real infrastructure ensures the quality of the cyberpolygon, but increases its cost. Companies must maintain a balance in this matter.

The particular importance of cyber polygons can be assessed based on the fact that a key element of the Federal Project ‘Information Security’ (as part of the National Programme ‘Digital Economy of the Russian Federation’) is the creation of a ‘cyber polygon for training and coaching students, specialists and experts of various profiles, information security and IT managers in modern security practices ’ (this task was performed by Rostelecom).

Currently, there are a number of companies on the market offering their developments in this area, there are both international and domestic solutions. In the current realities, of course, it makes sense to consider only domestic solutions, for example, from Cyberpolygon, BI.ZONE, Perspective Monitoring, Rostelecom (there are also a number of solutions that are used for internal use or as part of ongoing events).

The most popular and in demand are the so-called financial cyber polygons, as financial organisations are traditionally of the greatest interest to hackers and attacks on them are characterised by complexity and attempts to build into business processes in order to modify data and gain direct benefits through the theft of funds. Just the state ‘order’ for the cyberpolygon included requirements to create an infrastructure emulating the corporate networks of organisations of the credit and financial system of the Russian Federation (the so-called ‘IT Cyberpolygon’), as well as the industrial infrastructure (automated process control system) of the energy sector (hereinafter - the ‘Industrial Cyberpolygon’). Separately, it was required to create ‘independent centres for technical testing of software and hardware, including information security tools, allowing companies to gain access to analytical information and the results of independent testing of solutions offered on the market’. A systematic approach to this issue has made it possible to implement the necessary technical base and organise training and professional development of information security personnel, with different levels of ‘maturity’ (from students to the management of departments providing information security). Methodological support is also not standing still - the domestic regulator FSTEK, which took as a basis the world-famous methodology of the non-profit organisation MITRE, has joined in the development of a base of techniques and tactics for conducting attacks.

The general trend in the creation and development of cyber polygons is the development of applied business systems, the transition from attackers seizing control over infrastructure to ‘intelligent’ intervention in the work of emulated organisations and assessing the impact of such intervention on business processes, and the transition to a risk-oriented approach in the organisation of counter-attacks. Let us consider, for example, a typical infrastructure of a small bank from the point of view of applied business systems.

Most of the systems listed in the image are not represented in the existing cyber polygons, much less the specific hardware systems (e.g., bank HSMs and ATMs) that are part of them. Their implementation would allow to accurately assess the impact of an attack on the business as a whole, as well as to build parallel training for employees of business units, even working out their continuity and disaster recovery plans. Information security departments should not be locked into their own activities, and attacks are a common problem, often requiring interaction of all departments and coherence in actions.

The difficulty of creating such systems with a ‘rich’ application environment is due to the cost of such solutions for the financial sector, as well as the difficulty of keeping them running in a simulated operation mode. There will always be a separate issue in test data as well as points of interaction with the outside world. Therefore, even the creation of a virtual online shop to which acquiring services are provided can be considered.

Interesting opinions can also be heard about the gradual transition of cyber range exercises to the status of semi-mandatory. It is noteworthy that in 2020-2021, the Central Bank held events called cyber exercises with the largest banks, the results of which were used to assess the readiness of banks to counter and respond to cyber-attacks. These exercises in the next iteration may well be conducted at a state-owned cyber polygon, or somehow a separate employee training exercise may be recommended with the results submitted to the mega-regulator. Existing cyberpolygons will be developed in the form of expanding the range of both security tools and application software that emulates basic business processes to meet the most diverse customer needs and the specifics of their systems and business processes, through the introduction of a kind of cyberpolygon builder and template sets, including providing access to the cyberpolygon as a cloud-based solution.