You are a team responsible for ensuring the cybersecurity of critical infrastructure and key services in your country. The goal of the game is to build an effective cybersecurity system that will be able to protect the entities represented by the team against various threats from cyberspace.

At the beginning of the game, the organization has a budget in the amount specified before the game. Simulated cyberattacks and incidents based on real events will take place throughout the game. Some scenarios may involve increasing the budget during the game.

Protections are divided into 8 categories (Organization, Physical Infrastructure, Entire Network, Network Edge, Internal Network, Endpoints, Apps and Data).

• There is a ninth category of Protections – Data Sources – it must be unlocked by selecting the appropriate tab from the other categories.

The game scenarios include the occurrence of the so-called injections – events of various nature, e.g. attack, part of an advanced attack, incident, information. Before the game, players will be given hints about the planned scenario, but the advantage will be gained by those teams that are better prepared by gaining the most missing information.

REMARKS:

The flow of the game

The goal of the game:

The task of the players is to build a cybersecurity system that will be effective against the appearing Injects of the Attack type.

The PIN code – code to participate in the game.

Lobby – the space where players wait for the game to start.

Briefing – a tab describing the context of a given game. The information may include the organization defended by the players (e.g. sector, infrastructure) and a description of the game scenario.

HP (Hit Points, Health Points) – a metric used to present the impact of Injects on the infrastructure of the defended organization and the effectiveness of decisions made by players. The impact of each Event can be minimized by the selection of appropriate safeguards. The value of HP after the occurrence of Injects decreases the slower the more effective protections are implemented.

Budget – Players receive a virtual budget within which they implement security in accordance with their strategy.

Scenario – the course and schedule of the game consisting of predefined Injects.

Inject – any event in the game that can be of different nature.
Events will occur in the game according to the prepared game scenario. The moment of occurrence of the first Inject of the Attack type (generic or the first technique in the chain of attacks) is considered a compromise of the system and at the same time the end of the Prevention phase.

• Attack – Negative event affecting players’ infrastructure. It can be a generic event (e.g. malware delivered in e-mail correspondence) or a particular technique used by the attacker as part of the attack chain (sequence of techniques), e.g. the use of Powershell scripts and commands, modification of domain policies). One scenario can include several Attack Injects or multiple Attack Chains consisting of multiple Injects.
• Control – An event that can have a positive or negative impact on players’ HP or budget.
• Information – A neutral or positive event providing information affecting the course of the game, e.g. information about the activity of cybercriminal groups, information about granting an additional budget.
• Bonus – A positive event resulting from a successfully completed task by the players.

Prevention – the phase of the game that takes place before the occurrence of the first Inject of the Attack type (generic or the first technique in the chain of attacks). In this phase, the most effective are the safeguards that allow Identification of threats and Protection against them.

Note: For a scenario involving multiple Attack Injects (generic or chain attack), the Event will display the end of the Attack and the next Prevention phase will start until another Attack Inject occurs.

Reaction – The phase of the game that takes place after an Attack type Inject (generic or the first technique in the attack chain). In this phase, the most effective protections are Detection and Response to threats as well as Recovery of business capabilities after an incident. The reaction phase lasts until the information about the end of the attack appears.

Safeguards – Represented in the game by cards containing a number, name, price and icon. The security description is available on the website.

Segregation of safeguards is based on the defense-in-depth model
• Organization
• Physical infrastructure
• Entire network
• Edge of the network
• Internal network
• Terminal devices
• Apps
• Data
• Data sources

Safeguards effectiveness is assessed using criteria based on the functions of the NIST Cybersecurity Framework:
• Identification – Understanding the business context, resources supporting critical functions, and related cybersecurity risks enables the organization to focus and prioritize its activities in line with its risk management strategy and business needs.
Examples of safeguards within this function include: Asset management; Security Organization; Order; Risk assessment;
• Protect – development and implementation of appropriate safeguards to ensure the implementation of the most important infrastructural services and support the possibility of limiting the impact of a potential cybersecurity event.
Examples include: Access Control, Security Awareness, Data Security; Security Processes and Procedures; Maintenance and Security Technologies
• Detection – development and implementation of appropriate activities and tools to detect a cybersecurity incident.
Examples within this Feature include: Anomalies and Events; Continuous Security Monitoring and Detection Processes.
• Response – development and implementation of appropriate actions to take action related to detected cybersecurity incidents.
Examples include: Response Planning; communication; Event Propagation Prevention, Analysis.
• Recovery – development and implementation of appropriate actions to maintain resilience plans and restore capabilities or services affected by a cyber incident. The Restore feature supports restoring normal operations to reduce the impact of a cybersecurity incident.
Examples within this Function include: Business Continuity Planning, Recovery Planning, Backup, System Redundancy, Enhancement and Communication.

Safeguards effectiveness – the effectiveness is estimated for individual Injects. Some protections are effective only in the Prevention phase, and some in the Reaction phase. When the scenario assumes that the chain of attack consists of several Injects, the same protections can be considered multiple times with different levels of effectiveness depending on the Inject.

Safeguards implementation – safeguards implementation is approved by clicking the Buy button. Only then are they included in the cybersecurity system. WARNING! It should be remembered that some of the protections that are effective in the Reaction phase should be implemented in the Prevention phase. The idea of the game assumes that after starting the first Inject of the Attack type, it is no longer possible to implement safeguards measures that require a long time to implement, e.g. technological (such as SIEM, IDS/IPS) and process security (e.g. Incident Response Process). However, some security related to external services or activities that can be performed in a short time can be implemented in the Reaction phase, e.g. changes in configuration, network separation, event logging, connection of data sources.

General information

1. The organizer of the Cyber Fortress League (hereinafter CFL) is the Cybersecurity Foundation with its registered office in Warsaw, at Adam Branicki 13 street.

2. Tournaments will be held online or in the form of a regular, stationary event. Participants of online tournaments provide themselves with the equipment necessary to participate in the league, i.e. a computer with access to the Internet.

3. Information about the season (number of tournaments, duration and prizes) in which the league takes place is provided by the organizer at https://cybertwierdza.cybsecurity.org.

Team registration

4. Teams that register for CFL via the website https://www.cybsecurity.org/cyber-twierdza/ can participate in the game, during registration the team provides an e-mail address of their captain, through whom contact with the team will be maintained and he will be official representative of the team in the competition.

5. You cannot be a member of several teams at the same time.

6. By registering and participating in tournaments, the captain confirms that all registered team members accept these statue.

7. Teams can consist of 2 to 5 people.

7.1 There may be special tournaments where teams with a different number of players may participate. This type of tournament will be clearly indicated by the organizer.

8. You can join the League at any time during the season. At the time of joining, each new team has zero points in its account.

9. In each of the tournaments, the composition of the team does not have to be full, in order to include points in the general classification, the presence of at least one representative of the team is necessary.

10. Employees and members of the Cybersecurity Foundation and their families cannot participate in the CFL.

11. Teams participating in CFL games may not be named in an obscene manner or like legal entities or organizations, or their name may not clearly refer to such an entity or organization.