Designing a Controlled Environment for the Simulation of an Enterprise Security Infrastructure

摘要

Despite a growing emphasis upon computer and network security, little attention has been paid to how business enterprises or universities should approach the design of security laboratories. Such laboratories allow business professionals or students to test the effectiveness of different configurations in warding off attacks, as well as to experiment with and learn about various security devices, tools, and attack methods in a controlled manner that insures benign consequences. This paper pinpoints the critical issues that make design and implementation of a simulation environment difficult, and recommends ways of addressing these concerns through a three-step design process. Design and development principles and technical and engineering requirements proposed here can be of use to businesses or universities seeking to build a computer and network security laboratory. They can also provide a useful checklist for managers or administrators charged with the IT function to use when discussing their security laboratory with their lab's technical designers and support staff.