Cyber Attacks

Cyber security is everyone's concern. With the growing potential of Artificial Intelligence, we have no idea how this is going to evolve, but with things like deep fake and AI models independently hacking a website, we know it is only going to become worse. And then many the threats we know from the past, and how we can avoid them, still remain relevant.

But how do you create awareness about cyber security? By periodically going through mandatory training videos and doing a multiple choice test? Succeeding in the test has probably become a goal on its own, but there is a small chance that the actual message of the training will be remembered.

The cyber attacks game takes a different approach. It is a game with cards, in which participants need to guess what happened during a cyber security incident, based on a vague, rather cryptic description and an image. Through questions that can only be answered with "Yes" or "No", they have to solve the mystery. If they have no clue, they can get a key (maximum 3) that can help unlock the puzzle, or not...

The back of the card, which remains uncovered for the participants until they can guess what happened, contains the 3 keys, a brief description what really happened and how this kind of incidents can be avoided.

Extended stories

The size of the cards is limited. This means that the information on the cards, what happened and how to avoid, is often very condensed, reduced to the bare essence. But sometimes you really want to know just a little bit more than what is on the card. That's why this game is also accompanied by an e-book that you can download for free, from leanpub.com. The card deck contains a card with the URL (also accessible via the QR-code) where you can download the e-book for free.

Other ways to use the cards

You can use the cards also as a way to detect gaps in your team's way of working, e.g. during retrospectives.

As a team leader/coach, you can put the card(s) on the table for which you think your own product is vulnerable. Discuss with the team what corrective actions they will plan to mitigate the risk.
You can also put all the cards on the table and ask the team which vulnerabilities they think your product is still exposed to. Prioritize the vulnerabilities (e.g. impact versus likelihood) and plan mitigating actions.

There are probably many other possibilities. Feel free to share your suggestions.