Design and Implementation of a Critical Infrastructure Security and Assessment Laboratory

The globally-connected information superhighway, known as cyberspace, ushered our dependence on information technology to support our critical infrastructure. In a recent study [1] conducted by the United States Government Accountability Office (GAO) on critical infrastructure protection, the lessons learned from the first Cyber Storm exercise have yet to be fully addressed. In October, 1997, the report of the President’s Commission on Critical Infrastructure Protection acknowledged that there is a widespread capability to exploit critical infrastructure vulnerabilities [2]. In October 2001, the Bush administration created the President’s Critical Infrastructure Protection Board through Executive Order 13231. The Board and the Department of Energy have developed the nonprescriptive twenty-one (21) steps to improve cybersecurity of SCADA networks [3]. The research associated with this paper will serve as an instrument to facilitate the realization of each of those recommended 21 steps. And more specifically, this paper presents the design and implementation of an experimental Critical Infrastructure Security and Assessment Laboratory (CISAL) and activities associated with it. The laboratory is envisioned to be a training facility for future computer security professionals.