SUMMARY

A group of cybersecurity experts and game designers created this game for the Ford Foundation in 2022. They designed the game as a follow up to the session on Incident Response Plans.

Through playing this game, players will be thrust into a fast-paced environment where they will collaborate within teams to hammer out a detailed incident response plan. The goal of the game is two-fold:

1. To familiarize players intimately with the six steps of an incident response plan.

2. To highlight that the more detailed and meticulous a plan is, the better it is. It is easier to have too many items (and skip some if the incident doesn't require them) rather than having to come up with new plans after an incident has occurred.

RUN YOUR OWN GAME

The game works best when there are two facilitators. The first (lead) facilitator will lead the activity, call upon teams to answer, and make sure the answers make sense. The second (assistant) facilitator is simply in charge of typing up the answers as they come in from the teams. 

The game itself takes about 30 minutes to complete, but we recommend spending 10-15 minutes reviewing the basics of incident response plan basics (plus examples) to warm people up before starting the game.

The instructions below assume that you will be running the game over Zoom, but if you are using a different platform, please feel free to adjust the language accordingly.

Steps to run your own game:

1. Make a copy of the Google Slides deck. Use this slide deck to run the game.

2. Important: When you share your screen on Zoom, do not use hit the ▶️ Slideshow to start a full-screen slideshow. Instead, stay in editing mode and share just the portion of your screen that shows the slides. This is necessary so that the diagram/map on slide 10 is updated live as you or your assistant facilitator types in the answers.

3. Review incident response plan basics. Examples are helpful (slides 3-4).

4. Explain the rules (slide 6) and introduce the scenario.

5. Break the group up into different Zoom breakout rooms/teams. Ask each breakout room/team to assign a notetaker within their respective teams.

6. For ten minutes, within the breakout rooms, have people come up with as many action items (actions, methods, frameworks and lessons learned) in an incident response plan as they can (slide 8).

7. Gather everyone back into one Zoom session. Go around the teams and have the notetaker from each team says aloud one item from their plan. But be warned: each item must be new and not a repeat of what other teams have said.

8. After two rounds (in other words, after every team has given two items), have a team roll a die for surprise injects that makes minor changes to the rules of the game (slide 11).

9. After applying the inject, return to the table (slide 10) and continue asking teams to give items from their plans.

10. After another two rounds, go to the injects again.

11. Repeat this "two rounds, one inject, two rounds, one inject" cycle until teams start running out of items to give. When a team runs out of items, they lose.

12. The last team standing wins (slide 12)!