Article content
The Estonian Ministry of Defense and several partners are developing a new resource called OCR to troubleshoot new cyber security products before they are deployed for use by the wider public. Companies and educators everywhere will eventually be able to access this resource and pilot their tools against known cyber threats and vulnerabilities in a virtual environment unavailable anywhere else today.
The Open Cyber Range project commenced last year and will run through February 2024. With the Estonian MoD as the Project Promotor, it also involves the CR14 Foundation. This Tallinn-based organization supports cyber security R&D, as well as academic partners at the Tallinn University of Technology and Norwegian University of Science and Technology.
This Tallinn-based organization supports cyber security R&D, as well as academic partners at the Tallinn University of Technology and Norwegian University of Science and Technology.
Open Cyber Range (OCR) is funded through the Norway Grants Green ICT program with a budget of €3.3 million. The program supports cooperation between Estonia and Norway in green industry innovation, IT, and welfare technology.
A need for something new
A cyber range is a virtual environment where cyber security platforms developers can pilot new tools and features against a range of threats. Though commercial cyber range offerings exist on the market, the Estonian Ministry of Defense and its partners wanted to create a new environment that could be used to trial tools developed by small- and medium-sized enterprises, industry, and educators.
“There are many cyber ranges available commercially,” said Tiia Sõmer, the Open Cyber Range project manager within the Estonian Ministry of Defense. “What’s different in OCR is that it will include tools and products that are not part of standard cloud service, such as Amazon Cloud,” she said. Additionally, specific threats, such as live viruses, cannot be deployed in commercial cyber ranges. With OCR, they can. “That’s where we see added value for SMEs that wish to develop and test new products or services in cyber security,” she said.
The OCR will have a faster setup for its testing and validation environment, plus a reduced initial cost for users, she said. Ideally, it will be used to support SMEs and startups looking to bring new products to market and education and training exercises. In terms of the latter, academic organizations and industry will be able to introduce ready-to-deploy tools to the OCR library that will allow them to create environments to trial the capabilities of their products.
Current status
The OCR is currently developing, with initial capabilities set to become functional by 2022. That being said, Sõmer said that the team involved with the OCR is already welcoming participation from interested parties.
“If anyone wants to come and work with us, we are ready to take them onboard even today to learn the requirements and see where to put the most effort,” she said.
The OCR is intended to become fully operational by 29 February 2024, and ideally, the platform developers would like to pilot maybe ten companies and 15 products or services before it goes live. “Initially, we plan to involve a moderate number of SMEs and training events, as before we achieve full operational capability, only a subset of planned services can be used,” Sõmer noted.
She added that the project would like to train 100 people on the platform before fully operational. “Any such initiatives are welcome to be tested on the OCR,” said Sõmer. “Anyone who wants to work with us before being fully operational can do so free of charge.”
That includes companies and organizations outside of Estonia. Sõmer noted that the project has had discussions already with Norwegian partners and prospective users in other like-minded countries, but stressed that the OCR is in its early phase.
Cautiously positive
More small and medium-sized enterprises can be engaged as more capabilities come online, regardless of where they are located, Sõmer noted. By 2024, when the Open Cyber Range achieves its full capabilities, as many as ten companies could use the resource simultaneously.
So far, feedback from early users has been “cautiously positive,” Sõmer added, underscoring that the cyber security field is cautious and conservative. “No one wants to jump into unknown waters and start using some service without giving it some serious thoughts and knowing, and trusting, what the services entail,” she said.
She noted that the Open Cyber Range’s potential users, such as companies and academic researchers, create many tools and applications that will require vetting throughout their development cycle. Ideally, these varied users will be able to introduce ready-to-deploy software and technologies into the Open Cyber Range and test their products.
For educators that teach cyber security, Sõmer said that there is a lack of interactive exercises and courses, meaning the Open Cyber Range would be an excellent resource to tap into for education purposes. “There is no single beneficiary or target group, but the OCR will be built and developed to provide value to a vast group of people and organisation types,” noted Sõmer.
Academic contribution
Academic groups from Estonia and Norway also play an important role in the Open Cyber Range project. These include participants from TalTech and the Norwegian University of Science and Technology. Both are pitching in to help develop the range, according to Sõmer.
For example, the academic partners are working to develop a Scenario Development Language, which will form the Open Cyber Range’s core. The project’s academic partners are also developing a digital library, including learning materials, pre-built environments, and ethical hacking tools for defensive and offensive activities to simulate real-life situations.
Academic partners also contribute to developing and running competitions, Sõmer added, including education and training in creating content and organizing and hosting the events.
✈️ Can’t travel but want to hear the e-Estonia story or implement e-services in your country or company? Take a look at our services and get in touch – we’ve got you covered!
freelance journalist and writer
