Security breach game

The Security Breach Cards

Card 1 — Hospital

Victim
A regional hospital.

What happened?
Doctors cannot access patient records.
Surgeries are delayed.
Ambulances are diverted.

Impact

• Patient safety
• Financial loss
• Public trust

Vulnerability
Employees clicked a phishing email containing ransomware.(dancing cats?)

Diagnostic clues

• Files suddenly renamed
• Computers display ransom notes
• Security logs show one employee account accessed hundreds of files

Prevention

• Email filtering
• Employee training
• Offline backups
• Multi-factor authentication

Card 2 — Airline

Victim
Major airline.

What happened?
Reservation system crashes.
Thousands of flights delayed.

Impact

• Lost revenue
• Angry passengers
• Operational disruption

Vulnerability
Administrator password reused from another breached website.

Diagnostic clues

• Successful login from another country
• Password used correctly
• New administrator account created

Prevention

• Unique passwords
• MFA
• Login alerts

Card 3 — Personal Savings

Victim
College student.

What happened?
Bank account emptied.

Impact

• Financial loss
• Identity theft

Vulnerability
Fake banking website captured username and password.

Diagnostic clues

• Login from unfamiliar location
• Password reset email
• Transfer to unfamiliar account

Prevention

• MFA
• Verify URLs
• Password manager
• Passkeys

Card 4 — School

Victim
High school.

What happened?
Grades changed.

Impact

• Academic integrity
• Parent complaints

Vulnerability
Teacher password written on sticky note.(yes, this happened at HPA)

Diagnostic clues

• Grade changes after school hours
• Login from classroom computer (why are the dorms physically separate from the campus?)
• No evidence of hacking software

Prevention

• Password security
• Automatic screen locking

Card 5 — City Water System

Victim
Municipal water utility.(check the news: this happened 7 times last week)

What happened?
Chemical settings unexpectedly changed.

Impact

• Public safety
• Service disruption (could be worse if a dam was opened)

Vulnerability
Remote access software left exposed with weak credentials.(look up SCADA)

Diagnostic clues

• Remote login
• Configuration changes
• No physical intrusion

Prevention

• VPN
• MFA
• Disable unnecessary remote access

Card 6 — Online Store

Victim
Small business.

What happened?
Customer credit cards stolen.

Impact

• Fraud
• Reputation damage

Vulnerability
Unpatched web server.(look up the US Army web hack)

Diagnostic clues

• Web logs show exploit requests
• Database queried unusually often

Prevention

• Patch management
• Web application firewall

Card 7 — Smart Home

Victim
Family.

What happened?
Security cameras accessed by strangers.

Impact

• Privacy invasion

Vulnerability
Default administrator password never changed.

Diagnostic clues

• Logins from overseas
• New unknown device connected (could be tracking passwords, etc.)

Prevention

• Change default passwords
• Firmware updates

Card 8 — Factory

Victim
Manufacturing plant.

What happened?
Production stops (look up the stuxnet case)

Impact

• Lost production (Uranium for nuclear weapons?)
• Missed customer deadlines

Vulnerability
USB flash drive infected engineering computer (stuxnet, windows updates)

• look up "air gapped computers"

Diagnostic clues

• Malware appears immediately after USB insertion
• Antivirus alert

Prevention

• USB restrictions (Look up the Snowden case-how did he get data out?)
• Endpoint protection (look up Tanium)

==================== Which part failed?

• People
• Technology
• Process

Cybersecurity is almost never just about “hackers.” It usually involves weaknesses in one or more of those areas.

Threat: Something capable of causing harm.

Examples:

• Hacker
• Malware
• Fire
• Flood
• Insider

Vulnerability

A weakness that a threat can exploit.

Examples:

• Weak password
• Unpatched software
• Open Wi-Fi
• Employee mistake

Exploit

The method used to take advantage of the vulnerability.

Examples:

• Phishing email
• SQL injection
• Stolen password

Risk

The chance and consequence that a threat successfully exploits a vulnerability.

Easy mnemonic

TVER

• Threat
  
• Vulnerability
  
• Exploit
  
• Risk
  

Threat finds Vulnerability, uses an Exploit, creating Risk.

Another simple sentence is:

Threat + Vulnerability = Risk

with the understanding that the exploit is the mechanism connecting the two.

The CIA Triad

“What was really lost?”

• Money
• Grades
• Medical records
• Flights

Then map each answer to the CIA Triad: