#secwerewolf — Public Fediverse posts on home.social

As I just found the #SECWEREWOLF #SecurityGame
https://infosec.exchange/@realn2s/110071853623448036

Let me write some more about Security Games.

First:
Why do I consider them so important?

#InfoSec / #Cybersecurity is a topic which is often experienced as
* obstructive (the department of NO),
* unrealistic (they want WHAT? I can't work that way)
* complex (yesterday you told me it's ok),
* boring (SO many details),
and attached to fear (everybody does some stuff they either don't know if it is compliant or are aware that it is noncompliant).

At the same time security can't impose security and security is everyone's job.

Games help to address these issues.

If something is prohibited in a game, it's no problem. Either it's part of the game rules or you don't have to fear being noncompliant.

Games don't need to be realistic. Actually, being unrealistic at least on some dimensions is probably a core trait of a game.

As they don't need to be realistic you can reduce the complexity as needed.

A good game is fun and not boring :-).

And you don't need to fear the consequences. If I open attachment, execute everything, use my last name as password on all accounts, the whole infrastructure gets owned because of me,
I won't get fired.