The CMC Faculty at Moscow State University launched a cloud security course and a CTF platform with Yandex Cloud

What this is about

The CMC Faculty at Moscow State University has built an educational training ground for cybersecurity practice using Yandex Cloud services. The cloud infrastructure enabled deploying isolated environments for students, streamlining the scaling of hands-on exercises, and supporting CTF competitions modeled on real-world attack scenarios.

Building an educational training ground for a cloud security course

The Department of Information Security at the MSU Faculty of Computational Mathematics and Cybernetics (CMC) developed the Cloud Technology Security course as part of its Artificial Intelligence in Cybersecurity master’s program. In this course, master’s students study containerization, including Docker^® and Kubernetes^®, virtualization, and infrastructure protection methods. The curriculum is designed so that students cover theory during lectures and complete hands-on exercises on a dedicated educational training ground featuring lab exercises and competitive challenges in a capture-the-flag (CTF) format, where they must identify and exploit vulnerabilities in educational services.

To implement the practice component of the course, the team needed an infrastructure that could quickly spin up isolated environments for each student. Personal laptops and the department’s existing infrastructure were not an option, since the team needed to provision lab environments centrally, isolate students from one another, utilize infrastructure without unnecessary downtime, and avoid purchasing and maintaining proprietary hardware. Cloud infrastructure turned out to be the ideal solution to address these requirements.

The team sought a cloud platform capable of quickly deploying 25 to 50 virtual machines, isolating lab environments at the network level, and rapidly saving and restoring training image snapshots.

Ultimately, they selected Yandex Cloud, driven by its robust cloud infrastructure, an intuitive platform architecture, and a computing resource grant.

Educational training ground for attack simulations and infrastructure protection within Yandex Cloud

The practical part of the course is structured around two categories of exercises. The first one consists of lab sessions: following step-by-step guides, students deploy their own environments, study Docker, process and network isolation in Linux, Kubernetes operations, and secure infrastructure configuration.

The second one has competitive challenges in a capture-the-flag (CTF) format, where students must locate and exploit a vulnerability within an educational service to retrieve a secret flag code. For instance, there is an exercise where a student is granted access to an intentionally vulnerable Kubernetes cluster deployed across multiple virtual machines within Yandex Compute Cloud, requiring them to replicate the exact operational sequence executed by a real-world attacker: escalate privileges inside the cluster and capture the flag.

The platform has been enhanced incrementally since 2021. Initially, the team deployed a minimal footprint within Yandex Cloud, comprising virtual machines, a learning portal, a database, and the first Kubernetes practice environments. Over subsequent semesters, the team added new exercises, live lecture environments, automated building and deployment pipelines, and workload monitoring tools to handle pre-deadline traffic spikes. The grading workflow follows a two-stage process: first, the platform automatically validates the submitted flag and tallies points, and then the student explains their solution to their tutor and submits a report detailing the attack path. This methodology ensures validation of both the final exploit and the student’s comprehension of the complete operational sequence.

The course infrastructure was built entirely on Yandex Compute Cloud virtual machines. Because a core objective of the course is to demonstrate how Kubernetes works, the training clusters are assembled manually on dedicated virtual machines without leveraging managed Kubernetes services.

A baseline pool of several continuously running virtual machines hosts the learning portal, database, and a training Kubernetes cluster consisting of 3 to 5 worker nodes. For lab sessions and demos, ephemeral virtual machines are dynamically deployed, including higher-performance environments tailored for specific scenarios. The standard configuration for these training machines includes 2 to 4 vCPUs and 8 to 16 GB of RAM.

During peak periods, such as pre-deadline windows, the number of concurrently active environments and overall platform workloads multiply, prompting the team to scale computing resources proactively.

To isolate setups, the team developed a proprietary tool: upon establishing an SSH connection, a student is routed automatically into a personal, isolated container configured with their own environment, processes, network, and resource limits. Additionally, the infrastructure is partitioned at the cloud network layer, distributing student virtual machines across distinct subnets and access groups to prevent laboratory systems from communicating with each other or interacting with the core course setup. For lab sessions requiring administrative access over the full operating system, an independent virtual machine pre-configured with a baseline image is provisioned.

Scalable CTF platform for dozens of students

The CMC Faculty team at Moscow State University has built a comprehensive training ground for the cloud technology security course. The course infrastructure scales dynamically under heavy workloads.

The platform supports 25 to 50 active students per semester. The curriculum features more than 14 lectures, 7 lab sessions, and over 12 competitive CTF challenges utilizing a dynamic scoring engine: as more students resolve a challenge, its point yield decreases. Throughout the semester, the platform processes hundreds of submission attempts and retains a complete solution history for final grading loops.