Towards a Cyber-Physical Range

Cyber-physical systems are being increasingly employed in everyday applications, including critical ones. This integration of operational technology systems, originally designed to operate in physical isolation -hence with no or little cyber security defences- with information technology systems, by default meant to be networked, dramatically increases the cyber-attack surface of the resulting composite systems. Thus, the assessment of the security posture of cyber-physical systems, as well as the evaluation of the effectiveness and efficiency of the defensive mechanisms become of paramount importance. Unfortunately, testing cyber security in live real-world cyber-physical systems is not advisable, even when it is possible; hence, the use of testbeds is a necessary alternative. This work surveys cyber-physical testbeds in five major application domains, with an eye towards identifying key features to be subsequently used as input to the process of defining requirements for future cyber-physical testbeds with cyber security posture assessment capability. We then propose a reference architecture for the next generation of cyber ranges, namely the cyber-physical ranges.