Perspective Monitoring: Ampire Cyberpolygon

The main articles are:

• HRM Classification
• Functionality of HRM systems
• DLP - Data Loss/Leak Prevention
• Security Information and Event Management (SIEM)

2024

Ampire 1.5 with additional vulnerable nodes

On October 28, 2024, Perspective Monitoring announced the release of an updated version of the Ampire 1.5 cyber polygone, in which the developers updated attack scenarios, added vulnerable nodes, finalized a template that simulates the operation of the 110/10 kV substation, and updated the Ampire Junior cyber polygone and increased the stability of its operation.

Ampire Cyber ​ ​ Police is a training platform for practicing defense skills and countering computer attacks. Over its five-year history, Ampire has become the basic cyber police for many organizations in the public and commercial sectors, as well as for specialized training of young information security specialists in technical universities.

Developers continue to update vulnerable nodes and attack scenarios in the platform. For example, in version 1.5, vulnerable nodes appeared associated with the popular knowledge base management system, status monitoring system, file manager for the site and other systems.

In collaboration with the Mpire Cyber ​ ​ Poligon NTI Competence Center, a template was developed that simulates the operation of the 110/10 kV substation. This is a digital twin of the power system, which will allow employees of the security services of energy companies, substation operators and students of specialized universities, including energy, to undergo training in a virtual environment. This template has virtualized PLC, corresponding SCADA system and RPA, it almost completely repeats the operating conditions of the operating substation. The attacks used in the template are aimed at replacing the control signals to the RPA, which simulates the situation when the operator of the SCADA system does not see changes in the operation of the substation until a short circuit occurs.

Several important changes took place at once on the Ampire Junior cyberpoligon for schoolchildren. The developers paid special attention to the creation of mass training and reduced the time spent on their preparation. In addition, now the teacher in a single window displays a list of all participants in the training with details for each student. Ampire Junior has added a new lab work, Secure Passwords. She explains the principles of creating a secure password, clearly demonstrates the consequences of using a weak password and gives useful practical tasks to consolidate knowledge.

We traditionally pay a lot of attention to cyber policing for Ampire Junior schoolchildren. Every year children spend more and more time on the Internet, this is primarily due to the modern educational process. But on the network, schoolchildren face many threats, so it is very important to develop their information security skills. In the latest update, we took care not only of expanding the range of possible trainings, but also of the convenience of the teacher who conducts them, "said Georgy Melikhov, Ampire product manager for Promising Monitoring.

Ampire 1.4 with optional training formats

On July 4, 2024, Perspective Monitoring announced the release of an updated version of the Ampire 1.4 cyber police, in which the developers rethought the user experience and radically redesigned the functionality and interface of the system. Key platform updates include additional training formats, additional industry-specific infrastructure templates, and vulnerable nodes.

Ampire Cyber ​ ​ Police is a training platform for practicing defense and countermeasure skills. computer to the attacks Over its five-year history, Ampire has become a basic cyber police for many organizations state and commercial sectors, as well as for specialized training of young INFORMATION SECURITY specialists in technical universities.

In this version of the platform, the classic Blue Team defense skills training format is supplemented by the Red Team format, where the task of the participants is to use the pentest skills to penetrate the virtual infrastructure and search for a flag located on one of the nodes, and the second CSIRT format, in which the student combines monitoring and response roles, independently detects the vulnerability and eliminates the consequences of its exploitation.

Release 1.4 includes two additional templates of a typical infrastructure for training in Blue Team and CSIRT formats - Telecom OKS-7 and Import Substitution. The telecom template simulates the infrastructure elements of the mobile carrier, and the attack vectors in the template are built around the vulnerabilities of the SS7 protocols. The Import Substitution template simulates a typical enterprise infrastructure with domestic software and domestic operating systems.

Ampire over several years has acquired its adherents in the person of teachers and specialists due to the platform's functionality. More than 20 cyber polygons have been installed, mainly in universities. We also conduct regular cyber training courses for information security specialists. Ampire is already a whole ecosystem that brings together users, technology partners, developers. So, for example, we launched a community of developers of vulnerable nodes, where anyone can directly affect the development of the product, pump their technical and information security skills. And we already have one successful example of developing a vulnerable node, which we will add to one of the next releases, "said Sergey Neiger, director of business development at Perspective Monitoring.

The design of the Ampire platform has also undergone a complete revision. The developers set themselves the goal of helping users find the necessary tools faster without being distracted by secondary functions, and thereby simplify work with the software complex.

It is very important for us that users are not only useful, but also convenient to train on Ampire. We are so used to various services, platforms and programs that at the subconscious level we strive to use only intuitive solutions that are pleasant to use. It is important to note that this is the first release in a long time in which updates relate to all elements of the product - infrastructure templates, vulnerable nodes, design, interaction with the portal part of the complex, training formats, scripts - and, of course, updates to the younger version of the Ampire Junior platform. " noted Georgy Melikhov, Ampire Product Manager "Perspective Monitoring."

An updated version of the Ampire 1.4 platform is already available, and the update will be delivered to current cyberpoligon users during July.

2023: Integration with the Echelon line of information protection tools

Promising Monitoring (InfoTeCS Group of Companies) and Echelon Group of Companies have reached an agreement on a technological partnership, under which the Echelon line of information protection tools can now be delivered to customers as part of the Ampire platform. InfoTeCS Group of Companies announced this on July 13, 2023.

The Ampire cyber police is developed by Perspective Monitoring and is a training platform where information security specialists are trained and hone the skills and methods of detecting, analyzing and eliminating the consequences of computer attacks. Ampire is a basic cyberpolygon for teaching students at the country's leading universities.

Experts from both companies have carried out a full range of work on integration to testing and compatibility of software solutions. As of July 2023, three Echelon development products are built into the Ampire platform: a centralized information security event management system, KOMRAD Enterprise SIEM a comprehensive security analysis system, and an Scanner-VS firewall intrusion detection system.Rubicon

Technological cooperation with the Russian developer of information protection tools Echelon was a continuation of our strategy to provide the widest possible range of information security tools as part of Ampire. Both students and existing information security specialists are trained on our platform, and it is important for us to provide them with a training ground for practicing practical protection skills using various domestic IPS, commented "'Alexander Pushkin, Technical Director of Perspective Monitoring.

Cooperation of technology companies is an established trend in the Russian information security market. Such cooperation strengthens not only the capabilities of individual development companies, but also the market as a whole. Now organizations that already operate or plan to switch to Echelon Group solutions can conduct cyber training on Ampire using our IPS and further bring training sessions closer to the real working conditions of information security specialists, noted Alexander Dorofeev, General Director, Echelon Technologies JSC.