Critical infrastructure has become a focal point of cyberattacks, as previously isolated operational technology networks that were once perceived to be air-gapped are becoming Internet-exposed through increased connectivity with informational technology networks. Recent adversarial tendencies have led to an increase in targeted cyberattacks against both industrial control systems (ICS) and building automation systems. Furthermore, the insufficient supply of a cyber workforce exacerbates the challenges for organizations to defend their systems. Game-based learning is gaining traction and studies have shown that it is an effective educational element. Training facility operators responsible for critical services can be achieved through gamification of security policies and controls. The Network Defense Training Game (NDTG) is a cybersecurity training platform that encompasses a series of cybersecurity events that the player must assess and react to throughout the scenario to defend the network by thwarting the adversary's attack. The NDTG uses scenario narratives based on historical cyber incidents that affect ICS. It is designed to train facility owners and operators to evaluate their cybersecurity posture and to apply cybersecurity frameworks before and during the process of addressing cyber events and incidents. This study provides a detailed technical overview and design architecture of NDTG and demonstrates its capability in advancing the ICS cybersecurity workforce.

The zero trust principle only allows authorized and authenticated actions in a computer network. A network policy satisfies the least privilege principle by minimizing the network permissions to only those needed by users and applications. However, administrators face many challenges in creating a least privilege policy since it requires a detailed understanding of the network topology and knowing the communication requirements of every network application and user. This paper addresses those challenges by introducing a graph-based policy specification framework to capture a network's communication requirements and a network compiler that turns those requirements into an enforceable policy. To offset the effort of building such a stringent policy, we incorporate patterns to spread the work of policy creation over time and people. In the paper, we first elaborate on how our framework's semantics enhances network security and resilience. We then introduce a Security Policy Regression Testing tool (SPRT), which leverages our framework's semantics, to test and reason about consistency, correctness, and relevance of network security policies. Finally, we outline relevant research directions. CCS CONCEPTS• Security and privacy → Access control; Authorization; Network security; Domain-specific security and privacy architectures.

No abstract

No abstract

No abstract