Security breach game

This is all about real people losing things that matter
 Each group of 3–4 students gets one scenario card and answers four questions:
What happened? (the impact)
How did they get in? (the vulnerability)
What clue would tell us? (diagnostic evidence/logs)
How could it have been prevented? (defense)
The Security Breach Cards
Card 1 — Hospital
Victim
A regional hospital.
What happened?
Doctors cannot access patient records.
Surgeries are delayed.
Ambulances are diverted.
Impact
Patient safety
Financial loss
Public trust
Vulnerability
Employees clicked a phishing email containing ransomware.(dancing cats?)
Diagnostic clues
Files suddenly renamed
Computers display ransom notes
Security logs show one employee account accessed hundreds of files
Prevention
Email filtering
Employee training
Offline backups
Multi-factor authentication
Card 2 — Airline
Victim
Major airline.
What happened?
Reservation system crashes.
Thousands of flights delayed.
Impact
Lost revenue
Angry passengers
Operational disruption
Vulnerability
Administrator password reused from another breached website.
Diagnostic clues
Successful login from another country
Password used correctly
New administrator account created
Prevention
Unique passwords
MFA
Login alerts
Card 3 — Personal Savings
Victim
College student.
What happened?
Bank account emptied.
Impact
Financial loss
Identity theft
Vulnerability
Fake banking website captured username and password.
Diagnostic clues
Login from unfamiliar location
Password reset email
Transfer to unfamiliar account
Prevention
MFA
Verify URLs
Password manager
Passkeys
Card 4 — School
Victim
High school.
What happened?
Grades changed.
Impact
Academic integrity
Parent complaints
Vulnerability
Teacher password written on sticky note.(yes, this happened at HPA)
Diagnostic clues
Grade changes after school hours
Login from classroom computer (why are the dorms physically separate from the campus?)
No evidence of hacking software
Prevention
Password security
Automatic screen locking
Card 5 — City Water System
Victim
Municipal water utility.(check the news: this happened 7 times last week)
What happened?
Chemical settings unexpectedly changed.
Impact
Public safety
Service disruption (could be worse if a dam was opened)
Vulnerability
Remote access software left exposed with weak credentials.(look up SCADA)
Diagnostic clues
Remote login
Configuration changes
No physical intrusion
Prevention
VPN
MFA
Disable unnecessary remote access
Card 6 — Online Store
Victim
Small business.
What happened?
Customer credit cards stolen.
Impact
Fraud
Reputation damage
Vulnerability
Unpatched web server.(look up the US Army web hack)
Diagnostic clues
Web logs show exploit requests
Database queried unusually often
Prevention
Patch management
Web application firewall
Card 7 — Smart Home
Victim
Family.
What happened?
Security cameras accessed by strangers.
Impact
Privacy invasion
Vulnerability
Default administrator password never changed.
Diagnostic clues
Logins from overseas
New unknown device connected (could be tracking passwords, etc.)
Prevention
Change default passwords
Firmware updates
Card 8 — Factory
Victim
Manufacturing plant.
What happened?
Production stops (look up the stuxnet case)
Impact
Lost production (Uranium for nuclear weapons?)
Missed customer deadlines
Vulnerability
USB flash drive infected engineering computer (stuxnet, windows updates)
look up "air gapped computers"
Diagnostic clues
Malware appears immediately after USB insertion
Antivirus alert
Prevention
USB restrictions (Look up the Snowden case-how did he get data out?)
Endpoint protection (look up Tanium)
==================== Which part failed?
People
Technology
Process
Cybersecurity is almost never just about “hackers.” It usually involves weaknesses in one or more of those areas.
Threat: Something capable of causing harm.
Examples:
Hacker
Malware
Fire
Flood
Insider
Vulnerability
A weakness that a threat can exploit.
Examples:
Weak password
Unpatched software
Open Wi-Fi
Employee mistake
Exploit
The method used to take advantage of the vulnerability.
Examples:
Phishing email
SQL injection
Stolen password
Risk
The chance and consequence that a threat successfully exploits a vulnerability.
Easy mnemonic
TVER
Threat
Vulnerability
Exploit
Risk
Threat finds Vulnerability, uses an Exploit, creating Risk.
Another simple sentence is:
Threat + Vulnerability = Risk
with the understanding that the exploit is the mechanism connecting the two.
The CIA Triad
“What was really lost?”
Money
Grades
Medical records
Flights
Then map each answer to the CIA Triad:
Loss
CIA Property
Medical records unavailable
Availability
Grades changed
Integrity
Credit cards stolen
Confidentiality
Ransomware encrypts files
Availability
Hacker edits payroll
Integrity
Data leak
Confidentiality
Migrated from Apple Server Wiki. Original page ID: x3c5r5U5