uOttawa Professor Guy-Vincent Jourdan says he initially never would have guessed a year ago he’d be concocting simulated social media feeds and made-up news broadcasts. But that was before becoming co-director of the uOttawa-IBM Cyber Range.
“I came to the job with an expectation that I would use my research and knowledge in computer science almost exclusively,” he explains from his office at uOttawa’s STEM Complex. “But it’s so much more than that. The computer science side is important, of course. But it’s almost in the shadow of everything else.”
What he means by “everything else” includes lifelike, simulated cyberattacks on mock networks coupled with feels-like-the-real-world pressure from equally simulated social media commentary, media coverage, and other stress-inducing hazards.
It’s enough to get the pulse racing of even the most hardened chief security officer. And thanks to a new strategic partnership with the Ontario Centre of Innovation (OCI), uOttawa and IBM, such simulations will now be available to select small and medium-sized enterprises (SMEs) free of charge at uOttawa’s Cyber Range.
An ‘immersive’ cybersecurity experience, open to anyone
The year-old uOttawa-IBM Cyber Range is open to anyone looking for expert professional development: It hosts both private and public organizations looking to sharpen their IT teams’ security skills or beef up their staff’s security awareness.
One constant is the immersiveness of every Cyber Range simulation. Most are planned weeks in advance and, along with the actual cyberattack simulation, include:
- A simulated social media feed, scrolling on a monitor, discussing (and often criticizing) the subject organization’s response to the cyberattack.
- Actors placed in the actual Cyber Range itself, unknown to the participants, solely to cause unexpected mayhem.
- Other unexpected events, such as purposefully encrypting the computer of participants during a critical moment.
- Recorded TV broadcasts and news coverage that appear on a TV in the facility.
Sometimes these broadcasts purposely get facts wrong—and to correct the record, some participants are asked hard questions on (simulated) live TV in a fully equipped broadcast studio down the hall.
“We control everything,” Jourdan says. “And we do everything we can do to make you as uncomfortable as we can, so you can learn from that.
“The goal is to put teams on the spot to ask: What do you do if and when this happens? Do you know what to do? Do you know when to call the police? Do you know when to talk to the media, or when to say nothing? Do you have a plan in place?”
“At the end of the day, something or someone is being hacked—but that’s sort of in the background of the entire story. The focus is on crisis management including the legal, ethical, and social elements.”
Strategic partnership opens doors for SMEs
The OCI-uOttawa-IBM partnership was struck under Ontario’s Critical Industrial Technologies Program, which established the uOttawa-IBM Cyber Range as a Technology Development Site (TDS).
That means the facility will support Ontario-based SMEs to test, adopt, integrate, and demonstrate cybersecurity capabilities free of charge, provided the companies are one of the first 30 accepted by OCI.
Many organizations, after all, aren’t technology companies but still own proprietary software, technology systems, or possess sensitive data they must protect. But growing companies have a lot on their plate—which sometimes means there just isn’t enough time or resources to implement a robust cybersecurity posture.
The uOttawa-IBM Cyber Range can help with that.
“We work with SMEs to prepare them and select the service that makes sense, to get their systems tested, to make sense of the result, to implement the recommendations, and to get some training at the same time,” Jourdan explains, adding that the partnership helps further the uOttawa-IBM Cyber Range’s overall goal of preparing Canadian governments, organizations, and individuals to stay ahead of cyberattacks.
What SMEs can expect at the uOttawa-IBM Cyber Range
So, what happens if an organization is accepted by OCI to access cybersecurity training at uOttawa’s Cyber Range?
Organizations first participate in an onboarding discussion to define parameters: Which application(s) will be involved, will it be on-prem or in the cloud, what takes place on a development site vs. production, and other questions.
They will then have access to a catalog of more than 10 cybersecurity services grouped under three themes:
- What information security exposure do I have?
- Am I safe?
- How do I respond?
The service is then conducted based on these parameters, producing actionable intelligence about the organization’s security posture. A simulation is also performed providing the organization’s team with valuable additional training. A full report is then disseminated, including all findings and implementation suggestions.
Empowering secure, yet productive, business practices for Canadians
Jourdan says much of what the uOttawa-IBM Cyber Range does boils down to that age-old security quandary: How to secure companies without preventing employees from doing their work.
He says that’s the balance the Cyber Range tries to strike in its training programs. “As security people, we tend to say that more security is always better. But at some point it becomes counterproductive” if security measures force employees into insecure workarounds or shadow IT applications.
It’s all about providing the most robust security possible while removing as many friction points for employees, he says—which is why the Cyber Range provides the ideal venue for company-wide security awareness training, often a compliance requirement.
“Most of the time that means, once a year, people are dragged into a room and they cannot wait for it to finish,” he says. “We’re trying not to do that. We’re trying to make it a memorable day, something that was actually fun and useful, and that you are going to remember.”
Get in touch
To learn more and participate in this program, SMEs can contact the uOttawa-IBM Cyber Range at TDS-CyberSecurity@uOttawa.ca
