Riskio Card Decks

This page explains the Threat, Defence, and Information cards used during Riskio gameplay and how they support learning.

Attack Deck: The attack deck is formed by six suits of 13 cards (the same as a typical card deck: Ace, 2 to 10, then Jack, Queen and King). Each suit of the attack deck was based on categorising the attacks based on the six Microsoft STRIDE threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Defence Deck: The defence deck is formed by a single suit of 13 cards: 2 to 10, then Jack, Queen, King and Ace, representing the core security controls that can be directly applied to mitigate against known attack types.

Information Deck: The information deck is formed by a single suit of 13 cards: 2 to 10, then Jack, Queen, King and Ace, representing security-related events resulting in a successful cyber attack unless the correct defence card is played. The games master uses this deck to test players' defence strategies and help the gameplay.

Click on the back of the card to see the complete suit of cards.

Sign with a red, yellow, white, and blue mask icon and the words 'Open Spoofing Deck' along with a right arrow.
Sign with a red, yellow, white, and blue mask icon and the words 'Open Spoofing Deck' along with a right arrow.

Spoofing Suit

Attacks to procedures can maliciously impersonate users but can also spoof websites or servers.

A blue sign with white text and icons indicating the direction to an open tampering deck. The sign has an icon of a hand turning a gear and an unlocked padlock, with an arrow pointing right.
A blue sign with white text and icons indicating the direction to an open tampering deck. The sign has an icon of a hand turning a gear and an unlocked padlock, with an arrow pointing right.

Tampering Suit

Attacks that alter data at rest, e.g. by exploiting a vulnerability in application front-ends or transit, e.g. due to a lack of message encryption.

Sign with a hand and a document with a red cross, text says 'Open Repuation Deck', and an arrow pointing right.
Sign with a hand and a document with a red cross, text says 'Open Repuation Deck', and an arrow pointing right.

Repudiation Suit

Threats to claim to have not performed an action.

Blue informational sign with a hand icon, a document icon, and an i symbol, indicating 'Open Information Disclosure Deck' with a right arrow, directing to the right.
Blue informational sign with a hand icon, a document icon, and an i symbol, indicating 'Open Information Disclosure Deck' with a right arrow, directing to the right.

Information Disclosure Suit

Threats to the confidentiality of information.

A sign indicating an open but denied access to the service deck with a red warning triangle and arrow pointing to the right.
A sign indicating an open but denied access to the service deck with a red warning triangle and arrow pointing to the right.

Denial of Service Suit

Availability of services to users.

Blue directional sign indicating the open elevation of privilege deck with a person icon at the top, an upward red arrow, and a rightward white arrow in a circle at the bottom.
Blue directional sign indicating the open elevation of privilege deck with a person icon at the top, an upward red arrow, and a rightward white arrow in a circle at the bottom.

Elevation of Privilege Suit

Threats against the authorisation controls.

Sign indicating the direction to the open defense deck, with a shield and checkmark symbol at the top, and an arrow pointing right at the bottom.
Sign indicating the direction to the open defense deck, with a shield and checkmark symbol at the top, and an arrow pointing right at the bottom.

Defence Suit

Defence cards describe a pattern of behaviour that protects the player against an exploitation attempt.

Blue sign with an open book icon and a red information symbol, displaying the words 'Open Information Deck' and a right arrow.
Blue sign with an open book icon and a red information symbol, displaying the words 'Open Information Deck' and a right arrow.

Information Suit

Games master can use Scaffolding by framing, guiding and supporting using the information deck of cards.