Security is not a game. It just shares a lot in common with certain games. Oh Noes, as an incident response RPG, highlights that and makes great use of it.
I put a lot of my security knowledge down to being a heavy user of games. This includes both tabletop RPGs and board games. Social deduction and storytelling games provide practice dealing with people and presenting. Strategy games give a chance to spot and exploit system weaknesses. Others provide a myriad of other useful skills.
For another project for 2020 I’m going to pick out some which are directly or peripherally useful to a cyber security professional – whether for awareness building, threat modelling, or for useful skills development.
Oh Noes is probably one of the most directly related to security that I have come across, and I strongly recommend it. It’s also free, which is always helpful.
Inspired by a mix of classical tabletop RPGs and incident response exercises, Oh Noes! is a thin (but effective) layer of gamification over a tabletop incident response exercise. No matter how useful and enjoyable (at least I enjoy them) tabletop IR exercises are often seen as a tedious mandatory exercise rather than a chance to prepare and try out security. Wrapping a layer of gamification and entertainment around them is a good way to push engagement and more regular sessions. The game itself recommends quarterly rather than annual. With the right Incident Master and company culture regular Wednesday pizza and gaming sessions might happen.
At the very least it’s a new take on normal IR planning and is worth a shot. It’s published free by Expel, along with some handouts and a few scenarios to begin with. The first few sessions should be run by someone with a bit of experience running tabletop RPGs (as well as an understanding of IR and the company) to get the full experience.
I first read Shostack’s Threat Modeling some time ago and have tried to use the lessons since. Recently though it’s been recommended as reading for the MSc course, so I picked up my much-notated and dog-eared copy for another run through with fresh eyes.
Threat Modeling Fundamentals
Before I go into the book itself I am going to talk a little about threat modeling as a concept, and its value. Even if you do not go as far as using a formal methodology, are not looking at technical threats, or even have nothing to do with security in your company I highly recommend trying to use at least the basics of threat modeling. The simple idea behind it all is that when you are developing, planning or building something you should consider the threats – which are not the same as risks. A lot of attempted risk management takes place in the absence of consideration of threats, and (from experience) often without considering vulnerabilities. Risks arise from the combination of a threat and a vulnerability – the threat is a factor outside of your control. The vulnerability is something you can mitigate or even remediate.
The fundamental of threat modeling is to look at the threats to any endeavour, consider them carefully against vulnerabilities which exist in that endeavour (often because a threat hasn’t been considered) and manage the risks that arise, either by closing down vulnerabilities or simply accepting any residual risk. There are plenty of formal methodologies out there, as well as a few games, but to begin the principles are the important bit and a lot of the security awareness training I do works around teaching people how to build some sort of threat model before anything else.
The Book
Shostack’s book is not the only one available on threat modeling, but by many, it is considered to be the most important. It’s an enjoyable read in and of itself, and can even be read cover to cover if you’re interested in the subject matter (the writing style is helpful here, friendly and engaging). It also works well as a reference book to dig into when you’re trying to teach, learn or do a threat model. Working up from the fundamentals to the structured approaches of threat modeling, covering Microsoft’s STRIDE methodology, looking into attack trees and libraries, and advancing smoothly throughout I’d highly recommend this to anyone who wants to make use of threat modeling as well as those who need a good reference work on the subject.
