Cyber Training Range SOO DRAFT.pdf

DAU Cyber Training Range Courses Statement of Objectives (SOO)

6 March 2024

1. Purpose: DAU is seeking a qualified vendor(s) to host virtual range classes for hands-on cybersecurity training.

2. Background: Since 2019, DAU has been training DoD acquisition workforce personnel in cybersecurity using a “hands on” cyber training range. Training is conducted in a classroom setting or in a virtual instructor led training (VILT) environment using MS Teams and remote access to cyber training range (CTR) virtual machines. DAU also offers a hybrid classroom/VILT training option where part of the student body are physically in the classroom and the remainder are online. Three CTR classes are currently offered:

a. CYB 5640 – Cyber Training Range. This DAU course provides an introduction to offensive cyber tactics, techniques and procedures (TTPs) employed by an adversary when exploiting a target system. The course lasts 2.5 days and consists of:

i. One half day of introduction to offensive cybersecurity via instructor lecture.

ii. Three instructor led scenarios (one half day each) where the students are guided through exploitation of network systems. The exploit training is conducted in a virtual environment where students follow the instructor as he/she demonstrates steps the adversary uses in system exploitation. Tools including Kali Linux, Nmap, Metasploit, and Wireshark are used in the scenario exercises.

iii. One instructor led scenario (one half day) where the students are guided through exploitation of an unmanned aerial vehicle (UAV) and the UAV ground control station.

Virtual machine (VM) operating systems including Kali Linux, Windows 7, Windows 10 and CentOS 7 are used by the instructor and students in the class. CYB 5640 is designated CYB 5640V for the VILT offering and it was previously designated WSS 010.

b. WSS 011 – Intermediate Cyber Training Range. This workshop is offered as a follow on to CYB 5640. The workshop is offered only in a VILT environment. The workshop builds on the skills gained by students in CYB 5640 and transitions the student from a 100% instructor led model to an approach which is partially instructor led and partially student self-paced using a capture the flag (CTF) approach. The workshop lasts two days and consists of a threaded scenario where the ultimate objective is for the student to work through an iterative cyber attack kill chain by laterally moving throughout systems/network and install ransomware malware on a target system. Virtual machine (VM) operating systems including Kali Linux and Windows 10 are used by the instructor and students in the class.

c. WSS 012 – Cyber Training Range, Defensive Cyber Operations (DCO). This workshop builds on the skills gained by students in CYB 5640 but shifts the focus to defensive cyber operations.

Instructor led and self-paced training in the workshop includes secure configuration, attack surface enumeration and cybersecurity service provider. The workshop is offered in the VILT environment and lasts three days. Virtual machine (VM) operating systems including Kali Linux, CentOS 7, Cisco Router, Security Onion and Windows 10 are used by the instructor and students in the class. Tools used in the class include (but are not limited to) Burp Suite, Nikto, Nessus and Wireshark.

DRAFT

3. Period and Place of Performance: The contract will include a base year and then options for up to four additional years. Work will be accomplished at the vendors facility. Students will remotely log into vendor range infrastructure.

4. Performance Objectives: The classes will include both an instructor led option and a student self-paced option with instructor office hour support. The class titles and anticipated annual student throughput requirement follows in Table 1.0.

Course Title Instructor Led Self-Paced (Asynchronous) CYB 5640 Cyber Training

Range (CTR) 12 classes, 30 students

360 total 500 total

WSS 011 Intermediate CTR 6 Classes, 30 Students 180 total

250 total

WSS 012 CTR - Defensive Cyber Operations (DCO)

6 Classes, 30 Students 180 total

250 total

WSS 018 CTR - Weapon Systems

4 Classes, 30 Students 120 Total

250 total

WSS 019 CTR – Industrial Control Systems

4 Classes, 30 Students 120 Total

125 total

WSS 020 CTR – Software Assurance (SWA)

4 Classes, 30 Students 120 Total

125 total

WSS 021 CTR – Zero Trust 6 Classes, 30 Students 180 total

250 total

Table 1.0 Course Requirement Summary

Instructor led classes last 3 days each and typically run Tuesday through Thursday. Instructors require range access to the course virtual machines (VMs) 2 weeks prior to each session and for four days following. Sessions will be roughly evenly distributed through the year. Students will require range access one week prior to their session to verify accounts and access and for four days following the course completion for a total of two weeks (seven days prior, three days of class and 4 days following). The vendor will provide a help function for students with range access or navigation problems.

Self-paced (asynchronous) students will be provided access to their necessary VMs for a total of two weeks to complete the coursework. Students may optionally be granted a two-week extension in the event that they cannot complete the course in the allotted time. If the student cannot complete the course in the allotted two weeks plus the two-week extension, they are considered to have failed and must receive authorization from the DAU course manager to reregister as a new student. DAU will provide for office hours for asynchronous students to assist with problems they may have with the coursework. The vendor will provide a help function for students with range access or navigation problems.

The contractor will provide technical support for integration of their student registration and tracking system with the DAU learning management system (LMS).

The contractor will provide technical support for possible integration of DAU developed virtual instances (OVA format) into the contractor’s infrastructure.

Detailed objectives for each individual course are included later in this document.

4.1. Range Technical Objectives

The following top level objectives apply to the range and range interfaces.

i. Browser Compatibility. The vendor will ensure compatibility with MS Edge, Google Chrome and Fire Fox browsers.

ii. Availability. The vendor will provide for 24/7 operational range availability (Ao) at 95% threshold and 99% objective.

iii. DAU Learning Management System (LMS) integration. The vendor will provide for integration with the DAU LMS to facilitate student registration and tracking requirements.

iv. Security. The vendor will provide separate tenant space on their shared servers for DAU content. Content will include Controlled Unclassified Information (CUI).

v. Accounts. The vendor will provide an administrative supervisor account for DAU use.

The vendor will provide four faculty accounts for each range course with the ability for DAU to swap in instructors as needed.

vi. The vendor will provide for 200 hours of non-recurring engineering per year to assist with curriculum development, integration of DAU curriculum to their environment and other engineering tasks approved by the contracting officer (KO) or contracting officer’s representative (COR).

vii. Authentication. The vendor will provide for user authentication to provide for security of the DAU operating environment. Authentication will include a single sign on capability enabling full access to all required VMs and training materials.

viii. Concurrent course delivery. The vendor will provide for simultaneous delivery of courses in instructor led and asynchronous environments. For example, two DAU instructors may conduct a CYB 5640 conduct for 30 students at the same time two other instructors are conducting a CYB 5660 course. There may also be 100 students working asynchronously, spread across the seven courses at the same time.

4.2. Course Specific Objectives

4.2.1. CYB 5640 and CYB 5640A - Cyber Training Range

This course provides introductory level, hands on laboratory exploration of adversarial cyber threats to DOD networks. Students will learn and execute (in the lab environment) basic offensive cyber techniques to exploit target systems. Curriculum includes exploits by outsider, insider and nearsider threat actors. Adversary tactics, techniques and procedures follow the MITRE ATT&CK framework from initial reconnaissance through cyber effects.

Tools used by the adversary are included in a Kali Linux virtual machine and are used to gain a foothold in a target machine to execute data exfiltration.

Instances used in the existing course include:

Operating System Version Type

Kali Linux 7 Open Source Windows 7 COTS Windows 10 COTS

CentOS Linux 7 Open Source CentOS Linux 7 Open Source CentOS Linux 7 Open Source

Terminal Learning Objective (TLO): Understand offensive Tactics, Techniques and Procedures (TTPs) to enable better defensive outcomes.

Enabling Learning Objectives (ELOs):

• ELO 1: Recognize cyber-attack vectors to “Think like an adversary”

• ELO 2: Execute cyber-attacks against vulnerable networks to exploit vulnerabilities

• ELO 3: Describe defensive approaches which would provide system resiliency in the cyber contested environment

4.2.2. WSS 011 and WSS 011A - Cyber Training Range – Intermediate

The Intermediate (Level 200) Cyber Training Range - This workshop provides self-guided hands on laboratory exploration of cyber threats to DoD networks using sophisticated cyberattack methods such as a Ransomware. Students learn and execute (in the lab environment) a cyberattack kill chain using offensive cyber tactics, techniques and procedures. Examples of tactics, techniques and procedures include establishing an initial foothold using attacks such as Cross Site Scripting; conducting reconnaissance by manipulating email accounts and executing a Phishing attack; laterally moving throughout the network and escalating privilege; and running an attack to effect mission such as a ransomware. All students will develop mitigation and prevention strategy for vulnerabilities exploited in the workshop including ransomware.

Instances used in the existing course include:

Operating System Version Type

Kali Linux 7 Open Source Windows 7 COTS Windows 10 COTS

Terminal Learning Objective (TLO): Apply cyber adversary Tactics, Techniques and Procedures (TTPs) to enable proactive cyber defenses and make effective security decisions

Enabling Learning Objectives (ELOs):

• ELO 1: Exploit vulnerabilities of an enterprise network to execute ransomware attack

• ELO 2: Use open-source tools to conduct adversarial TTPs throughout the cyber-attack kill chain

• ELO 3: Identify cyber defenses and mitigations to proactively prevent cyber-attacks

4.2.3. WSS 012 and WSS 012A - Cyber Training Range – DCO

The Cyber Training Range - DCO course provides hands on laboratory exploration of cyber defensive measures used in support of DoD information systems. Students will enumerate system attack surface; analyze vulnerability scan data to prioritize appropriate defensive measures; identify, review, and implement secure configuration standards; and analyze network data to identify anomalous activity and initiate incident response activities.

Critical Behaviors: Upon completion of this workshop the student will in their work environment, be able to:

i. Enumerate the cyber attack surface associated with common information system and network components using manual and automated tactics and techniques.

ii. Write defensive system cybersecurity performance requirements from the perspective of defending against adversarial attacks on a DOD system utilizing information technology.

iii. Provide subject matter expertise at system design reviews regarding defensive Information Technology architectures and designs that are necessary to defeat cyber attacks.

iv. Train program office personnel and system developers on various defensive measures to address system vulnerabilities and/or cyber incidents.

Terminal Learning Objective (TLO): Use threat-based engineering principles to support decisions made regarding defensive cybersecurity throughout systems development lifecycle

Enabling Learning Objectives

i. (ELO) 1: Utilize various techniques and tools to enumerate system attack surface

ii. ELO 2: Select appropriate security measures for application based on the laboratory system/network contents and configuration

iii. ELO 3: Analyze and process vulnerability scan data to determine and prioritize potential operating system and application vulnerabilities

iv. ELO 4: Utilize tools and techniques to analyze network data to identify potential anomalous activity typical of cyber attacks

v. ELO 5: Select and apply the appropriate incident response procedures based on the laboratory scenario

Instances used in the current WSS 012 workshop Operating System Application Version Type

Linux 7 COTS - Freeware Security Onion 2.3 COTS - Freeware

Windows 7 COTS Google Chrome 103 COTS - Freeware

Windows 10 COTS LibreOffice 7.3 COTS - Freeware Adobe Acrobat 22 COTS Google Chrome 103 COTS - Freeware SCAP Compliance Checker 5.4.2 GOTS

Windows Server 2008 COTS

IIS 7.5 COTS

Linux 7 COTS - Freeware SCAP Compliance Checker 5.4.2 GOTS Firefox COTS - Freeware

4.2.4. WSS 018 and WSS 018A - Cyber Training Range Weapon Systems

The Cyber Training Range – Weapon Systems course provides hands on laboratory exploration of adversarial cyber threats to DOD weapon systems. Students will learn and execute (in the lab environment) basic offensive cyber techniques to exploit target systems.

Adversary tactics, techniques and procedures follow the MITRE ATT&CK framework from initial reconnaissance through cyber effects.

Curriculum Objectives for this new DAU course

i. UAS familiarization

ii. Computer communication refresher

iii. UAS datalink jamming

iv. UAS datalink reconnaissance and analysis

v. UAS datalink spoofing

vi. UAS datalink buffer overflow attack

vii. Embedded device security

viii. MIL-STD-1553 sniffing

ix. MIL-STD-1553 spoofing

x. MIL-STD-1553 embedded system buffer overflow

4.2.5. WSS 019 and WSS 019A - Cyber Training Range – ICS

The Cyber Training Range – ICS course provides hands on laboratory exploration of adversarial cyber threats to DOD industrial control systems. Students will learn and execute (in the lab environment) basic offensive cyber techniques to exploit target systems.

Adversary tactics, techniques and procedures follow the MITRE ATT&CK framework from initial reconnaissance through cyber effects.

Curriculum Objectives for this new DAU course

i. ICS Policy, Standards and Regulations

ii. Fundamental concepts of cybersecurity and industrial control systems (ICS)

iii. Explore the similarities and differences when securing IT and ICS networks

iv. Networking and Cryptography

v. Reconnaissance and Assessments

vi. Purdue Level 0 and 1 Devices

vii. Purdue Level 2 and 3 Devices

viii. Wireless Communications

ix. Secure ICS Architecture

x. Endpoint Security

xi. Incident Response and Recovery

xii. Secure PLC Coding Practices

xiii. Launch real-world attacks on virtual ICS networks

1. Modbus, OPC UA, Ethernet/IP, MQTT, BACnet

2. PLCs, HMIs, Historians, IIoT

xiv. Simulations – Power plant, chemical plant, HVAC (BAS)

4.2.6. WSS 020 and WSS 020A - Cyber Training Range – SwA

This introductory course will require learners to understand the main components of the system undergoing adversarial cyber attack, use cases, operational risk assessment, loss scenarios, and resilient modes. Cyber Security Requirements Methodology (CSRM), System Theoretic Process Analysis Security (STPA SEC), Framework for Operational Resilience in Engineering and System Test (FOREST), and Mission Aware Concepts, can be deployed in a virtual instructor led environment using a modeling environment such as Vitech Genesis. An introductory course can use pre-developed and hosted examples on

GitHub (or equivalent), whereas a practitioner course can allow access for each student to the model to administer training.

Curriculum objectives for this new DAU course:

i. Knowledge of software quality assurance process.

ii. Knowledge of software engineering.

iii. Skill in applying secure coding techniques.

iv. Ability to develop secure software according to secure software deployment methodologies, tools, and practices.

v. Skill in performing root cause analysis.

vi. Skill in using code analysis tools.

vii. Skill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.

viii. Skill in writing code in a currently supported programming language.

ix. Knowledge of development and application of security system access controls.

x. Skill in creating programs that validate and process multiple inputs including command line arguments, environmental variables, and input streams.

xi. Skill in conducting software debugging.

xii. Knowledge of penetration testing principles, tools, and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).

xiii. Knowledge of embedded systems.

xiv. Knowledge of complex data structures.

4.2.7. WSS 021 and WSS 021A - Cyber Training Range – Zero Trust

Terminal Learning Objective for this new course: Students acquire practical skills and knowledge relevant to implementing and maintaining a Zero Trust security model.

Enabling Learning Objectives for this new course:

i. Understanding Zero Trust Principles:

1. Define the core principles of Zero Trust.

2. Explain the shift from traditional security models to Zero Trust.

ii. Identifying and Classifying Assets:

1. Identify and classify organizational assets.

2. Demonstrate methods for assessing the criticality of different assets.

iii. Implementing Micro-Segmentation:

1. Implementing micro-segmentation strategies.

2. Demonstrate hands-on experience with network segmentation tools and techniques.

iv. Authentication and Authorization:

1. Illustrate best practices for implementing strong authentication mechanisms.

2. Describe authorization methods in a Zero Trust environment.

v. Continuous Monitoring:

1. Describe continuous monitoring concepts and tools.

2. Set up and configure continuous monitoring solutions.

vi. Endpoint Security:

1. Describe techniques for securing endpoints in a Zero Trust architecture.

2. Implement endpoint protection measures.

vii. Data Encryption:

1. Explain the importance of data encryption in Zero Trust.

2. Conduct hands-on exercises on implementing encryption for data in transit and at rest.

viii. Incident Response in a Zero Trust Model:

1. Develop incident response plans specific to a Zero Trust environment.

2. Simulate and practice incident response scenarios.

ix. Policy Enforcement:

1. Demonstrate the implementation of policies for access control.

2. Create and enforce policies based on Zero Trust principles.

x. Vendor Risk Management:

1. Describe strategies for implementing Zero Trust with third-party vendors.

2. Describe strategies for assessing and managing risks associated with external partners.

xi. User Education and Awareness:

1. Understand the role of user education in Zero Trust.

2. Conduct simulations to enhance user awareness and adherence to security practices.

xii. Automation and Orchestration:

1. Describe automation and orchestration tools for Zero Trust environments.

2. Create automated responses to security events.

xiii. Compliance in a Zero Trust Framework:

1. Outline how to align Zero Trust practices with regulatory compliance.

2. Provide examples of compliance requirements and how they can be addressed.

xiv. Testing and Evaluation:

1. Demonstrate skills in conducting security assessments within a Zero Trust framework.

2. Test and evaluate the effectiveness of Zero Trust solutions.

xv. Real-world Case Studies:

1. Analyze real-world Zero Trust implementation case studies.

2. Discuss challenges and lessons learned from organizations that have successfully adopted Zero Trust

5. Operating Constraints:

1. Range access shall be enabled for individuals working from US government computing equipment as well as personal PCs.

2. If the vendor cannot provide a range that satisfies requirements for both enterprise network cybersecurity training and embedded computing systems (weapon system & ICS) cybersecurity training, teaming is encouraged.