Cybersecurity Lab · Live in production
A production-grade cyber range. Built, secured, operated.
A self-contained cybersecurity lab where learners run real attack-and-defend exercises in the browser — no client software, no exposed infrastructure. Dozens of isolated systems, single sign-on, encrypted access, continuous monitoring, and an automated nightly reset. Designed, deployed and operated end to end by ABOSS.
- Live in production
- Browser-based access
- Single sign-on
- Segmented & monitored
Key capabilities
Everything a class needs. Nothing the campus network doesn't.
Browser-based access
Terminal and remote-desktop sessions to every offensive and defensive system open in a tab. Nothing to install on the learner's device.
Single sign-on
Federated to the institution's existing identity provider. One login opens every permitted application; access is granted or revoked in one place.
Segmented architecture
Vulnerable targets and live attack traffic stay inside the range. A hardened reverse proxy is the single front door.
Encrypted everywhere
Every service is reached over HTTPS/TLS, with certificates that renew automatically.
Blue-team monitoring
Network and host-based detection, intrusion-detection sensors, real-time alerting and automated daily health reporting.
Nightly reset
Training systems return to a known-good baseline every night, so each class starts clean regardless of what happened the day before.
Project overview
Not a website deployment. A platform.
- Secure front door
- 1
- Federated identity
- SSO
- Every service, auto-renewed
- TLS
- Reset to a clean baseline
- Nightly
ABOSS was engaged to build and run a complete cybersecurity training platform for a higher-education institution — an environment where students and staff practise real offensive and defensive techniques safely, from any browser, with nothing to install.
The result is a production cyber range: a fleet of purpose-built virtual machines — attacker workstations, vulnerable web applications, a Windows Active Directory environment, malware-analysis tooling and full blue-team monitoring — consolidated onto controlled, owned infrastructure and presented behind a single secure web address.
It combined application engineering, DevOps, infrastructure design, network security, identity, monitoring and day-to-day operations into one dependable system that is live and in daily use for teaching.
The challenge
Many vulnerable systems. One campus network. Zero leakage.
A hands-on security curriculum needs something ordinary IT can't easily provide: many deliberately vulnerable systems running side by side, safely isolated, and reachable by a whole class at once — without turning the campus network into a target.
Complexity at scale
Dozens of specialised systems — attack tools, vulnerable targets, monitoring stacks — each with different access methods (SSH, RDP, web) had to coexist and stay manageable.
Safe isolation
Intentionally vulnerable machines and live attack traffic must never leak onto the wider network. Segmentation was a hard requirement, not a nice-to-have.
Frictionless, secure access
Students needed everything from any device without installing clients or juggling separate passwords — while keeping strong authentication.
Operational reliability
A lab that breaks mid-class is worthless. Damaged machines had to recover automatically, and staff needed clear visibility into platform health.
Trustworthy exposure
A single, encrypted, professionally branded front door — not a sprawl of raw services on random addresses.
Cost control
Enterprise-grade range capability without an enterprise-grade cloud bill.
Architecture
One secure door in. Strong identity. Isolated services. Eyes on everything.
The platform is built in clean layers, deliberately understandable by business owners, CTOs and engineers alike. Internal addressing, ports and configuration are deliberately omitted.
- 01
01 · Edge
Users
Students & staff
Any device, any browser. Nothing to install.
- 02
02 · Secure web layer
Hardened reverse proxy
The single front door
Terminates HTTPS/TLS, presents one friendly address and routes each request to the right internal service. Nothing internal is exposed directly.
- 03
03 · Identity
Single sign-on broker
One login, short-lived sessions
Federates the institution's existing accounts. Users authenticate once; each connected application receives a short-lived session. No per-app passwords to manage.
- 04
04 · Application services
Containerised apps
Isolated services
The browser-based remote-access gateway, the challenge and scoring platform, and the training web applications — each an isolated container.
- 05
05 · Lab targets
Segmented internal networks
Reachable only through the gateway
Attacker workstations, vulnerable hosts, a Windows Active Directory environment and analysis tooling on segmented internal networks.
Application engineering
Every component maps to a teaching function.
The platform brings together several classes of application, each deployed as an isolated, containerised service, integrated with single sign-on where appropriate and placed behind the secure front door. Nothing was added for effect.
Browser-based remote-access gateway
Full terminal and remote-desktop sessions to lab machines, inside the browser. The single path through which learners reach every operating-system target.
Challenge & scoring platform
Security challenges with flag submission, scoring and a live leaderboard for assessments and competitions.
Vulnerable training web applications
A curated set of deliberately insecure web apps for teaching web exploitation — including a per-learner variant so each student gets an independent instance and a clean scoreboard.
Offensive & defensive systems
Attacker workstations, vulnerable hosts, a Windows Active Directory environment, malware-analysis tooling and full network and host monitoring stacks.
Cybersecurity
Security was designed in, not bolted on.
Infrastructure
- Network segmentation isolates vulnerable systems and attack traffic from the wider environment.
- Least-exposure model — internal systems are never published directly.
- Administrative access is controlled and kept off the public path.
Application
- Every service is reached over HTTPS/TLS with automatically renewing certificates.
- A hardened reverse proxy centralises and standardises secure access.
- The public surface is a single, well-understood entry point.
Access
- Single sign-on federates the existing identity provider — strong authentication enforced centrally.
- Short-lived, session-based access to each application instead of shared standing credentials.
- Time- and class-based controls limit who can use the lab, and when.
Detection & containment
- Network security monitoring and host-based detection observe lab activity for threats.
- Dedicated intrusion-detection sensors support signature-based exercises and real visibility.
- Because the lab deliberately contains vulnerable machines, containment is a first-class control.
DevOps & operations
Repeatable and recoverable — not hand-built and fragile.
The environment runs day after day with minimal babysitting. The emphasis throughout is on outcomes: a lab that is dependable, observable and self-healing.
Version-controlled configuration
Infrastructure and service configuration tracked in Git — a clear history and a path to review every change.
Containerised services
Applications run as containers for consistent, portable, repeatable deployment and clean upgrades.
Automated recovery
Training systems reset to a known-good baseline nightly. Staff can restore an individual system on demand from a snapshot.
Scheduled operational jobs
Routine health reporting and maintenance run on automated schedules without human intervention.
Daily health reporting
An automated summary of system and service state, flagging anything that needs attention.
Real-time alerting
Operators are notified of significant events as they happen, backed by continuous network and host monitoring.
These patterns extend into full CI/CD pipelines — automated build-and-deploy via GitHub Actions — for teams that want every change to ship through an automated, tested workflow.
Security testing & validation
Validated before it was trusted for teaching.
- Assessment
- Findings
- Prioritisation
- Remediation
- Validation
- Improved posture
- End-to-end verification confirmed every service was reachable only through the intended secure path.
- External-exposure checks confirmed internal systems were not publicly reachable.
- Access and authentication flows were validated through the identity provider.
- Issues found during bring-up were remediated and re-verified before go-live.
We do not publish exploit paths, findings evidence or sensitive configuration. Validation is described by outcome, not by method.
Project journey
Discover to operate — the full engineering lifecycle.
Discover
Translated the security curriculum into a concrete set of systems and access needs.
Design
Planned a segmented architecture with one secure front door and centralised identity.
Build
Provisioned the virtual fleet and deployed containerised services.
Secure
TLS everywhere, single sign-on, and network isolation for vulnerable systems.
Automate
Built the nightly reset and scheduled health reporting.
Test
Validated access paths and confirmed nothing internal was publicly exposed.
Optimise
Right-sized infrastructure and consolidated onto owned compute.
Deploy
Cut over to the production domain and professional brand.
Operate
In daily use with monitoring, alerting and self-recovery.
Before vs after
From a risky sprawl to one operated platform.
- A curriculum needing many risky, hard-to-manage systemsOne consolidated, professionally operated platform
- Manual, install-heavy accessBrowser-based access, nothing to install
- Separate logins per systemSingle sign-on through the existing identity provider
- Vulnerable systems near the wider networkSegmented, isolated, contained lab environment
- Services exposed ad hocOne encrypted, hardened front door
- Manual recovery after damageAutomated nightly reset to a clean baseline
- Limited operational visibilityContinuous monitoring, alerting and daily reporting
- Uncontrolled infrastructure costRight-sized, cost-efficient owned infrastructure
Results & impact
What changed.
Stronger security posture
Least-exposure design, encrypted access everywhere, centralised authentication.
Reduced attack surface
A single controlled entry point; internal systems never directly exposed.
Operational reliability
Self-healing training systems and continuous visibility keep classes running.
Frictionless access
Any device, any browser, one login.
Repeatability
Containerised, version-controlled, automated operations.
Cost efficiency
Enterprise-grade capability on right-sized, owned infrastructure — rather than renting equivalent always-on cloud capacity.
Production-ready
Live, validated, branded, and in daily use.
Technology stack
What it runs on.
Only technologies actually used on the project are presented as delivered. Cloud breadth and AI serving are transferable or extension capabilities.
- Infrastructure
- Linux virtualisationNginx reverse proxySegmented internal networking
- Application & services
- Docker containersBrowser-based remote-access gatewayChallenge / scoring platformTraining web applications
- DevOps
- Git-based configurationContainer-based deploymentScheduled automationCI/CD-ready (GitHub Actions)
- Security
- HTTPS/TLS, auto-renewedSingle sign-on / federated identityNetwork segmentationNetwork & host intrusion detectionSIEM / monitoringFirewall controls
- CloudTransferable capability
- AWSGCPDigitalOceanLinode
- AI infrastructureExtension capability
- Self-hosted model servingGPU-based inference
Extend it with self-hosted AI infrastructure.
Environments like this can be extended with AI/LLM models running on the institution's own compute — for cost efficiency, data control and independence from external APIs. Controlled model serving, self-hosted inference and GPU-efficient deployment are offered as a roadmap option, not as work delivered on this project.
Build with us
What we build for institutions and enterprises.
The same architecture — secure front door, federated identity, segmented services, monitoring and automated operations — applies to training platforms and production application environments alike.
“We don't just build applications. We build the infrastructure, security, automation and operational foundation required to run them reliably in production.”
Have a platform that needs to be built, secured, deployed and operated properly?
Let's build the infrastructure behind it.
We build to strong, honest security standards. We don't promise "100% secure" — no one credible does.
FAQ