Cyber security awareness month: How about a card game?
Every year we do the little extra dance to spread cyber security awareness around us, and every year this is usually centered around phishing or passwords - which is fair; it's what we encounter the most. But - how about trying something like a game about security?
This thought actually began a while back when I was employed at Easee - they wanted to move away from the usual video followed by multiple obvious choice training and try something more social and interactive.
TL;DR: The game can be found here
The idea was to bring people together to play a game and learn security lessons while having fun.
It was a good time and while the game was developed by a third party (sorry, I would link it but I cannot remember the name - if you read this and know, tell me and I will update), myself and colleagues were involved with security domain knowledge and it was fun to make a game even though balancing it was the hardest part!
During this period of game development, I had an idea of building a card game with the same focus: Learning cyber security. At the time I was playing a lot of Magic: The Gathering with my girlfriend and felt a system like that would match well with what I had in mind.
But game development and balancing the rules and cards is very time consuming so the idea died off, as so many other hobby projects.
Enter AI
I have been using AI to bounce ideas and build prototypes (and even production-grade stuff like Elevate, which I am proud of) and suddenly, while sick with the cold or flu or something, I got bored and revisited the old card idea.
I could bounce ideas around and see them prototyped fast, but I could also get great card art created!
Breach & Defend
The card game is quite simply: Deploy your defenses or attacks and play it all out strategically.
You pick a side: Red or Blue.
Red team has cards that tries to build an offensive, do blitz attacks and disrupt.
Your job is to wear down your opponent and cause as much damage as you can!
Blue team's cards employs defensive measures. Network segmentations, audits, security analysts.
Your job is to defend and push back against the attacks!
Either way: You deploy infrastructure to support your actions; each card has a cost of infrastructure it needs to play.
Then you have cards that represents security tools, malware, techniques that can be played against each other.
The goal? Each player has a set of computational capacity (health); if that ever reaches 0 on either side, that side has lost the game.
Some cards are very specific in that they target or defend particular attacks or defenses. For example, in the game a card with the tag Phishing will not do any damage if a card with Phishing resistant MFA is on the battlefield.
Clicking on a card lets you inspect it and learn a lesson if you wish.
And the card often mimics its purpose in the game; the Attack Surface Mapper card in the image above lets you peek (or map) your opponents deck of cards.
The quick way to play is against a very limited computer opponent; there is no AI involved. Just a bunch of if statements and such.
You can, of course, play against a friend by choosing the two player route and share a link with someone.
This establishes a connection between your two browsers and you play head to head.
Summary
It's not going to propel your cyber security career, but I hope it can be fun for those learning cyber security and those who are well experienced.
It's a game! Have fun and play!
And of course, the source code is available here.
