![](bg9.png)
type, flag type and king-of-the-hill type of CTF train-
ing (Facebook, Inc., 2016). However, the Facebook
CTF platform is mainly a cool UI for the training,
and it does not provide assistance with a full environ-
ment setup as CyTrONE does. Moreover, there is no
support for generating security content either. These
tasks remain the organizer responsibility, and conse-
quently are still tedious.
In (Raj et al., 2016), the use of application
containers is proposed as a solution for improving
the scalability of CTF contests. The approach fo-
cuses only on deployment though, as content creation
and management still have to be handled manually.
CyTrONE has a much more thorough and general ap-
proach, and we are planning to investigate in the fu-
ture the possibility of using container technology in-
stead of virtual machines to improve the scalability of
our framework.
Closed, proprietary systems, such as the Boe-
ing Cyber-Range-in-a-Box (CRIAB) create a vendor
lock-in, both in terms of software and hardware. On
the other hand, our open-source framework makes it
possible to decouple the training content from the exe-
cution infrastructure, making it possible to update the
content and also to expand the infrastructure depend-
ing on actual needs. The open-source approach also
brings about perspectives for standardization of the
training content format; this would create opportuni-
ties for training companies to easily produce content
adapted to various levels of trainee skills, age, back-
ground, and so on, and license it without having to
worry about the details of the platform on which the
content is actually used.
By using CyTrONE, with automatic environment
setup and content generation based on YAML de-
scriptions, it becomes possible for practically anyone
to conduct security training anytime and anywhere
(given that host servers are available for the cyber
range creation), thus leading to the democratization
of cybersecurity training. The flexibility of the frame-
work, in association with the use of a Learning Man-
agement System, means that not only classical CTFs,
but any other kind of training can be conducted, for
instance by leveraging the advances of modern edu-
cation methodologies, such as adaptive learning, etc.
We have currently reached the first concrete goal
of our project: develop the fully-configurable cyber-
security training framework that based on organizer
input and a training database will automatically pro-
duce the training content and training environment
necessary for that training. Once its testing is final-
ized, we shall publicly release CyTrONE as an open-
source project, so that it can be used by other organi-
zations; the release is planned for the end of the cur-
rent Japanese fiscal year (March 2017).
5.2 Training Database
Our framework currently uses a classical training
paradigm of scenario-based and topic-based questions
that are prepared in advance. At release we shall in-
clude samples of such training content targeting var-
ious audiences, such as technical college students,
company employees, etc. However, while this ap-
proach undoubtedly serves many training purposes,
especially for beginners, we are planning to also de-
velop a new training paradigm, by which actual inci-
dent information is used to automatically recreate the
corresponding training environment.
In this context, the framework of the ITU-T
X.1500 recommendation for structured cybersecurity
information exchange techniques (CYBEX) (ITU-T,
2016) is extremely relevant, and detailed informa-
tion about the incidents can be obtained in stan-
dard machine-readable formats, such as Structured
Threat Information eXpression (STIX) (OASIS CTI
Technical Committee, 2016) or Incident Object De-
scription Exchange Format (IODEF) (Danyliw et al.,
2007). This information is the basis for reproduc-
ing the incident; furthermore, vulnerability databases
such as CVE (Common Vulnerabilities and Expo-
sures) (MITRE Corporation, 2016) will be used to
recreate the target (victim) environment, and public
websites such as the Exploit Database (EDB) (Of-
fensive Security, 2016) will be used to obtain exploit
code for recreating the attack in the cyber range.
The novelty of this approach is that, through the
use of de-facto standards as the source of the database
content included in our framework, it becomes possi-
ble to conduct training in similar conditions to a cer-
tain incident and/or vulnerability as soon as the cor-
responding information is made public. This would
make it possible for IT professionals to immediately
gain first-hand knowledge and develop response tac-
tics, so that the said incident is avoided elsewhere.
5.3 User Trials and Integration
Once the development of the framework is finalized,
we shall proceed with several usability tasks. First
of all, we’ll do a series of user trials to validate the
system in various training scenarios, from the point
of view of: (i) content and training environment, and
(ii) user interfaces both for organizers and trainees.
Secondly, we’ll proceed with the integration of the
framework into the workflow of existing training pro-
grams, such as CYDER and Hardening Project that
were mentioned in beginning of the paper, through
CyTrONE: An Integrated Cybersecurity Training Framework
165