0

I had been studying Cyber Ranges for a while & found out there applicability in defense, military control systems, enterprise & in medical. I'm interested to know if the stimulation which is carried out by these Cyber Ranges have the capability or would ever gear the capability to detect Business Logic Threats on Application Tier?

If this is already something which's accomplished by AI, I'm not sure I had found out any such sample working or enterprise usecase whereby it says so. Having said that - does Cyber Range detect Business Logic Threats which are seemingly wild or just rely on the high level detection of Network Stimulated Attacks?

p.s. Cyber Range uses virtualization to reduce costs which otherwise could require high-end hardware to stimulate larger scale organizations. These organizations would surely have internal applications, external applications & the logical aspects of it.

edit: To be precise I'm asking if current cyber range are capable to stimulate a large scale organization with obvious business logic threats which can be unleashed by manual security assessment efforts. Are these business logic security proactively detected while the stimulation is done?

  • You appear to be asking if a system could be designed a certain way: the answer is obviously "yes" (anything could be built). Are you asking if there are Ranges that do this currently? I'm really not sure I understand what you are asking here. Can you refine the question? I'd love to answer this because I, myself, have created a Cyber Firing Range that includes the ability to learn from the simulation and apply the logic to a Business real network ... – schroeder Apr 26 '17 at 6:29
  • Hi, I changed the misleading title from could to do to emphasize if cyber ranges currently covers the business logic security aspect in real time organization stimulation. The whole point is to pro-actively detect & hence train the red team & blue teams. I'm refining this the way I can best put up. Many thanks for your valuable inputs. – Shritam Bhowmick Apr 26 '17 at 15:29
1

Cyber ranges can be set up to simulate anything you want.

Most commonly they are used to simulate vulnerabilities so people can learn to exploit them but it would be easy to setup a misconfigured application which allows for business-logic exploitation. There are some intentionally poorly written web apps that simulate shopping carts and also a fake bank where you can play with business logic a little bit on Damn Vulnerable Linux. Possibly not the same type of business logic that you have in mind but it does exist already.

If the network you are simulating also has detection capabilities you could also simulate the defensive tools in use and in that situation you could have a Cyber Range which does detection. This is useful for practicing evading defenses.

That said the tools which typically would spot business logic threats frequently fall into a different category, Fraud detection, and these are not normally something you would see in most Cyber Ranges at this time. You could deploy them but it's so specific to a given business/organization that it's simply not something people would commonly train on. Again, you could do this if you wanted.

The following may be a good Cyber Range platform to get you started: https://opencyberchallenge.net/

Per edit to question: Cyber Ranges can be made to simulate huge networks with thousands of hosts fairly easily. That said, getting specific business logic and business logic monitoring into that environment would take additional work and is not something commonly done but it is something that can be done. At this time I think the answer for most ranges is that what you are asking about would almost never be detected because it's not a typical goal for these ranges. As I said earlier though you can set these up to simulate anything you want so if you want to simulate tests against systems with fragile business logic issues and monitor that you definitely can but it's not something you will find commonly done at this time.

  • 1
    the question appears to be about the ability to detect problems in the infrastructure, not simulate them – schroeder Apr 26 '17 at 10:11
  • @Trey Blalock but the goal of Cyber Range is to stimulate the target environment. Let's say this environment has undetected business logic security in one of their application. Does the Cyber Range detect it proactive when stimulation is done? – Shritam Bhowmick Apr 26 '17 at 15:25
  • @schroeder I really needed an expertise answer. Could you kindly look into it? I think your expertise might facilitate conclusion to this doubt.. – Shritam Bhowmick May 6 '17 at 1:35
1

Cyber ranges are mostly established for infra related imitation & simulations. Lot of cyber ranges count on network, host, system element creation in a virtual environment and then generate the volume and traffic patterns.

Establishing cyber ranges for business logic security failures could be a extremely complicated exercise. Since the logical flows would need to be discovered using gaps in simulated business logic environment which is very different unless one has complete internal details of logical & algorithmic construct of business application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.