CyberSecureDeck

The CyberSecureDeck, Defend the Network! card game, is an engaging way to foster discussions about cybersecurity, identifying threats and addressing vulnerabilities.

The game's objectives are to practice cyber incident response, evaluate response and recovery needs and enhance response plans.  

The goal of the game is for the players to guide the organization through a cybersecurity scenario, focusing on Identifying, Protecting, Detecting, Responding and Recovering from incidents.

Play this game as a fun way to promote a cyber-aware culture, and learn how to identify, protect, respond, and recover from attacks and create cyber resiliency in your organization.

Find instructions for game play below.  For a printable version, download the instruction booklet (PDF).

Components

Facilitator (1): The Facilitator guides players through the game. They do not “play” the game or represent a Role or have a purpose within the Organization.

Roles (8): Each player chooses one or more Role cards within the Organization. All eight roles must be used.

Organization (1): The Organization is based in Massachusetts and represents a business, corporation, non-profit, school, public agency or local government. The Organization provides services to citizens/customers/students and is made up of the eight roles.

The Organization may collect and/or hold citizen/customer/student data, and that data will include employee data and may include citizen/customer/student. Personally Identifiable Information (PII) and Personal Health Information (PHI) as well as financial information.

Citizens/customers/students rely on the Organization.

Scenarios and Injects: There are five Scenario cards, which can be used individually for a 15-Minute Discussion Topic or as a One-Hour GAME (with associated Injects) to help players experience how a cybersecurity incident might occur.

Play

One-Hour GAME for five+ participants (One FACILITATOR, Five+ PLAYERS)

Setup:

The Facilitator chooses a Scenario card and related Injects. No information is shared.

• The Facilitator places all eight Role cards on a table, along with the Organization Chart; Game Purpose, Objective, and Components Sheet; and one-hour game Instructions.
• The Facilitator asks players to each take a Role card and familiarize themselves with the Role and the game (using the materials on the table).
  • If there are less than eight players at the table, have players take a second Role card to fulfill all the Roles. Every Role should be filled, and every player at the table must participate.
  • Players should take their Roles seriously, even if they do not perform that function in real life.
• Give players five minutes to familiarize themselves with the game and their roles.

Game Play

• Facilitator hands Injects, one-by-one (in order) to each Role indicated on the Inject card and asks, “What do you do with this information?”
• When a player in a Role receives an Inject card, they may choose to share the information with other Roles or the Organization (all eight roles) in-whole or in-part or not at all.
• Wait for discussion after each Inject. If there is none, the Facilitator may ask leading questions about the Inject to the Role or Organization to help generate discussion.
• After last Inject is used, and discussion ended, the Facilitator may read the Scenario to the Organization and go through Hot Wash card questions.
   

Responsibilities:

• The Facilitator’s responsibility is to guide the players through the game. The Facilitator does not “play” the game, represent any Role or have a purpose within the Organization. Scenario information and Injects will be provided by the Facilitator only.
   

Play in person

Play this game as a fun way to promote a cyber-aware culture, and learn how to identify, protect, respond, and recover from attacks and create cyber resiliency in your organization. Download the card game with instructions (PDFs) to print up the card deck and play in-person.

Download the Card Game (Zip File)

Provide FEEDBACK on the game.