A Comparative Cost Analysis of Organizational Network Security Test Lab Setup on Cloud Versus Dedicated Virtual Machine

Abstract

The global network infrastructure spectrum is witnessing its fastest growth since the last decade with concurrent rise in cloud computing, Internet of things (IoT), and edge computing. There has been a multitude of heterogeneous networking devices spanning different configurations and using a variety of access methods. A parallel evolution of the network infrastructure security is happening with increasing attempts to exploit the security vulnerabilities in mission critical cyber-assets of organizations. Several organizations invest heavily in security research using lengthy and cryptic mathematical models while ignoring the practical network implementation situation and focus only on the monetary implications of the attack and defense. Attack tree has evolved as a convenient and cost effective way of plotting the network in which an attack may take place and can also help organizations understand the way it can be defended. Attack trees combined with the MITRE ATT&CK framework are widely used for crown jewels risk assessment globally. However, the major challenge for information security experts using the attack tree methodology lies in manually creating the attack tree and plotting all the crown jewels and perimeter network so that it can be defended from attackers. We propose a test lab setup for simulation and attack tree generation, which can be used in conjunction with the MITRE ATT&CK framework and allow us to create and assess various attack scenarios while providing flexibility in subnet configuration and movement, addition or removal of networking devices. The lab can be cloud hosted with a popular cloud hosting on Microsoft Azure or may be created on a VM within a dedicated high-resource machine to be used as a portable testbed. The results indicate that both services have their own pros and cons based on the hours of usage, and the dedicated resource VM testbed may perform better in a low-risk potential small network while the cloud-based approach is useful for the scalable organizations with high-threat potential.