Infrastructure of the Lab

The lab consists of two virtual environments that are capable of simulating very detailed network architectures and system configurations, running from the network perimeter to the end-user workstation. We use one virtual environment to test micro-scale scenarios, and another larger-scale platform to simulate the behavior of a “real” network. In other words, the “micro-lab” provides us with a small network of fewer than ten servers, workstations, and users in order to stage our scenario. The “macro-lab” can replicate a network topology of several hundred servers and workstations, and we have actually used this lab environment to simulate the behavior of up to 5,000 users.

The micro-lab consists of a few physical systems running various virtual machines to simulate complete networks. This flexibility provides a quick way to reconstruct insider attacks and respective defense mechanisms. It enables us to determine the effectiveness of various controls and tools against the threat of malicious insiders and to test our proposed new countermeasures in a realistic environment. As a result, we can now provide concrete, technical recommendations for prevention and mitigation of insider threats. We create realistic environments to study insider attacks and to evaluate candidate defense mechanisms. Additionally, the lab allows us to rapidly prototype small to medium-sized networks at minimal cost and allows us to inte....