How to Build a Cyber Range on AWS

Businesses have always tried to adapt and innovate when it comes to cybersecurity, but in today’s marketplace, doing so is more critical than ever. 

Layered defenses, vulnerability scans, and network monitoring are still useful, but recent, high-profile cyberattacks have proven that these measures are not enough; today’s threats call for businesses to take their preparations to the next level.

One powerful tool that is quickly gaining prominence is utilizing a cyber range on an organization’s own Amazon Web Services (AWS) deployment.  From there, it can test incident response protocols, evaluate new policies and security controls, and enhance coordination across its operations to stay ready in the face of new cyber threats. 

Fortunately, establishing, maintaining, and customizing a cyber range on AWS is not as difficult as it may seem. With the right tools, an experienced partner, and by taking advantage of the same cloud functionality and services your business is already familiar with, your organization can take a big leap toward increasing your security posture.

So, just how can your organization get started building its cyber range on AWS? This guide will take you through the key decisions you need to make and the components that need to be in place to make this initiative a reality.

What is a cyber range?

What if your organization could put your security and operations teams through the worst conditions that a cyber actor had to offer? What if you could test how your organization responded to a ransomware or DDoS attack that another company recently faced? 

These scenarios — and much more — are exactly what cyber ranges do. They provide are realistic, controlled virtual training ground where your security team can learn hands-on using simulations of cyber threats. 

Cyber ranges use virtualized replicas of your network devices, end-user hosts, security tools, and other infrastructure to enable your organization to offer a realistic and safe place for employees to apply their skills or test new defensive controls. 

Why build and host a cyber range on AWS?

Although cyber ranges are relatively new in the span of technology and cybersecurity, these test platforms have typically been hosted on-premises by large organizations with expansive budgets, experience, and resources or they have been sponsored by universities or even state and federal government agencies.

As the know benefits of cyber ranges continue to spread, organizations now have the option to partner with other providers in the market to help them build their own on- or off-premises environment. However, for organizations looking for the best of both worlds — the knowledge of a trusted cyber range provider and the streamlined operational and maintenance costs of off-premises, cloud-based infrastructure — the decision to build and host a cyber range on AWS makes a clear business case for itself.

What are the key components of an AWS-hosted cyber range?

So what exactly goes into establishing and running your own cyber range on your AWS deployment? 

Because the cloud offers flexibility, straightforward and configurable virtualized hardware and software, as well as cost-effective infrastructure that is scalable with your training needs and budget, hosting a cyber range on your AWS deployment can mean more predictable implementation and maintenance costs. 

With this foundation set, your team can then turn its focus toward establishing the key components of your own cyber range program. Organizations may approach design and administration differently, but each typically includes the following aspects:

Identified Roles and Responsibilities for Maintenance and Execution

Each organization will use its cyber range for different purposes and for different levels of evaluation and training, but there are some necessary functions that need to be defined so you can make the best use of your new advanced security tool.

These roles can include:

• Network engineers to build and maintain networking services within the simulated environment and add and modify components as needed
• Orchestrators who can establish the attack scenarios, automate tasks, and replicate interactions such as scheduling tasks or initiating different events based on the use case
• Scenario and content administrators to establish, document, and proctor the different cyber range events
• Data collection professionals who can utilize network- and host-based monitoring tools to track the performance of different systems and evaluate the scale and reach of offensive and defensive measures
• End-user simulators, which can be either real or automated client users to make the testing and evaluation process more realistic
  
  

A Flexible and Tested Cyber Range

Leverage the power, flexibility, and performance of an existing, tested cyber range like SimSpace’s, which can be easily installed and deployed on your own AWS infrastructure. 

SimSpace makes the establishment of otherwise complex cyber range environments easy and turns it into an hours-long activity, rather than one that takes weeks or months. Once in place, SimSpace will give your team the ability to build customized network environments with real security tools, replicate host-based traffic, replicate services, and put your security team to the test quickly.

A Current-State Infrastructure and End-User Device Schema 

With SimSpace’s cyber range in place, capture your current-state infrastructure from end to end as well as your end-user device configurations and schema.

Use this documentation as a baseline from which to replicate your current network environment for testing and training or from which to purposefully deviate to evaluate different modifications to find the optimal design.

Configured Security Tools and Network Devices

Curious to see how your current security tools and layered defenses would withstand a real attack? Want to evaluate different policies, network devices, or tools?

With SimSpace, it is easy to replicate your current environment or make the needed changes to test a different security technique or tool before you invest time and money in implementing it in your production environment. 

Scenarios to Test Incident Response 

Here, organizations have a lot of flexibility when it comes to the scenarios they want to recreate in a cyber range. Some organizations choose to use a pre-existing curriculum, and some even create their own.

In any of these cases, the ultimate goal is to prepare your security professionals for the types of situations they will encounter when they are confronted with a cyber threat, both as individuals and as a team. At the same time, your cyber range can be used to evaluate different security tools prior to deploying them, test which specific configurations or policies work best, and better understand how your existing ecosystem is performing under different stressors.

If your organization has the basics down, you can choose to recreate advanced persistent threats or run recent high-profile ransomware or other threat events against your own team to see how they would fare. 

Ready to take the next step?

The flexibility and realism built into a SimSpace Cyber Range can be critically important for enhancing your organization’s ability to respond to cyber threats — especially for those that run in an AWS environment where administrative and security best practices need to be formed to match each business’ needs.

Fortunately, by partnering with SimSpace, your security professionals can focus more on the critical aspects of testing, refining, and establishing your security controls in a cloud or hybrid environment and less on the nuances of designing and maintaining an industry-leading cyber range. This ability to focus your team is vital because going back to the same techniques, training methods, and testing approaches in the face of evolving cyber threats is not going to be enough anymore. 

To be ready for the threats of tomorrow, your team needs to pair new skills that have become instinctual through training with a test environment that matches your operational reality. 

A SimSpace cyber range hosted on your AWS deployment allows your security team to move beyond tabletop exercises and take the necessary steps to form the muscle memory that will help to keep your cloud environment, your data, and your customers safe when — not if — a real cyber actor has you in their sights. 

Ready to take the next step toward cyber readiness? Then click here to download a copy of The Comprehensive Guide to Cyber Ranges, and then set up your own personalized consultation with a SimSpace expert.