12 Key Features of Top Cyber Range Solutions

Every environment is different, and every team is different. A good cyber range solution will allow trainees to use the same tools and software during training that they use every day on the job. It’s important to train like you fight; Formula One drivers don’t practice timed laps in their minivans. Why limit your cyber professionals?

The training offered by a cyber range needs to focus on ensuring total comprehension, rather than memorization. Hands-on functional learning is essential: when a real cyberattack strikes, operators must be able to address the threat without relying on an “answer key”. The real world is not like a classroom, and cyber range training must enable trainees to move into practice.

Cyber professionals need to maintain their readiness. And in order to do so, they must train in a way that provides functional learning and skills development. Replay value and randomization are key to making sure that trainees can’t simply memorize a set of answers or look them up online in order to progress. An ideal cyber range ensures that no trainee will ever see the exact same question twice. This ensures that mentoring and cross-team learning are possible while still giving the student the hands-on experience and preventing cheating.

Cyber range administrators must be able to track training and advancement, provide feedback, and show results. A good cyber range will offer a variety of reporting and metrics tools to provide objective, measurable results. Range reporting should be easy to understand and easy to generate.

All organizations can benefit from cyber range training, but one size does not fit all.  A cyber range needs to be customizable and scalable to meet the needs of the customer. Not every implementation will have the same requirements for architecture, security, or clearance level. When choosing a cyber range, ask: how will this scale to our needs? What customizations are possible – or impossible?

It may seem counter-intuitive to think of cybersecurity training in an offline environment. But there are many real-world scenarios where this is necessary. For some organizations, security requirements may mandate that certain systems never connect to the corporate network or to the internet. And for deployed military, conferences, and events, there may not be internet access on demand. The ideal cyber range can be used under any circumstances, including without an internet connection.

Cyber range training should be easy to use, not create work and make things harder. Look for a cyber range solution that can be deployed efficiently, without requiring additional staff or extensive training. One of Aries’ clients told us that the system needs to be so simple that someone just out of boot camp with limited knowledge can set it up, so admins can do admin work and cyber operators can train. With cybersecurity staff shortages on the rise, having a cyber range that can be run by administrative personnel is a huge time- and labor-saver.

Many regulations, both commercial and government, require staff to maintain specific cybersecurity certifications, such as CISSP, Security+, GSEC, CEH, CISM, and CISA. To maintain these, professionals need to acquire a large number of continual professional education credits (CPEs). These CPEs can be gained listening to sales pitches disguised as seminars or reading articles, etc., but a good cyber range makes it possible to gain them while doing specific training that adds value to the organization. This lets professionals kill two birds with one stone.

A cyber range is only as useful as the training it makes possible. When looking for a solution, take into account whether the cyber range you’re looking at provides out-of-the-box challenges so that your team can begin training immediately. While having an environment that lets you build your own internet has some advantages, time spent sourcing challenge content is time that could instead be used to develop and improve skills. 

Every organization is different, and every implementation is different. The best cyber range vendors are aware of this and provide their product in a variety of formats to suit diverse needs. Whether it’s an offline hardware appliance that allows hardware in-the-loop, a virtual on-premise solution letting you use your existing infrastructure spend, or a fully cloud based Software-As-A-Service solution, a cyber range has to come in the format that bests fits your organizations needs.