AUTOMATED DEPLOYMENT OF VULNERABLE TRAINING ENVIRONMENTS USING THE LEAST-PRIVILEGE MODEL

Abstract

The growing number and complexity of cyberattacks impose increasingly stringent requirements on the practical training of cybersecurity professionals. At the same time, traditional lecture-based instruction is, unfortunately, often unable to provide a sufficient level of applied skills. Training-oriented cyber ranges address this problem to a certain extent, but existing solutions rarely offer automated deployment of a separate, fully isolated environment for each participant. Moreover, they frequently fail to align training scenarios with formalized descriptions of adversary techniques. The main goal of our study was therefore to substantiate, design, and ultimately implement in software a platform capable of automated deployment of vulnerable testbeds that accurately reproduce documented techniques from the MITRE ATT&CK framework, within a controlled multi-user space, while ensuring complete isolation between users through containerization technologies.

A variety of methods were employed in the course of this work, including a systematic analysis of existing cyber ranges and vulnerable testbeds, as well as a thorough comparative analysis of isolation mechanisms at both the container and virtual machine levels. In addition, object-oriented software architecture design methods were applied, together with a carefully elaborated least-privilege model for container configuration. The platform is built on a multi-tier architecture (Nginx, Django/Daphne, PostgreSQL, Redis) with dynamic orchestration of Docker containers, managed through a dedicated application programming interface.

A platform was designed and implemented that automatically creates and, subsequently, destroys isolated vulnerable testbeds on demand. It is capable of mapping each testbed to specific MITRE ATT&CK techniques and, importantly, supports the addition of entirely new laboratory scenarios without requiring changes to its core. A security configuration for containers was proposed, based on the principle of dropping unnecessary privileges, while preserving the ability to selectively relax these restrictions in order to correctly reproduce certain techniques. A comparison of the chosen container-based approach with traditional virtualization convincingly demonstrated substantially shorter deployment times and significantly lower resource consumption.

Combining containerization, automated orchestration, and scenario integration directly with the MITRE ATT&CK framework enables the creation of a scalable and, most importantly, reproducible environment suitable for practical cybersecurity training. The practical value of the platform lies in the fact that it can be readily integrated both into the educational process of higher education institutions and into professional development systems for information security specialists.