This is a sporadically updated list of online games that illustrate useful points about cyber security. For those I’ve tried, or intend to try, I’ve listed them below, with some brief thoughts so you can decide whether to spend time on them yourself.

Please do contact me if there’s something out there I should play to consider adding it to the list. Despite my history in professional wargaming I’m especially interested in solo games that let players learn at their own pace, in their chosen context, and without even the most ephemeral consequences for errors.

In no particular order:

Interland - Google

Interland is a web-based solo game aimed at children, explaining some basic concepts around safe Internet usage, such as being wary of what you share, and who you share it with.

This video is the briefest of introductions to the theme and gameplay.

Or play the game yourself.

I found it fun, interesting to see what was or wasn’t emphasised, and particularly cynical viewers will be intrigued by what does and doesn’t make it into the threat model that’s illustrated. But overall this is recommended, to see what the web is now capable of. Its certainly worth putting in front of your younger children.

Terminal - IBM

In stark contrast to Interland above, Terminal is aimed at security professionals, described as a stripped down version of IBMs “cyber range”. It covers threats against normal business operation of an airport, where it’s your job to effective manage those threats by allocating resources quickly and efficiently.

This video is the briefest of introductions to the theme and gameplay.

Or play the game yourself.

I was impressed by the sheer scale and complexity of it, and the number of moving parts as you play. However, while I appreciate the implied point about having to make decisions quickly, and triaging tasks being so important, I often felt rushed rather than educated. Great production values though, and another example of how engaging this kind of medium can be.

Targeted Attack - Trend Micro

Targeted Attack, also known as “Fugle” after the company at the centre of the narrative, is also aimed at security professionals. It mainly consists of video clips followed by limited choices, but with resource points to spend it is much more than a simple branching narrative. In it you are the CIO of a global organization called The Fugle, on the verge of making the first release of a biometrically authenticated mobile payment app, but in a “third person” way as you make decisions for Dave, the CIO in the game.

This short trailer is the briefest of introductions to the theme and gameplay.

Or play the game yourself.

As someone beginning to experiment with branching narratives I found it interesting from that perspective, and also I was impressed by the quality of the performances, and the production values in general. There’s obviously a lot of work gone into this, and it was interesting to play. The limited choices could be frustrating, but with pre-recorded video as the medium I don’t see a better way of doing this.

Cyber Sprinters - NCSC

This is a cute little game aimed at 8-11 year olds. Fast-paced, and aimed at an elementary level, it feels like a good way to start conversations around cyber security basics.

This is a playthrough that’s pretty comprehensive, and probably more than you need to see to get an idea of whether the game is for you, or your family or class.

Or play the game yourself.

Cyber Explorers - DCMS

This is a free online service from the UK Government, specifically the Department for Digital, Culture, Media, & Sport; aimed at 11-14 year olds, and their teachers. Right from the start I liked the introductory video, with the emphasis on people doing things, so they needed cyber security help, rather than security being an end in itself. I only tried a couple of modules, but this tone appears to be maintained throughout.

The production values were high, the animation style was friendly. It was engaging too, it didn’t feel like it was talking down to the audience at all. I’ve literally no idea how well this goes across with a typical 11-14 year old in the UK, but if you’re a teacher for that age range I think it’s worth your time to check this out.

Go the the Cyber Explorers website for information on how to register.

Cybersecurity Lab - Nova Labs

“The Cybersecurity Lab is a game designed to teach people how to keep their digital lives safe, spot cyber scams, learn the basics of coding, and defend against cyber attacks. The Lab also features stories of real-world cyber attacks, a glossary of cyber terms, and short animated videos that explain the need for cybersecurity, privacy versus security, cryptography (cyber codes), and what exactly hackers are.”

This video is an introduction to Nova Labs, and at an abstract level is a great introduction to the risks and benefits of the Internet.

Or play the game yourself.

I haven’t played this yet, when I do, I’ll update this post.

Bad News - DROG and University of Cambridge

In Bad News, you take on the role of fake news-monger, building a persona as an unscrupulous media magnate. Your task is to get as many followers as you can while slowly building up fake credibility as a news site. It’s aimed at ages 14 and up, and purports to act as a vaccine against online disinformation, illustrating the common forms of manipulation that you will encounter online.

This datasheet will tell you everything you need to know if you’re using this for educational purposes.

Or play the game yourself.

It’s a wonderfully simple game, with relatively few choices, but just enough interactivity and a quick enough pace to keep you playing along. I’m sure I played this several years ago, but the use of relatively up to date news and comments has kept it fresh. Depending on who you follow on Twitter, the similarity to some popular accounts is jarring at times.

Epilogue

I wouldn’t include standard technical CTFs in this category, please contact me if you know of a good index of those that I can link to.

Adam Shostack has a list of Tabletop Security Games and Cards.

( I have a couple of these, but mostly haven’t played them in far too long - suggestions or offers to play them remotely are welcome )

Record of significant updates:

• Originally published 22nd May 2022.
• Updated 27th October 2022 to add Cyber Sprinters
• Updated 3rd November 2022 to add Cyber Explorers