Otnetic: A Cyber Range Training Platform Developed for the Norwegian Energy Sector

Abstract

As cyber attacks have become increasingly frequent and complex, the need for effective cyber security training has become essential. This master thesis was developed in collaboration with the client organization NC-Spectrum, with the objective of developing an alternative training program utilizing cyber ranges and gamified training for OT-personnel in the Nor-wegian energy sector. The need additional training was identified by the client organization initially, and reinforced through the findings from the literature review and interviews conducted as part of this thesis. Current training methods commonly use one-way communication, which has been shown to be inefficient for facilitating motivation and knowledge retention. As the thesis has employed the design science research method (DSR), an arti-fact called OTnetic was produced as a result of this thesis. The artifact was created using multiple open source technologies and tools. The requirements for OTnetic, were elicited by analyzing the interviews and creating user stories. OTnetic allows trainees to acquire knowledge and practical skills by completing tasks in a cyber range environment. The cyber range is supplemented with a quiz and information about a given cyber security related question. As the target audience for training in this thesis have been found to have limited cyber security knowledge, a module on password security was developed in the first DSR cycle. Keywords: Cyber Security Training Gamification Critical Infrastructure Cyber Ranges Energy Sector Design Science Research