Poulsbo cyber range is a first for Washington

POULSBO — Think of it as a shooting range for cyber security personnel.

By year’s end, the Western Washington University campus at Poulsbo will be home to the first public cyber range in Washington state. Western Washington University made the announcement at the March 15 meeting of the Poulsbo City Council. According to Poulsbo City Councilman Ed Stern, it will be one of only nine educational ranges in the nation.

The cyber range is being funded by an allocation from the State of Washington and donations from the computer industry, according to Erik Fretheim, Ph.D., WWU’s program director for computer information systems security who is responsible for developing the cyber range.

So what is it and how will it work?

“Cyber ranges function like shooting or kinetic ranges, facilitating training in weapons, operations or tactics. Thus, cyber warriors and IT professionals employed by various agencies train, develop and test cyber range technologies to ensure consistent operations and readiness for real world deployment,” according to Techopedia (www.techopedia.com).

Cyber ranges — (closed clouds” that are cut off from the real web — “allow students to be black hats and do things that, if they did them on the real web, would be illegal and they would wind up in jail,” Fretheim said.

“Which would not be good for either the program or the student,” he added dryly.

By isolating a realistic representation of the Internet, it is possible to test advanced tactics, techniques, and procedures — playing the role of friendly or adversary forces, or neutral networks (e.g. a utility company) — in a variation of highly realistic conditions and situations.

Merit (www.merit.edu/cyberrange/) which operates the University of Michigan cyber range likens it to a “secure sandbox … a flexible, secure environment that can be used for cybersecurity education, training exercises, and software testing. Located in a virtual cloud, the Secure Sandbox simulates a real-world networked environment with virtual machines that act as web servers, mail servers, and other types of machines. Utilizing the virtual town of Alphaville, the Michigan Cyber Range conducts hands-on cybersecutiry exercises to help teams practice and prepare for any type of data breach.”

After reviewing what was available, WWU made the decision to build its own cyber range rather than go with Merit or any of the other commercial programs.

“We looked at a number of commercial ranges,” Fretheim said. “They were not directed at education and did not meet our needs.” Nor were other educational cyber ranges necessarily appropriate. He pointed out that Virginia and Maryland have very good programs, but those east coast programs tend to focus on government programs. “In Washington, we don’t have a huge government presence,” he said. “We need to be more focused on industry and infrastructure. We also tend to be more cooperative and are more advanced than other states.”

Consequently, he envisions a cooperative, working with other cyber security programs in the state. Presently, he is in discussions with the University of Washington and Whatcom College and he expects all of the colleges and universities will eventually join them.

He pointed out that the size of each university or college’s cyber range is limited by the size of their systems and the number of examples their instructors have time to build. By sharing their examples, the Poulsbo range can offer students a richer experience than any single program can.

When the program opens in the Fall of 2017, the cyber range will be able to support one class at a time. Within two years, Fretheim expects the range to handle 40 classes simultaneously — enough to handle every school with a cybersecurity program in the state.

“We will bring in malware from outside (too),” Fretheim said.

So how will they know they are training the good guys — the white hats —and not a future bad guy?

“We’re training the good guys because we work with them everyday as students,” he said. An important art of that student training is on computer ethics. “Black hats aren’t interested in education and they tend to live in their mothers’ basements,” he joked.

When the new program begins in Poulsbo in the fall of 2017 it will lead to a Bachelor of Science degree.