DARPA builds Cyber Range to test security measures

Automated strategy will speed ideas rapidly from concept to operations

The Defense Advanced Research Projects Agency and industry are developing a National Cyber Range to test network attack-and-defend strategies, much the same way that the United States created a range at Bikini Atoll in the 1940s and 1950s to test atomic weapons.

The goal of the NCR is to accelerate government research and development in high-risk, high-return areas and jump-start technical cyber transformation in the private sector. NCR will achieve this by providing a real-world simulation environment from which companies and research organizations can develop, field and test advanced concepts and capabilities to defend U.S. communications networks against cyber threats.

There are already a number of smaller, noninterconnected cyber ranges for testing in the United States, but none of them provides the single, large-scale test bed that DARPA said will quickly produce qualitative and quantitative assessments of cyber R&D. For example, there is the Joint Forces Command Information Operations Range, which has been operating since 2006 and routinely conducts more than 100 experiments a year related to information operations.

What DARPA wants to do with the NCR is take testing automation to the next level so that time-consuming, manual setup time can be kept to a minimum, leaving more time to conduct experiments so cyber defense can be more quickly woven into the nation’s communications networks.

“We’re looking at revolutionizing the state of the art of cyber testing itself,” said Michael VanPutte, DARPA program manger of the National Cyber Range. “We want to create a test range that is fully automatic and rapidly configured so that we can get the results back out to the community. We don’t want to take six months to do the test and another three months to do the analysis. We want to do a large number of tests rapidly and really push the comprehensive national cyber initiative to get technologies deployed.”

NCR is not a Defense Department program even though DARPA is the lead agency. Rather, it is part of the Comprehensive National Cybersecurity Initiative, a major governmentwide effort established during the Bush administration to increase the nation’s defenses against electronic attack. As such, NCR will be open to industry network scientists and engineers from industry, government, the military and academia who want to test their cyber tools.

For CNCI to be successful, the government must develop technologies that dramatically improve cybersecurity.

“There are so many areas that need research that we’re not going to solve a lot of these problems in an evolutionary fashion,” VanPutte said. “That’s why we’re focusing on high-risk, high-payoff technology experimentation related from everything from spam to mitigating computer bots."

“We can’t solve those problems by patching the boxes,” VanPutte added. “We need better solutions, so what we ask is for the community to bring their ideas to NCR, test them, and see what works and what doesn’t work in a quick fashion.”

Prototype Ranges

The second phase of the NCR program began in February with the award of a $31 million contract to Lockheed Martin's Simulation, Training and Support unit and the Applied Physics Laboratory at Johns Hopkins University. In Phase II, DARPA, Lockheed Martin and Johns Hopkins will build and evaluate prototype ranges and their corresponding technology.

Under Phase I of the NCR program, which lasted for about six months, DARPA and a number of industry organizations created initial conceptual designs, concepts of operation, and detailed engineering and system demonstration plans. Besides Lockheed Martin and Johns Hopkins, participants in the first stage were BAE Systems Information and Electronic Systems Integration unit; General Dynamics Advanced Information Systems unit; Northrop Grumman's Intelligence, Surveillance and Reconnaissance Systems division; Science Applications International Corp.; and Sparta.

Although the National Cyber Range is designed to be a test bed for experimentation of offensive and defense network capabilities, VanPutte said the main purpose of NCR is to improve the defensive skills of the agencies that operate communications networks.

“We want to bring realistic attacks against our defensive capabilities,” he said. “Somebody with an academic point of view and understanding of computer security may not necessarily understand what is capable in the offensive community. By bringing nation-state-level offensive capability into the NCR, we can test out defensive tools in a more realistic fashion and get more realistic results out to the community.”

From a scientific point of view, there have been a number of technical and engineering challenges associated with developing the NCR concept. With the goal of speeding cybersecurity systems to government, military and private-sector communications networks, automating test processes has been one of the top goals for NCR.

“Probably the biggest technical objective that we’ve laid out is the full automation of both the resources and the testing itself,” VanPutte said. “We want a researcher to be able to come in and configure a task in an automated fashion, perhaps using a drag-and-drop graphic user interface, in order to design his architecture, the links, and the operating systems and applications. There are a number of solutions that are out there that have challenges, and testing in the NCR can help to get those technologies out there.”

Full-Spectrum Threats

Another challenge to testing has been the inability to stress systems in an operational environment against realistic users, who do not always behave as might be expected. That situation would be described as a full-spectrum cyber threat, VanPutte said. NCR will help developers challenge their basic assumptions and think outside the box of the engineer’s or user’s original assumptions.

A third challenge is the difficulty to reproduce machines down to the instruction level.

“I give you a machine, and within four hours, you give me a virtual machine that includes all the hardware," VanPutte said. "That is a really hard technological challenge. Some research has been put into all these areas, but we’re really trying to push them to a whole new level.”

In the future, DARPA will get NCR to a working state but will not operate the range, which coincides with the agency's charter for technology development. The plan is to transition NCR to an agency that has not yet been determined.

“It won’t necessarily be the DOD,” VanPutte said. “We’re looking across the U.S. government to see what makes the most sense. And that decision will most likely be made by the CNCI."

“But one of the things we’re trying to ensure is that we can share the technology we develop across all test beds," VanPutte added. "We’re not trying to build just a DARPA test bed. We’re trying to build technologies such as an automated tool suite, for example, that anyone can use in their own test beds.”

About the Author

Barry Rosenberg is editor-in-chief of Defense Systems. Follow him on Twitter: @BarryDefense.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group