Son Of Sun Tzu blog

Son Of Sun Tzu blog

They keep saying my audience will find me…

22 May 2022

Free and online cyber security solo games

As a result of this year’s PlaySecure conference coming around again I’ve made more of a point to look at online games that illustrate useful points about cyber security. I’ve listed them below, with some brief thoughts so you can decide whether to spend time on them yourself.

Please do contact me if there’s something out there I should play to consider adding it to the list. Despite my history in professional wargaming I’m especially interested in solo games that let players learn at their own pace, in their chosen context, and without even the most ephemeral consequences for errors.

In no particular order:

Interland - Google

very cute, very welcoming, very well made

Interland is a web-based solo game aimed at children, explaining some basic concepts around safe Internet usage, such as being wary of what you share, and who you share it with.

This video is the briefest of introductions to the theme and gameplay.

Or play the game yourself.

I found it fun, interesting to see what was or wasn’t emphasised, and particularly cynical viewers will be intrigued by what does and doesn’t make it into the threat model that’s illustrated. But overall this is recommended, to see what the web is now capable of. Its certainly worth putting in front of your younger children.

Terminal - IBM

Die Hard levels of peril at your airport

In stark contrast to Interland above, Terminal is aimed at security professionals, described as a stripped down version of IBMs “cyber range”. It covers threats against normal business operation of an airport, where it’s your job to effective manage those threats by allocating resources quickly and efficiently.

This video is the briefest of introductions to the theme and gameplay.

Or play the game yourself.

I was impressed by the sheer scale and complexity of it, and the number of moving parts as you play. However, while I appreciate the implied point about having to make decisions quickly, and triaging tasks being so important, I often felt rushed rather than educated. Great production values though, and another example of how engaging this kind of medium can be.

Targeted Attack - Trend Micro

You'll come to dread the CIO looking to the camera for your choice

Targeted Attack, also known as “Fugle” after the company at the centre of the narrative, is also aimed at security professionals. It mainly consists of video clips followed by limited choices, but with resource points to spend it is much more than a simple branching narrative. In it you are the CIO of a global organization called The Fugle, on the verge of making the first release of a biometrically authenticated mobile payment app, but in a “third person” way as you make decisions for Dave, the CIO in the game.

This short trailer is the briefest of introductions to the theme and gameplay.

Or play the game yourself.

As someone beginning to experiment with branching narratives I found it interesting from that perspective, and also I was impressed by the quality of the performances, and the production values in general. There’s obviously a lot of work gone into this, and it was interesting to play. The limited choices could be frustrating, but with pre-recorded video as the medium I don’t see a better way of doing this.

Cybersecurity Lab - Nova Labs

snapcat

“The Cybersecurity Lab is a game designed to teach people how to keep their digital lives safe, spot cyber scams, learn the basics of coding, and defend against cyber attacks. The Lab also features stories of real-world cyber attacks, a glossary of cyber terms, and short animated videos that explain the need for cybersecurity, privacy versus security, cryptography (cyber codes), and what exactly hackers are.”

This video is an introduction to Nova Labs, and at an abstract level is a great introduction to the risks and benefits of the Internet.

Or play the game yourself.

I haven’t played this yet, when I do, I’ll update this post.

Bad News - DROG and University of Cambridge

simple and direct explanations

In Bad News, you take on the role of fake news-monger, building a persona as an unscrupulous media magnate. Your task is to get as many followers as you can while slowly building up fake credibility as a news site. It’s aimed at ages 14 and up, and purports to act as a vaccine against online disinformation, illustrating the common forms of manipulation that you will encounter online.

This datasheet will tell you everything you need to know if you’re using this for educational purposes.

Or play the game yourself.

It’s a wonderfully simple game, with relatively few choices, but just enough interactivity and a quick enough pace to keep you playing along. I’m sure I played this several years ago, but the use of relatively up to date news and comments has kept it fresh. Depending on who you follow on Twitter, the similarity to some popular accounts is jarring at times.

Epilogue

I wouldn’t include standard technical CTFs in this category, please contact me if you know of a good index of those that I can link to.

Adam Shostack has a list of Tabletop Security Games and Cards.

( I have a couple of these, but mostly haven’t played them in far too long - suggestions or offers to play them remotely are welcome )