3 ms·

Reading the title and before I saw the link, I thought this was referring to games like Armored Brigade or Red Dragon (always be reconning, find a weakness to e

Reading the title and before I saw the link, I thought this was referring to games like Armored Brigade or Red Dragon (always be reconning, find a weakness to exploit, execute, or conversely stop enemy recon and conceal your weaknesses). Both kinds of wargame require a similar process to be successful, even though OTW's wargames are more relevant to computer security (and a great place for beginners to start! Highly recommended).

astrobe_ 5y ago
"conceal your weaknesses"... Wouldn't it be "security by obscurity" ? I didn't play those games, but I expect at least one introduces the idea of defense in depth. A tower defense game, for instance.
azalemeth 5y ago
They're really fun – thanks for sharing the names of some others. Although I'm not "new" I hadn't encountered OverTheWire before. The first one is indeed a gentle introduction, but I think the difficulty does then increase. I got through all of leviathan using radare2 (which, frankly, I feel like I am still scratching the surface of) and reading the passwords out of registers. After finishing it, I googled for others' solutions, and found very creative -- and totally different -- solutions to the same puzzles, almost none of which involved something like gdb or r2 at all. They very much feel like the traditional "book of Christmas puzzles", but for the HN audience that likes solving them interactively.
- indigochill 5y ago
  Well, the ones I named are more "wargames" in the traditional sense: tanks and planes and stuff. But as I mentioned, the principles of reconnaissance and exploiting weaknesses are the same, which is interesting. For more computer-oriented wargames, I really enjoyed what I've done of Microcorruption (if you're into radare2 sort of stuff) and wechall is a challenge site tracker that has links to many other similar games as well as being a scoreboard that you can track your progress on all participating sites on. Or if you like competition, CTFtime.org is a live calendar of many computer security capture-the-flag competitions you can join. If you're interested in that but want to join a team, OpenToAll is a team that welcomes anyone to join and talk about challenges.
openasocket 5y ago
The actual term of war gaming dates back to the 19th century, where generals would simulate battles or campaigns to practice and determine the viability of strategies. Modern militaries will conduct war games (distinct from military exercises, though sometimes both are done together) involving dozens of people on each side. I actually think that would be pretty cool to try and implement for cybersecurity, having multiple people working together as an APT group, or a security operations team. Especially if you have both sides competing against each other. I imagine that would be really difficult to implement, making it realistic while not having it take months to play.
- mcguire 5y ago
  There are certainly such games existing, although I can't recall any particular cybersecurity games offhand. One resource for more entertainment games is the megagaming thing (https://megagamecoalition.com/ https://megagamecoalition.com/ is a starting point): "Megagames combine the physical mechanics of board games with the fluid emergent gameplay of role‐playing games at large player counts (40‐80 players). Players are encouraged to be creative but must act within the existing game mechanics and established setting. Megagames range in time length, ranging from two hours to entire weekends. A team of moderators (Control) coordinate the game, adjudicate rules, and make sure players have the best experience possible!" Another semi-professional ("Professional games" being run by the DoD or various militaries for training or analysis.) option is the National Security Decision Making Game (https://paxsims.wordpress.com/2011/05/20/the-national-security-decision-making-game/ https://paxsims.wordpress.com/2011/05/20/the-national-securi...). Pre-COVID, they ran a pandemic game several times that was at least somewhat prescient. Oh, and I'd be remiss to not mention the Connections group of conferences (One or more on every continent except Antarctica, I think.) (https://connections-wargaming.com/ https://connections-wargaming.com/) They have discussions primarily of professional games, but topics like megagaming, cybersecurity, and the NSDMG are common---it's open to anyone who wants to take gaming seriously. There will be a (free!) Connections Online in Summer 2022; strongly recommended. The History of Wargaming Project (http://www.wargaming.co http://www.wargaming.co) has branched out to print several books on cybersecurity gaming. Naturally I can't get to their website now, but a couple are The Handbook of Cyber Wargames (https://www.amazon.com/gp/product/B086WMMYS4/ref=dbs_a_def_rwt_bibl_vppi_i43 https://www.amazon.com/gp/product/B086WMMYS4/ref=dbs_a_def_r...) and Dark Guest (https://www.amazon.com/gp/product/B00J3OVJXG/ref=dbs_a_def_rwt_bibl_vppi_i81 https://www.amazon.com/gp/product/B00J3OVJXG/ref=dbs_a_def_r...) There's a giant rabbit hole here if you're interested.

astrobe_ 5y ago

"conceal your weaknesses"... Wouldn't it be "security by obscurity" ? I didn't play those games, but I expect at least one introduces the idea of defense in depth. A tower defense game, for instance.

azalemeth 5y ago

They're really fun – thanks for sharing the names of some others. Although I'm not "new" I hadn't encountered OverTheWire before. The first one is indeed a gentle introduction, but I think the difficulty does then increase. I got through all of leviathan using radare2 (which, frankly, I feel like I am still scratching the surface of) and reading the passwords out of registers. After finishing it, I googled for others' solutions, and found very creative -- and totally different -- solutions to the same puzzles, almost none of which involved something like gdb or r2 at all. They very much feel like the traditional "book of Christmas puzzles", but for the HN audience that likes solving them interactively.

indigochill 5y ago
Well, the ones I named are more "wargames" in the traditional sense: tanks and planes and stuff. But as I mentioned, the principles of reconnaissance and exploiting weaknesses are the same, which is interesting. For more computer-oriented wargames, I really enjoyed what I've done of Microcorruption (if you're into radare2 sort of stuff) and wechall is a challenge site tracker that has links to many other similar games as well as being a scoreboard that you can track your progress on all participating sites on. Or if you like competition, CTFtime.org is a live calendar of many computer security capture-the-flag competitions you can join. If you're interested in that but want to join a team, OpenToAll is a team that welcomes anyone to join and talk about challenges.

openasocket 5y ago

The actual term of war gaming dates back to the 19th century, where generals would simulate battles or campaigns to practice and determine the viability of strategies. Modern militaries will conduct war games (distinct from military exercises, though sometimes both are done together) involving dozens of people on each side. I actually think that would be pretty cool to try and implement for cybersecurity, having multiple people working together as an APT group, or a security operations team. Especially if you have both sides competing against each other. I imagine that would be really difficult to implement, making it realistic while not having it take months to play.

mcguire 5y ago
There are certainly such games existing, although I can't recall any particular cybersecurity games offhand. One resource for more entertainment games is the megagaming thing (https://megagamecoalition.com/ https://megagamecoalition.com/ is a starting point): "Megagames combine the physical mechanics of board games with the fluid emergent gameplay of role‐playing games at large player counts (40‐80 players). Players are encouraged to be creative but must act within the existing game mechanics and established setting. Megagames range in time length, ranging from two hours to entire weekends. A team of moderators (Control) coordinate the game, adjudicate rules, and make sure players have the best experience possible!" Another semi-professional ("Professional games" being run by the DoD or various militaries for training or analysis.) option is the National Security Decision Making Game (https://paxsims.wordpress.com/2011/05/20/the-national-security-decision-making-game/ https://paxsims.wordpress.com/2011/05/20/the-national-securi...). Pre-COVID, they ran a pandemic game several times that was at least somewhat prescient. Oh, and I'd be remiss to not mention the Connections group of conferences (One or more on every continent except Antarctica, I think.) (https://connections-wargaming.com/ https://connections-wargaming.com/) They have discussions primarily of professional games, but topics like megagaming, cybersecurity, and the NSDMG are common---it's open to anyone who wants to take gaming seriously. There will be a (free!) Connections Online in Summer 2022; strongly recommended. The History of Wargaming Project (http://www.wargaming.co http://www.wargaming.co) has branched out to print several books on cybersecurity gaming. Naturally I can't get to their website now, but a couple are The Handbook of Cyber Wargames (https://www.amazon.com/gp/product/B086WMMYS4/ref=dbs_a_def_rwt_bibl_vppi_i43 https://www.amazon.com/gp/product/B086WMMYS4/ref=dbs_a_def_r...) and Dark Guest (https://www.amazon.com/gp/product/B00J3OVJXG/ref=dbs_a_def_rwt_bibl_vppi_i81 https://www.amazon.com/gp/product/B00J3OVJXG/ref=dbs_a_def_r...) There's a giant rabbit hole here if you're interested.