A Review of Cyber-Ranges and Test-Beds: Current and Future Trends

TL;DR

This paper reviews current and future trends in cyber-ranges and test-beds, emphasizing their role in enhancing cyber situational awareness, training, and vulnerability assessment amidst evolving cyber threats.

Contribution

It evaluates documented platforms, segments them by various criteria, and develops a taxonomy to understand future directions of cyber-ranges and test-beds.

Findings

CRs and TBs are segmented by type, technology, threat scenarios, and scope.

A taxonomy is proposed to classify and understand future developments.

Diminishing differentiation between application areas of CRs and TBs.

Abstract

Cyber situational awareness has been proven to be of value in forming a comprehensive understanding of threats and vulnerabilities within organisations, as the degree of exposure is governed by the prevailing levels of cyber-hygiene and established processes. A more accurate assessment of the security provision informs on the most vulnerable environments that necessitate more diligent management. The rapid proliferation in the automation of cyber-attacks is reducing the gap between information and operational technologies and the need to review the current levels of robustness against new sophisticated cyber-attacks, trends, technologies and mitigation countermeasures has become pressing. A deeper characterisation is also the basis with which to predict future vulnerabilities in turn guiding the most appropriate deployment technologies. Thus, refreshing established practices and the scope of the training to support the decision making of users and operators. The foundation of the training provision is the use of Cyber-Ranges (CRs) and Test-Beds (TBs), platforms/tools that help inculcate a deeper understanding of the evolution of an attack and the methodology to deploy the most impactful countermeasures to arrest breaches. In this paper, an evaluation of documented CR and TB platforms is evaluated. CRs and TBs are segmented by type, technology, threat scenarios, applications and the scope of attainable training. To enrich the analysis of documented CR and TB research and cap the study, a taxonomy is developed to provide a broader comprehension of the future of CRs and TBs. The taxonomy elaborates on the CRs/TBs different dimensions, as well as, highlighting a diminishing differentiation between application areas.