Effectiveness of Hands-On Lab Training for Improving Zero-Trust and Identity-Access Management Competencies Among Hybrid Cloud Engineers
Keywords:
access control, workforce training, cloud securityAbstract
Hybrid-cloud security increasingly depends on identity-centered controls, continuous authorization, federation, least privilege, and policy enforcement across heterogeneous platforms. These competencies are difficult to develop through lecture-only or awareness-oriented instruction because engineers must be able to configure, observe, troubleshoot, and validate security controls in realistic systems. This review evaluates the effectiveness of hands-on laboratory training for developing zero-trust and identity-access management (IAM) competencies relevant to hybrid-cloud engineering and proposes an evidence-based framework for training delivery and assessment. A structured evidence review synthesized peer-reviewed studies involving cybersecurity laboratories, virtual laboratories, cyber ranges, learner-controlled security training, gamified security education, and practical assessment, together with authoritative zero-trust and IAM standards. Evidence was mapped to operational competency domains including authentication, federation, role- and attribute-based authorization, least privilege, conditional access, workload identity, policy troubleshooting, and security telemetry. Across heterogeneous educational settings, practical training environments consistently supported procedural learning, realistic task execution, self-efficacy, engagement, and directly observable performance. Stronger training designs combined realistic scenarios with learner control, immediate feedback, repeatable environments, objective task instrumentation, and delayed or transfer assessment. Cyber-range and virtual-laboratory platforms also improved scalability and enabled systematic collection of command, log, configuration, and policy evidence. For zero-trust and IAM training, the most defensible outcome measures include policy correctness, task completion time, excess-privilege errors, authentication and federation troubleshooting accuracy, recovery from misconfiguration, and performance on unfamiliar scenarios. Overall, hands-on laboratories are well suited to hybrid-cloud zero-trust and IAM skill development because they convert abstract access-control principles into observable configuration and diagnostic behavior. Their effectiveness is greatest when training is scenario-based, instrumented, progressively scaffolded, and evaluated using task-level security outcomes rather than participant satisfaction alone.
References
Rose S, Borchert O, Mitchell S, Connelly S. Zero Trust Architecture. NIST Special Publication 800-207. Gaithersburg (MD): National Institute of Standards and Technology; 2020. doi:10.6028/NIST.SP.800-207.
Grassi PA, Garcia ME, Fenton JL. Digital Identity Guidelines. NIST Special Publication 800-63-3. Gaithersburg (MD): National Institute of Standards and Technology; 2017. doi:10.6028/NIST.SP.800-63-3.
Hu VC, Ferraiolo D, Kuhn R, Schnitzer A, Sandlin K, Miller R, et al. Guide to Attribute Based Access Control (ABAC) Definition and Considerations. NIST Special Publication 800-162. Gaithersburg (MD): National Institute of Standards and Technology; 2019. doi:10.6028/NIST.SP.800-162.
Newhouse W, Keith S, Scribner B, Witte G. National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework. NIST Special Publication 800-181. Gaithersburg (MD): National Institute of Standards and Technology; 2017. doi:10.6028/NIST.SP.800-181.
Sandhu RS, Coyne EJ, Feinstein HL, Youman CE. Role-based access control models. Computer. 1996;29(2):38-47.
Hu J, Meinel C. Tele-Lab “IT-Security” on CD: portable, reliable and safe IT security training. Comput Secur. 2004;23(4):282-289. doi:10.1016/j.cose.2004.02.005.
Willems C, Klingbeil T, Radvilavicius L, Cenys A, Meinel C. A distributed virtual laboratory architecture for cybersecurity training. In: 2011 International Conference for Internet Technology and Secured Transactions. IEEE; 2011. p. 408-415.
Willems C, Meinel C. Online assessment for hands-on cyber security training in a virtual lab. In: 2012 IEEE Global Engineering Education Conference (EDUCON). IEEE; 2012. p. 1-10. doi:10.1109/EDUCON.2012.6201149.
Pham C, Tang D, Chinen K, Beuran R. CyRIS: a cyber range instantiation system for facilitating security training. In: Proceedings of the Seventh Symposium on Information and Communication Technology. New York: ACM; 2016. p. 251-258. doi:10.1145/3011077.3011087.
Frank M, Leitner M, Pahi T. Design considerations for cyber security testbeds: a case study on a cyber security testbed for education. In: 2017 IEEE DASC/PiCom/DataCom/CyberSciTech. IEEE; 2017. p. 38-46. doi:10.1109/DASC-PICom-DataCom-CyberSciTec.2017.23.
Domínguez M, Prada MA, Reguera P, Fuertes JJ, Alonso S, Morán A. Cybersecurity training in control systems using real equipment. IFAC-PapersOnLine. 2017;50(1):12179-12184. doi:10.1016/j.ifacol.2017.08.2151.
Tobarra L, Robles-Gómez A, Pastor R, Hernández R, Duque A, Cano J. A cybersecurity experience with cloud virtual-remote laboratories. Proceedings. 2019;31(1):3. doi:10.3390/proceedings2019031003.
Abawajy J. User preference of cyber security awareness delivery methods. Behav Inf Technol. 2014;33(3):237-248. doi:10.1080/0144929X.2012.708787.
González-Manzano L, de Fuentes JM. Design recommendations for online cybersecurity courses. Comput Secur. 2019;80:238-256. doi:10.1016/j.cose.2018.09.009.
Estriegana R, Medina-Merodio JA, Barchino R. Student acceptance of virtual laboratory and practical work: an extension of the technology acceptance model. Comput Educ. 2019;135:1-14. doi:10.1016/j.compedu.2019.02.010.
Abraham S, Chengalur-Smith I. Evaluating the effectiveness of learner controlled information security training. Comput Secur. 2019;87:101586. doi:10.1016/j.cose.2019.101586.
Dincelli E, Chengalur-Smith I. Choose your own training adventure: designing a gamified SETA artefact for improving information security and privacy through interactive storytelling. Eur J Inf Syst. 2020;29(6):669-687. doi:10.1080/0960085X.2020.1797546.
Vykopal J, Celeda P, Seda P, Svabensky V, Tovarnak D. Scalable learning environments for teaching cybersecurity hands-on. In: 2021 IEEE Frontiers in Education Conference (FIE). IEEE; 2021. doi:10.1109/FIE49875.2021.9637180.
Švábenský V, Vykopal J, Tovarňák D, Čeleda P. Toolset for collecting shell commands and its application in hands-on cybersecurity training. In: 2021 IEEE Frontiers in Education Conference (FIE). IEEE; 2021. doi:10.1109/FIE49875.2021.9637052.
Vykopal J, Švábenský V, Chang EC. Benefits and pitfalls of using Capture the Flag games in university courses. In: Proceedings of the 51st ACM Technical Symposium on Computer Science Education. New York: ACM; 2020. p. 752-758. doi:10.1145/3328778.3366893.
Published
Issue
Section
License
Authors retain copyright. Articles published under the Creative Commons Attribution 4.0 International licence (CC BY 4.0) may be shared and adapted for any purpose, including commercially, provided appropriate credit is given, a link to the licence is supplied, and changes are indicated. No additional legal or technological restrictions may be imposed. Third-party material is included only where its credit line permits. Licence: https://creativecommons.org/licenses/by/4.0/. Earlier publications remain subject to their stated licence and author agreements unless the rights holder authorizes a change.
