TULiPS

Technology Usability Lab in Privacy and Security

Research Publications People Student Projects Wiki Outreach

Security Games

Collection of free-to-use educational security games.

The collection below is currated by the TULIPS group and features both our own games and games designed by other labs and organizations. We make no guarentees about the content, but if you find a problem please contact us to let us know.

Adam Shostack also maintains a list of tabletop security games.

Firewall

Blue Team (TULIPS)

Difficulty: Medium - some networking knowledge

Teaches the basic idea behind firewall administration on a network. The aim of the game is to set up firewall rules in different scenarios, in order to teach the player about iptables syntax, and attack logs from IDS.

Firewall simulator as a WebApp (TULIPS)

Difficulty: Hard - existing iptables knowledge needed

Firewall simulator where a user can setup a firewall on the "insider" terminal and then test it by attacking from the "outsider" terminal.

Permission Impossible (TULIPS)

Difficulty: Novice - anyone can play

Teaches novices about basic firewall terminology and concepts as well as how to build a firewall rule set to enable incoming and outgoing packet traffic.

General

Data Center Attack (Trend Micro)

Difficulty: Novice - anyone can play

A choose-your-own adventure style game where you play the role of a Chief Information Security Officer (CISO) making decisions for a hospital. Game starts out with a worst case scenario and then rolls back time so you can play the main character as they attempt to setup security for the hospital.

Networking

CS4G Netsim

Difficulty: Novice - anyone can play

Simulator game intended to teach the basics of how computer networks functions. With an emphasis on security. You will learn to perform attacks that real hackers use and see how they work in our simulator.

Table Top

Cards Against Identity (BSPK)

Difficulty: Medium - computer science experience recommended

Unofficial version of Cards Against Humanity. It focuses on the world of Internet identity. 'If you want to know what the new password requirements will be, or you know the feeling of accidentally hitting your security token in the middle of a sentence, or you just want to blame everything on multi-factor authentication, this card set is for you. It's full of industry jokes and references that your normal friends probably won't understand.'

Control-Alt-Hack (not free) (University of Washington)

Difficulty: Novice - anyone can play

Mission-based card game where each person plays a different type of hacker such as a 'Network Ninja' or a 'Social Engineer' to accomplish different jobs.

Decisions & Disruptions (Lancaster University)

Difficulty: Novice - anyone can play, game master needs some general security knowledge

Role-playing game about security in industrial control systems. D-D players are tasked with managing the security of a small utility company: they are given a budget that they can spend among different defensive options. Played with 3 to 5 players plus a Game Master who directs the players.

Elevation of Privilege (EoP) Threat Modeling Card Game (Microsoft)

Difficulty: Advanced - intended for software developers who have an existing code base

Easy way to get started threat modeling. It is a card game that developers, architects or security experts can play.

Hack On Hackers (TULiPS)

Difficulty: Medium - computer science experience recommended

Card game where each player must manage a personal computer which hosts services (make money) and defend their network (costs money). Players then try and take down rivals by playing well known attacks against them, and they defend by correctly identifing how to prevent the attack.

d0X3d!

Difficulty: Novice - anyone can play

Board Game focused on computer network layous. Players attempt to collect resources off of various servers on a network while the system administrator keeps patching the nodes. You can download and print your own copy or buy it as a standard board game.