Name
Title | ||
|---|---|---|
PenQuest: a gamified attacker/defender meta model for cyber security assessment and education |
Abstract | ||
|---|---|---|
Attacks on IT systems are a rising threat against the confidentiality, integrity, and availability of critical information and infrastructures. At the same time, the complex interplay of attack techniques and possible countermeasures makes it difficult to appropriately plan, implement, and evaluate an organization’s defense. More often than not, the worlds of technical threats and organizational controls remain disjunct. In this article, we introduce PenQuest, a meta model designed to present a complete view on information system attacks and their mitigation while providing a tool for both semantic data enrichment and security education. PenQuest simulates time-enabled attacker/defender behavior as part of a dynamic, imperfect information multi-player game that derives significant parts of its ruleset from established information security sources such as STIX, CAPEC, CVE/CWE and NIST SP 800-53. Attack patterns, vulnerabilities, and mitigating controls are mapped to counterpart strategies and concrete actions through practical, data-centric mechanisms. The gamified model considers and defines a wide range of actors, assets, and actions, thereby enabling the assessment of cyber risks while giving technical experts the opportunity to explore specific attack scenarios in the context of an abstracted IT infrastructure. We implemented PenQuest as a physical serious game prototype and successfully tested it in a higher education environment. Additional expert interviews helped evaluate the model’s applicability to information security scenarios. |
Year | DOI | Venue |
|---|---|---|
2020 | 10.1007/s11416-019-00342-x | Journal of Computer Virology and Hacking Techniques |
Keywords | Field | DocType |
Security model, Serious game, Education, Awareness, Game theory, Attack patterns, Controls, Malware, Intrusion detection | Information system,Attack patterns,Computer science,Computer security,Information technology,Information security,Game theory,Information technology management,Perfect information,Computer security model | Journal |
Volume | Issue | ISSN |
16 | 1 | 2263-8733 |
Citations | PageRank | References |
0 | 0.34 | 0 |
Authors | ||
5 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Robert Luh | 1 | 51 | 8.37 |
| Marlies Temper | 2 | 0 | 0.34 |
| Simon Tjoa | 3 | 180 | 20.01 |
| Sebastian Schrittwieser | 4 | 291 | 35.16 |
| Helge Janicke | 5 | 250 | 36.70 |