This document describes the design and evaluation of a virtualized Security Operations Centre ([vSoC]). [vSoC] leverages virtualization technology to provide a shared training environment for public sector, academia, and industry. It currently hosts over 2,500 virtual machines across various operating systems and security tools. Modules in the [vSoC] have been used to teach over 500 students across various cybersecurity courses. Current work is focused on integrating additional security tools like F5 Big-IP, RSA Security Analytics, and Splunk, as well developing mobile access and capture the flag exercises.

1. Design and Evaluation of
[vSoC]: Virtualised
Security Operations
Centre
Prof William J Buchanan, Charley Celice, Peter
Aaby, Bruce Ramsay, Richard Macfarlane, Adrian
Smales, Dr Gordon Russell and Bobby Soutar
http://thecyberacademy.org
[vSoC]

2. Sharing of resources
DFET Training Cloud –
Infrastructure for training and
sharing of material
Public Sector
 Evaluation of
systems.
 Training.
Academia
 Training/sharing
materials
 Virtualised environments
Industry
 Training/sharing
materials.
 Professional
certification
Software Vendors:
 Test environments.
 Promoting products.
 Providing floating licences
Government
 Define standards
 Evaluate products
Public clouds
Existing
Academic
Clouds
Law Enforcement
 Triage systems
 Training

3. Building vSoC
Intrusion
Detection
System
Firewall
Internet
Switch
Router (NAT)
Email
server
Web
server
DMZ
FTP
server
Firewall
Eve
Bob
Alice
Data Centre
Load balancer
Syslog
server [vSoC]

4. vSoC/DFET Cloud
The current DFET Cloud contains five main
cluster nodes, where each cluster node runs:
• VMware vSphere 5.5 with VMware vCenter
used to manage the instances.
• 170GHz CPU, 767GB of memory.
• 40TB of disk space.
• 72 Processors.
• Running over 2,500 running VMs.

5. The Move Toward
Security Analytics
Big Data/SIEM
[vSoC]

6. Data Analysis
• Increasing number of
jobs are in Security
Analytics (SOC Analysts).
• Companies require skills
for before, during and
after incidents (mix of
security and forensics).
IncidentsIntroduction
Author: Prof Bill Buchanan
Incidents
During IncidentBefore Incident After Incident
Timeline
Data At Rest
Data In-Motion
Data In-Process
Files, Directories, File Rights,
Domain Rights, etc.
File changes, File CRUD
(Create, Delete, Update,
Delete), Thumbprints
Network packet logs, Web
logs, Security logs
Network scanners, Intrusion
Detection Systems, Firewall
logs, etc
Processes, Threads, Memory,
etc.
Security Log, Application Log,
Registry, Domain Rights.
Intruder

7. Increasing Complexity of Knowledge
• Increasing
requirement for a
wide range of skills
for security
professionals.
IntroductionIncResponse
Data Capture
Web
server
IT Ops
Nagios.
NetApp.
Cisco UCS.
Apache.
IIS.
Web Services
Firewall
Router
Proxy
server
Email
server
FTP
server
Switch
Eve
Bob
Microsoft
Infrastructure
Active Directory.
Exchange.
SharePoint.
Structured Data
CSV.
JSON.
XML.
Database Sys
Oracle.
My SQL.
Microsoft SQL.
Network/Security
Syslog/SNMP.
Cisco NetFlow.
Snort.
Intrusion
Detection
System
Alice
Cloud
AWS Cloudtrail.
Amazon S3.
Azure.
Application Serv
Weblogic.
WebSphere.
Tomcat

8. Data Integration
• Increasing move
toward the
integration of data
for security analysis
eg with SIEM tools.
IntroductionIncResponse
Security Operations Centre
Eve
Eve
Logs/alerts
Bob
SIEM Package (Splunk)
News feeds
Security alerts

9. Design and Evaluation of
[vSoC]: Virtualised
Security Operations
Centre
Splunk Lab Integration
[vSoC]

10. vSoC SIEM Architecture
U001 - Ubuntu
Server
192.168.x.7/24)
Main gateway/
fireweall Firewall
(pfSense)
W001 - Windows 2003
Server
(192.168.y.7/24)
K001 - Kali
(DHCP)
K002 - Kali
(192.168.y.9/24)
em0
(DHCP)
em1
em2
10.200.0.1/24
W003 – Windows 2008
with Splunk Enterprise
(192.168.y.8/24)
_Public _Private
_DMZ Splunk
forwarder
192.168.y.254/24
192.168.x.254/24

11. Splunk Lab Integration

12. Design and Evaluation of
[vSoC]: Virtualised
Security Operations
Centre
Splunk Testing Environment –
Buttercupgames
[vSoC]

13. http://asecuritysite.com/tests/tests?sortBy=siem
http://asecuritysite.com:8000

14. Capture The Flag
British Broadband, and RSA SA
[vSoC]

15. British Broadband
• Video: https://www.youtube.com/watch?v=V7o03eLolqA

16. British Broadband

17. Cyber Security Insight Camp

20. Big Data in Cyber Security

21. RSA SA

22. CTF – Big Data in Cyber Security

25. Design and Evaluation of
[vSoC]: Virtualised
Security Operations
Centre
Results
[vSoC]

26. Current Range of VMs
• Specialised: EnCase, Windows XP (with Malware), GNS3.
• Linux Kali.
• Ubuntu.
• Windows 2003, Windows 2008, Windows 7 and Windows 8.
• Firewalls: pfSense, vyatta, F5 Big-IP (in development).
• Caine.
• Metasploitable.

27. Example $tubuntu = "t_ubuntu_205"
if ($args[1].contains("u"))
{
$ins = $prefix+$iubuntu +$i.ToString("000")+"_private";
...
Write-Output "Creating: $($ins) from $($temp) in $($folder) for $($folder) disk:
$($disk) "
new-vm -name $ins -template $temp -datastore $disk -resourcepool DFETLab -
DiskStorageFormat thin -location $folder
$apt = Get-NetworkAdapter -VM $ins
Set-NetworkAdapter -NetworkAdapter $apt -NetworkName $private -
confirm:$false
Write-Output "Creating: $($ins) from $($temp) in $($folder) for $($folder) disk:
$($disk) "
new-snapshot -VM $ins -Name snapshot
}
Setup network
Create VM
Create known
snapshot

28. Results
Modules used on:
Semester 1: Cryptography and Network Forensics (80 students); Network
Security (60 students – GNS3); Host-based Forensics (60 students - EnCase).
Semester 2: Security Testing (70 students); e-Security (100 students); Incident
Response and Malware Analysis (100 students).
Cloud upgrade

29. Current Work
• Integrating F5 Big-IP (30 licences).
• Integration of SDN within Cloud (with Hutchinson
Networks).
• Integration of RSA SA and Splunk for teaching in
2016/2017.
• Integration of HPE Arcsight.
• Roll-out of two CTF: British Broadband and RSA SA
(Network Forensics.
• Development of a mobile Cloud environment, for
onsite training/CTF.

30. Design and Evaluation of
[vSoC]: Virtualised
Security Operations
Centre
Prof William J Buchanan, Charley Celice, Peter
Aaby, Bruce Ramsay, Richard Macfarlane, Adrian
Smales, Dr Gordon Russell and Bobby Soutar
http://thecyberacademy.org
[vSoC]