Software Engineering Institute

This report details the design considerations and execution plan for building high-fidelity, realistic virtual cyber ranges that deliver maximum training and exercise value for participants. A cyber range is a fully interactive virtual instance of the IT infrastructure of a mid-to enterprise-level organization that is dedicated to cyberwarfare training and exercise. The Software Engineering Institute CERT Cyber Workforce Development (SEI/CERT/CWD) team at Carnegie Mellon University has provided a wide array of cyber ranges spanning various levels of complexity to the Department of Defense (DoD) since 2012. This report draws on tens of thousands of hours of experience and expertise in designing, developing, deploying, troubleshooting, maintaining, and improving cyber ranges. The most frequent use case for a cyber range is team exercise. Team exercises can focus on incident response, malware removal, network takeover, process improvement, and many other specialized use cases. This report summarizes the SEI/CERT/CWD current state of the art when it comes to delivering high-fidelity/realistic cyber ranges to DoD and non-DoD customers that support the complex operating environments required for their training and exercise purposes.