Коллеги из финского интегратора Nixu опубликовали " Nixu hACME social engineering playing cards ". Их можно использовать для игр - обучения по ИБ. Это хороший пример правильного повышения осведомленности для сотрудников и забавная тренировка (мозговой штурм) для пентестеров.
We created a social engineering game for practicing different psychological scenarios to help people to be more resistant and aware of social engineering attacks as they are a reality and are happening all the time, online and in real life.Всего в игре используются 39 карт 4 типов (2 для жертвы и 2 для атакующего):
The aim of the game is to demonstrate to people how possible is to create a tailored attacks for a specific victims when using information publicly available. Learning how these attacks can be created, help people to understand how can you be more resistant to these attacks.
- Victim card (роль/должность жертвы)
- Personality Traits (личностные качества жертвы)
- Mission card (задача атакующего)
- Attacker card (навыки и сильные сторон атакующего)
А сама игра происходит в паре Жертва-Атакующий в виде мозгового штурма, "как бы это происходило на самом деле". Очков нет, победителя нет, суть в отработке сценария и повышения осведомленности...
Okay, I printed the cards. Now what?
The main steps are:1. The victim picks an occupation role and 2 personality cards.
2. Based on the cards picked, the victim will fill in the Victim's notes that include a collection of publicly available information, it is called the Social Footprint.
3. The attacker learns the occupation of the victim and decides what kind of attacker skills you will have.
4. The attacker investigates the victim's social footprint and plans an attack.
5. The attacker finally meets the victim and performs its attack, improvising and changing his strategy as the attack is performed.
6. The best attacker/victim pair wins! This way, attacker and victim are really focused on helping each other as the points based on how well they perform during the game.
How to win the game? Points are collected in pairs. There is no attacker vs. victim scores for this game, otherwise, nobody would learn anything. The victim helps the attacker to perform a better attack, the attacker helps the victim to provide good information about the character. Working together, the learning is increased.
В общем, штука забавная, попробуйте.
P.S. Если сделаете перевод карточек на русский, то пришлите, я опубликую.