Leidos' CastleClone - Digital Twin Environment

CastleClone is an on-demand, secure software-as-a-service cyber platform that enables cyber security missions with capabilities for creating “digital twins”, performing adversary emulation, forensics, penetration tests, skill-based assessments, and testing AI agents. Leidos collaborated with AWS to ensure that CastleClone was risk-free for our customers. Each environment is sandboxed from the internet, with no way to communicate out. Additionally, with a focus on ease of use, we made CastleClone completely interactive from the browser. Customers can deploy and interact with entire networks all from their browser and don’t need a powerful computer. Inside of these environments a variety of cybersecurity roles can be performed. Some examples include:

• Security operations center analysts can deploy a detection lab to see how well their latest defensive signatures do against specific MITRE ATT&CK technique IDs.
• Malware analysts can perform static and dynamic malware analysis in a risk-free environment. Red and blue teams can do team exercises.
• Penetration testers can practice against target virtual machines. Exploit developers can create new exploits and test them.
• Machine learning engineers and data scientists can create custom cyber datasets to train new models on by collecting all the network traffic and host data from attack simulations.

CastleClone helps provide organizations with cyber confidence.

CastleClone's capabilities include:

• Creation of “Digital Twins” - Import your workstations, servers, network configurations and deploy your organizations digital twin. This enables threat emulation, threat analysis and helps to ensure an organization is cyber ready.
• Emulation of Adversary threats - Simulate cyber-attacks mapped to the MITRE ATT&CK Framework. DNC hack to see how well your security posture holds up.
• Analyze Threats - Using the threat emulation capabilities of CastleClone, analysts can use the data captured from the simulation that they uploaded to their bucket to create custom detections, signatures, queries, YARA rules, and additional analytics that are then passed to incident responders.
• Evaluate Products - Evaluate new products, infrastructure, and applications in a risk-free environment to ensure risk compliance. secure vulnerability analysis.
• Build Cyber Datasets - Export captured network or host-based data to form your own custom datasets so that your organizations data scientists and machine learning engineers can create tailored analytics and detections.
• Perform Team Assessments - Train your analysts, operators, and engineers in your organizations digital twin in a risk-free environment, where they are free to make mistakes and learn.