The European Cybersecurity Skills Framework (ECSF) was introduced by the European Union Agency for Cybersecurity (ENISA) to identify the necessary competencies, knowledge, and skills required for European cybersecurity professionals. The ECSF condenses all cybersecurity-related positions into 12 role profiles, aiming to establish a mutual understanding of essential roles and support the creation of cybersecurity training programs. In order to address the shortage of cybersecurity experts, a multi-criteria selection method is developed to increase the availability, accessibility, and quality of cybersecurity courses and certifications. This Course Selection methodology ensures high-quality training materials that meet the current and future needs of the cybersecurity industry and benefit a wide range of participants. The methodology considers six criteria and provides a scoring system to rank the occupational profiles and select the most relevant profiles for the course design. Our final score formula identifies Chief Information Security Officer (CISO), Cyber Incident Responder, Cyber Threat Intelligence Specialist, and Penetration Tester for the Course creation.

Hands-on training is an effective way to practice theoretical cybersecurity concepts and increase participants' skills. In this article, we discuss the application of visual analytics principles to the design, execution, and evaluation of training sessions. We propose a conceptual model employing visual analytics that supports the sensemaking activities of users involved in various phases of the training life cycle. The model emerged from our long-term experience in designing and organizing diverse hands-on cybersecurity training sessions. It provides a classification of visualizations and can be used as a framework for developing novel visualization tools supporting phases of the training life-cycle. We demonstrate the model application on examples covering two types of cybersecurity training programs.

Cyber defence exercises (CDX) represent a popular form of hands-on security training. Learners are usually divided into several teams that have to defend or attack virtual IT infrastructure (red vs. blue teams). CDXs are prepared for learners whose level of skills, knowledge, and background may be unknown or very diverse. This is evident in the case of high-profile international CDXs with hundreds of participants coming from government agencies, military, academia, and the private sector. In this poster, we present techniques for distributing learners into teams with respect to their level of proficiency and the prerequisite skills required by the exercise. Our aim is to reach a balance between proficiency and the exercise to make the exercise beneficial for the learners and an effective investment for sponsors. The poster describes three methods and compares their advantages and disadvantages. First, we present self-assessment questionnaires, which we have already used in four runs of a national CDX for 80 participants. We outline our findings from an analysis of the learners' self-assessment before and after the exercise, and the score they achieved during the exercise. Second, we introduce a promising method for testing the prerequisites of the exercise. This is still a work in progress but we believe that this method enables the better assessment of learners' skills with respect to the exercise content, and supports the game balance better. Finally, we compare both methods to a naïve one that shuffles participants into teams randomly.

We present a comprehensive framework for automatic phishing incident processing and work in progress concerning automatic phishing detection and reporting. Our work is based upon the automatic phishing incident processing tool PhiGARo which locates users responding to phishing attack attempts and prevents access to phishing sites from the protected network. Although PhiGARo processes the phishing incidents automatically, it depends on reports of phishing incidents from users. We propose a framework which introduces honey pots into the process in order to eliminate the reliance on user input. The honey pots are used to capture e-mails, automatically detect messages containing phishing and immediately transfer them to PhiGARo. There is a need to propagate e-mail addresses of a honey pot to attract phishers. We discuss approaches to the honey pot e-mail propagation and propose a further enhancement to using honey pots in response to phishing incidents. We propose providing phishers with false credentials, accounts and documents that will grant them access to other honey pot services. Tracing these honey tokens may lead us to the originators of the phishing attacks and help investigations into phishing incidents.

Cyber attacks have become ubiquitous and in order to face current threats it is important to understand them. Studying attacks in a real environment however, is not viable and therefore it is necessary to find other methods how to examine the nature of attacks. Gaining detailed knowledge about them facilitates designing of new detection methods as well as understanding their impact. In this paper we present a testbed framework to simulate attacks that enables to study a wide range of security scenarios. The framework provides a notion of real-world arrangements, yet it retains full control over all the activities performed within the simulated infrastructures. Utilizing the sandbox environment, it is possible to simulate various security attacks and evaluate their impacts on real infrastructures. The design of the framework benefits from IaaS clouds. Therefore its deployment does not require dedicated facilities and the testbed can be deployed over miscellaneous contemporary clouds. The viability of the testbed has been verified by a simulation of particular DDoS attack.