Riskio Information Card Deck
Information Deck used by Games Master
The Games Master Acts as The Attacker
The Games Master can stop the game play and act as an attacker for all the players to act as defenders.
Example: Games Master (G) selects the Jack of Information: Unsecured USB Drive. “ Cyber Criminals left the USB sticks in your office and staff have plugged them into work PCs. USB has malware and auto run is not disabled so it installs a key logger to capture user names and passwords when plugged in”
Example of Two Defences
Player 1: Plays the Defence Card, 3 Secure Configuration: “Disable auto run in group policy for all PCs and laptops”.
Player 2: Plays the Defence Card, 7 Security Training: “Train staff to report to IT Help Desk if they find USB stick in office”.
The Games Master can use this for example, to explain:
Link defences, for example, to NCSC Cyber Essentials
Discuss cost benefits of defences with players
Discuss the effectiveness of defences
Importance of not all controls being technical and staff
The Defence Example 1 - Is this a good and cost-effective defence?
The Attacker (A) “Cyber Criminals - Attacker gathered information from corporate website and used this to create emails to target employees”.
The Defender (D) “Train staff how to spot spoofed emails and implement a intranet based training solution for staff to test their skills”.
The Defence Example 2 - Is this a good and cost-effective defence?
The Attacker (A) “Cyber Criminals - Attacker gathered information from corporate website and used this to create emails to target employees”.
The Defender (D) “Configure the Email server to verify the IP Address of the incoming email domain and put in spam folder where does not match”.