Game Progress

Objective of the Game

The players’ task is to build a cybersecurity system that will be effective against emerging Attack-type Injects.

PIN Code – a code that enables participation in the game.

Lobby – a space where players wait for the game to start.

Briefing – a tab that describes the context of a given game session. Information may include the organization being defended by the players (e.g., sector, infrastructure) and a description of the game scenario.

HP (Hit Points, Health Points) – a metric used to present the impact of Injects on the defended organization’s infrastructure and the effectiveness of the decisions made by the players. The impact of each Event can be minimized by selecting appropriate security measures. The HP value decreases more slowly after the occurrence of Injects if more effective security measures are implemented.

Budget – Players receive a virtual budget within which they implement security measures according to their adopted strategy.

Scenario – the course and schedule of gameplay consisting of predefined Injects.

Inject (Event) – any event in the game that can have various characteristics.

The game will include Events according to the prepared game scenario. The moment the first Attack-type Inject (generic or the first technique in the attack chain) occurs is considered a compromise of the system and marks the end of the Prevention phase.

Attack – A negative event impacting the players’ infrastructure. It can be a generic event (e.g., malware delivered via email) or a specific technique used by the attacker as part of the attack chain (a sequence of techniques), such as using scripts and PowerShell commands, modifying domain policies. One scenario can include several Attack-type Injects or several attack chains composed of multiple Injects.

Control – An event that can have a negative or positive impact on the players’ HP or budget.

Information – A neutral or positive event providing information that influences the course of the game, e.g., information about the activities of cybercriminal groups, information about additional budget allocation.

Bonus – A positive event resulting from successfully completing a task by the players.

Prevention – A phase of the game that occurs before the first Attack-type Inject (generic or the first technique in the attack chain) takes place. In this phase, security measures that allow for the Identification of threats and Protection against them are the most effective. Note: In scenarios involving multiple Attack-type Injects (generic or attack chains), after the Event concludes, a notification will be displayed indicating the end of the attack, and another Prevention phase will begin until the next Attack-type Inject occurs.

Response – A phase of the game that takes place after the occurrence of an Attack-type Inject (generic or the first technique in the attack chain). In this phase, security measures that allow for Detection of threats, Response to threats, and Recovery of business capabilities post-incident are the most effective. The response phase continues until the information about the end of the attack is received.

Security Measures – Represented in the game using cards that contain a number, name, price, and icon. Descriptions of the security measures are available on the website https://lct.cybsecurity.org/safeguards.

The categorization of security measures is based on the defense in depth model:

• Organization
• Physical Infrastructure
• Entire Network
• Network Edge
• Internal Network
• End Devices
• Applications
• Data
• Data Sources

The effectiveness of the security measures is estimated based on criteria from the NIST Cybersecurity Framework functions:

Identification – Understanding the business context, resources supporting critical functions, and associated cybersecurity risks enables the organization to focus and prioritize its actions according to its risk management strategy and business needs.

Examples of security measures within this function include: Asset Management; Security Organization; Governance; Risk Assessment;

Protection – Developing and implementing appropriate safeguards to ensure the delivery of essential infrastructural services and supporting capabilities to limit the impact of potential cybersecurity incidents.

Examples include: Access Control, Security Awareness Training, Data Security; Security Processes and Procedures; Maintenance and Security Technologies.

Detection – Developing and implementing appropriate activities and tools to detect cybersecurity-related incidents.

Examples within this function include: Anomalies and Events; Continuous Security Monitoring and Detection Processes.

Response – Developing and implementing appropriate actions to respond to detected cybersecurity incidents.

Examples include: Response Planning; Communication; Preventing Event Propagation, Analysis.

Recovery – Developing and implementing appropriate actions to maintain resilience plans and restore capabilities or services affected by a cybersecurity incident. The Recovery function supports the restoration of normal operations to minimize the impact of the cybersecurity incident.

Examples within this function include: Business Continuity Planning, Recovery Planning, Backups, System Redundancy, Improvements, and Communication.

Effectiveness of Security Measures – Effectiveness is assessed against individual Injects. Some security measures are effective only in the Prevention phase, while others are effective in the Response phase. In scenarios where the attack chain consists of multiple Injects, the same security measures can be considered multiple times with varying levels of effectiveness depending on the Inject.

Implementation of Security Measures – The implementation of security measures is confirmed by using the Purchase button. Only then are they included in the cybersecurity system. NOTE! It should be noted that some security measures that are effective in the Response phase must be implemented in the Prevention phase. The game’s premise assumes that once the first Attack-type Inject begins, there are no longer options for implementing security measures that require a long time for implementation, such as technological (e.g., SIEM, IDS/IPS) and procedural security measures (e.g., Incident Response Process). However, some security measures related to external services or quick-action tasks can still be implemented in the Response phase, e.g., configuration changes, network segmentation, event logging, and connecting data sources.