Security breach game

~~Migration~~This is all about real people losing things that matter

Each group of 3–4 students gets one scenario card and answers four questions:

What happened? (the impact) How did they get in? (the vulnerability) What clue would tell us? (diagnostic evidence/logs)How could it have been prevented? (defense)

The Security Breach Cards

Card 1 — Hospital

Victim
A regional hospital.

What happened?
Doctors cannot access patient records.
Surgeries are delayed.
Ambulances are diverted.

Impact

Patient safety Financial loss Public trust

Vulnerability
Employees clicked a phishing email containing ransomware.(dancing cats?)

Diagnostic clues

Files suddenly renamed Computers display ransom notes Security logs show one employee account accessed hundreds of files

Prevention

Email filtering Employee training Offline backups Multi-factor authentication

Card 2 — Airline

Victim
Major airline.

What happened?
Reservation system crashes.
Thousands of flights delayed.

Impact

Lost revenue Angry passengers Operational disruption

Vulnerability
Administrator password reused from another breached website.

Diagnostic clues

Successful login from another country Password used correctly New administrator account created

Prevention

Unique passwords MFA Login alerts

Card 3 — Personal Savings

Victim
College student.

What happened?
Bank account emptied.

Impact

Financial loss Identity theft

Vulnerability
Fake banking website captured username and password.

Diagnostic clues

Prevention

MFA Verify URLs Password managerPasskeys

Card 4 — School

Victim
High school.

What happened?
Grades changed.

Impact

Academic integrity Parent complaints

Vulnerability
Teacher password written on sticky note.(yes, this happened at HPA)

Diagnostic clues

Grade changes after school hours Login from classroom computer (why are the dorms physically separate from the campus?) No evidence of hacking software

Prevention

Password security Automatic screen locking

Card 5 — City Water System

Victim
Municipal water utility.(check the news: this happened 7 times last week)

What happened?
Chemical settings unexpectedly changed.

Impact

Public safety Service disruption (could be worse if a dam was opened)

Vulnerability
Remote access software left exposed with weak credentials.(look up SCADA)

Diagnostic clues

Remote login Configuration changes No physical intrusion

Prevention

VPN MFA Disable unnecessary remote access

Card 6 — Online Store

Victim
Small business.

What happened?
Customer credit cards stolen.

Impact

Fraud Reputation damage

Vulnerability
Unpatched web server.(look up the US Army web hack)

Diagnostic clues

Web logs show exploit requests Database queried unusually often

Prevention

Patch management Web application firewall

Card 7 — Smart Home

Victim
Family.

What happened?
Security cameras accessed by strangers.

Impact

Privacy invasion

Vulnerability
Default administrator password never changed.

Diagnostic clues

Logins from overseas New unknown device connected (could be tracking passwords, etc.)

Prevention

Change default passwords Firmware updates

Card 8 — Factory

Victim
Manufacturing plant.

What happened?
Production stops (look up the stuxnet case)

Impact

Lost production (Uranium for nuclear weapons?) Missed customer deadlines

Vulnerability
USB flash drive infected engineering computer (stuxnet, windows updates)

look up "air gapped computers"

Diagnostic clues

Malware appears immediately after USB insertion Antivirus alert

Prevention

USB restrictions (Look up the Snowden case-how did he get data out?)Endpoint protection (look up Tanium)

==================== Which part failed?

People Technology Process

Cybersecurity is almost never just about “hackers.” It usually involves weaknesses in ~~progress~~one ~~for~~or more of those areas.

Threat: Something capable of causing harm.

Examples:

Hacker Malware Fire Flood Insider

Vulnerability

A weakness that a threat can exploit.

Examples:

Weak password Unpatched software Open Wi-Fi Employee mistake

Exploit

The method used to take advantage of the vulnerability.

Examples:

Phishing email SQL injection Stolen password

Risk

The chance and consequence that a threat successfully exploits a vulnerability.

Easy mnemonic

TVER

Threat
Vulnerability
Exploit
Risk

Threat finds Vulnerability, uses an Exploit, creating Risk.

Another simple sentence is:

Threat + Vulnerability = Risk

with the understanding that the exploit is the mechanism connecting the two.

The CIA Triad

“What was really lost?”

Money Grades Medical records Flights

Then map each answer to the CIA Triad:

Loss	CIA Property
Medical records unavailable	Availability
Grades changed	Integrity
Credit cards stolen	Confidentiality
Ransomware encrypts files	Availability
Hacker edits payroll	Integrity
Data leak	Confidentiality

Migrated from Apple ~~Wiki~~Server Wiki. Original page ~~x3c5r5U5.~~ID: x3c5r5U5