New cybersecurity training platform strengthens Europe’s telecom networks In the face of increasing cyberattacks, an EU-funded project launched a new cybersecurity training platform to strengthen defences as 5G is rolled out. Security © issaro prakalung/Shutterstock.com 5G technologies, through their potential to enable and support a spectrum of functions and applications, play a major role in the digital socio-economic transformation across the EU, affecting a wide range of sectors. Yet there are many new security challenges and vulnerabilities associated with the development of secure 5G network architecture. Billions of euro are invested in cybersecurity measures each year in the EU. Despite this, the telecommunications industry remains vulnerable. “The complexity of threats and malicious activities in cyberspace is significantly growing, and cybercrime attackers are getting more sophisticated and organised, and are continuously evolving their tactics,” explains Pier Luigi Polvanesi, project manager at Ericsson and SPIDER project coordinator. The EU-funded SPIDER project developed a new cybertraining platform to improve 5G cyberdefence capabilities in the telecoms sector. SPIDER is a virtual environment used to help train industry security professionals to test out new security technologies, and support companies in their cybersecurity investments. “In essence, SPIDER has delivered a novel Cyber Range as a Service (CRaaS) platform targeting 5G deployments, to assist cybersecurity professionals of various levels to enhance their skills by being trained under realistic conditions,” adds Polvanesi. A training playground for cyberattacks In order to test new defences, SPIDER designed, developed and validated specific training scenarios in the 5G domain. SPIDER provides theoretical training on cybersecurity issues, hands-on training to interactively test and improve trainee skills, simulation training to help execute risk assessment and econometric analysis of auditors, and security-awareness training for non-expert users. One example of a training scenario is a trainee playing the role of an ethical hacker aiming to disrupt the business of the SPIDER Telecom organisation. After many months, the group has managed to infiltrate the telecom system through an IT administrator, using a hacking method known as a reverse shell. The trainee mission is to explore the network visibility of the compromised IT administrator, identify vulnerable assets and try to penetrate these assets as stealthily as possible by intercepting communications. Gamification and ‘serious game’ of cybersecurity SPIDER also introduces gamification elements into the security training, to increase cybersecurity awareness among employees who do not have specific cybersecurity skills. Red and blue teams are pitted against each other in cyberattack and defence. The teams have to achieve their mission objectives, to steal or defend information in the file server. These serious games contribute to making cybersecurity more engaging and help employees with more advanced expertise to understand more about the hacking mindset. This also trains employees to be more careful with sensitive information, and avoid risky behaviours. “The acquired fundamental technical skills are extremely essential, since it turns out that the human factor is the most severe vulnerability,” Polvanesi notes. Future development and potential for commercialisation of SPIDER Through the SPIDER project, the team designed and validated the platform architecture, developed supporting technologies, and successfully tested the system in five major pilots. “Next steps are about identifying possible enhancements of the platform to reach a higher maturity level, and support future commercialisation activities with a view to bringing SPIDER to the market,” Polvanesi says. Keywords SPIDER, telecommunications, cyber, attacks, cyberattack, cybersecurity, gamification, serious, games, serious game, security, training
