Cyber Siege is a turn-based strategy game where players take on the role of either the Red Team (attackers) or Blue Team (defenders) in a cyber security scenario.
Your goal is to progress through the kill chain and reach the COMPROMISED state before Blue Team can detect and respond to 10 alerts.
Your goal is to detect and respond to 5 alerts before the Red Team reaches the COMPROMISED state.
The Red Team progresses through the MITRE ATT&CK framework stages:
The game board represents a network with different types of nodes:
Critical infrastructure with valuable data
Store sensitive information and records
User workstations and computers
Network infrastructure connecting nodes
Each node has two key attributes:
Red Team has different attack options based on their current stage in the kill chain. Each attack generates an alert for the Blue Team.
If Blue Team fails to properly respond to an alert, Red Team advances to the next stage of the kill chain.
Phishing attacks are most effective against endpoints. Successfully phishing an unprotected endpoint will advance Red Team in the kill chain.
When Blue Team successfully mitigates an attack, Red Team is pushed back one stage in the kill chain.
Red Team wins by reaching the final stage (COMPROMISED) of the kill chain.
Blue Team must choose the appropriate response based on the alert severity (low, medium, high).
Choosing an inappropriate response will allow Red Team to advance in the kill chain and result in point penalties.
Blue Team can isolate compromised systems by selecting a node and using the "Isolate System" action. This takes the system offline and pushes Red Team back in the kill chain.
Do not Isolate more than 3 customers as this will cause significant impact on the business making you lose the game.
Blue Team wins by successfully detecting and responding to 10 alerts before Red Team reaches the COMPROMISED state.
Alerts have three severity levels, and each requires an appropriate response:
Early-stage reconnaissance or minor suspicious activity.
Potential exploitation attempts or suspicious execution.
Active exploitation, data exfiltration, or critical system compromise.