ICSrange: A Simulation-based Cyber Range Platform for Industrial Control Systems
This work addresses the need for accessible security training tools for maintenance staff in industrial settings, though it appears incremental as it builds on existing cyber range concepts with domain-specific adaptations.
The authors tackled the lack of cost-effective cyber range platforms for training and testing security in Industrial Control Systems (ICS) by proposing ICSrange, a simulation-based platform that uses Commercial-Off-The-Shelf technologies to virtualize networks and simulate industrial processes, and they demonstrated its effectiveness by executing a multi-staged attack that breached an enterprise network and intruded a simulated ICS with water tanks.
Maintenance staff of Industrial Control Systems (ICS) is generally not aware about information technologies, and even less about cyber security problems. The scary impact of cyber attacks in the industrial world calls for tools to train defensive skills and test effective security measures. Cyber range offers this opportunity, but current research is lacking cost-effective solutions verticalized for the industrial domain. This work proposes ICSrange, a simulation-based cyber range platform for Industrial Control Systems. ICSrange adopts Commercial-Off-The-Shelf (COTS) technologies to virtualize an enterprise network connected to Industrial Control Systems. ICSrange is the outcome of a preliminary study intended to investigate challenges and opportunities to build a configurable and extensible cyber range with simulated industrial processes. Literature shows that testbeds based on realistic mock-ups are effectively employed to develop complex exploits like Advanced Persistent Threats (APTs), hence motivating their usage to train and test security in ICS. We prove the effectiveness of ICSrange through the execution of a multi-staged attack that breaches an enterprise network and progressively intrudes a simulated ICS with water tanks. The attack mimics lateral movements as observed in APTs.