OWASP Top 10 Card Game - Revision history

SGU303: /* Game Overview */

2019-10-09T14:37:49Z

‎Game Overview

SGU303 at 22:42, 8 October 2019

2019-10-08T22:42:03Z

SGU303: /* Cards */

2019-10-08T20:52:08Z

‎Cards

SGU303 at 21:53, 4 October 2019

2019-10-04T21:53:20Z

SGU303 at 21:43, 4 October 2019

2019-10-04T21:43:14Z

SGU303: /* Card Attack / Defense Matrix */

2019-10-04T21:41:55Z

‎Card Attack / Defense Matrix

Hblankenship: /* Classifications */

2019-05-15T17:12:14Z

‎Classifications

SGU303: Edit

2019-05-03T23:58:39Z

Edit

SGU303: Edit

2019-04-27T14:27:51Z

Edit

SGU303: Edit

2019-04-24T16:55:36Z

Edit

@@ Line 3: / Line 3: @@
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
-| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
+| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
 ==Game Description==
@@ Line 23: / Line 23: @@
 Cybersecurity activities and training are frequently designed around the concept of red (attacking) and blue (defending) teams.
-| style="padding-left:25px;width:260px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |
+| valign="top" style="padding-left:25px;width:260px;border-right: 1px dotted gray;padding-right:25px;" |
 == What is the OWASP Top 10 Card Game? ==
@@ Line 49: / Line 49: @@
 GitHub - https://github.com/OWASP/Top-10-Card-Game/
-| style="padding-left:25px;width:260px;" valign="top" |
+| valign="top" style="padding-left:25px;width:260px;" |
 == What Type of Project is This? ==
@@ Line 75: / Line 75: @@
     {| width="200" cellpadding="2"
     |-
-    | align="center" width="50%" valign="top" rowspan="2" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
+    | width="50%" align="center" valign="top" rowspan="2" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
-    | align="center" width="50%" valign="top" | [[File:Owasp-builders-small.png|link=]]
+    | width="50%" align="center" valign="top" | [[File:Owasp-builders-small.png|link=]]
     |-
-    | align="center" width="50%" valign="top" | [[File:Owasp-defenders-small.png|link=]]
+    | width="50%" align="center" valign="top" | [[File:Owasp-defenders-small.png|link=]]
     |-
     | align="center" colspan="2" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
@@ Line 102: / Line 102: @@
 * Game Rules and Instructions
-The objective of the game is to take control of (PWN) your opponent’s three business websites while protecting your business websites. It is possible to knockout all three of your opponents TA attack websites. A primary requirement for the game is that it be designed around the standard set of playing cards so that the general public is familiar with the medium facilitating internationalization and that the play grid fit easily on the standard sized card table.
+The objective of the game is to take control of (PWN) your opponent’s three business websites while protecting your business websites. It is possible to knockout all three of your opponents TA attack websites. Primary requirements for the game are that it be designed around the standard set of playing cards so that the general public is familiar with the medium facilitating internationalization and that the play grid fit easily on the standard sized card table.
 The standard two player configuration includes one TA deck and one DC deck for each gamer. The Threat Agent (TA) deck includes two Joker cards that are used to represent a Phishing attack. This brings the TA’s deck to a total of 54 cards. The Defense Control (DC) deck also includes two joker cards that are used to represent White Hat defensive controls. This also brings the DC deck to a total of 54 cards.

@@ Line 3: / Line 3: @@
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
-| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
+| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
 ==Game Description==
@@ Line 23: / Line 23: @@
 Cybersecurity activities and training are frequently designed around the concept of red (attacking) and blue (defending) teams.
-| valign="top" style="padding-left:25px;width:260px;border-right: 1px dotted gray;padding-right:25px;" |
+| style="padding-left:25px;width:260px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |
 == What is the OWASP Top 10 Card Game? ==
@@ Line 49: / Line 49: @@
 GitHub - https://github.com/OWASP/Top-10-Card-Game/
-| valign="top" style="padding-left:25px;width:260px;" |
+| style="padding-left:25px;width:260px;" valign="top" |
 == What Type of Project is This? ==
@@ Line 75: / Line 75: @@
     {| width="200" cellpadding="2"
     |-
-    | width="50%" align="center" valign="top" rowspan="2" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
+    | align="center" width="50%" valign="top" rowspan="2" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
-    | width="50%" align="center" valign="top" | [[File:Owasp-builders-small.png|link=]]
+    | align="center" width="50%" valign="top" | [[File:Owasp-builders-small.png|link=]]
     |-
-    | width="50%" align="center" valign="top" | [[File:Owasp-defenders-small.png|link=]]
+    | align="center" width="50%" valign="top" | [[File:Owasp-defenders-small.png|link=]]
     |-
     | align="center" colspan="2" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
@@ Line 102: / Line 102: @@
 * Game Rules and Instructions
-The objective of the game is to take control of (PWN) your opponent’s three business websites while protecting your business websites. It is possible to knockout all three of your opponents TA attack websites. A primary requirement for the game is that it be designed around the standard set of playing cards so that the general public is familiar with the medium facilitating internationalization.
+The objective of the game is to take control of (PWN) your opponent’s three business websites while protecting your business websites. It is possible to knockout all three of your opponents TA attack websites. A primary requirement for the game is that it be designed around the standard set of playing cards so that the general public is familiar with the medium facilitating internationalization and that the play grid fit easily on the standard sized card table.
 The standard two player configuration includes one TA deck and one DC deck for each gamer. The Threat Agent (TA) deck includes two Joker cards that are used to represent a Phishing attack. This brings the TA’s deck to a total of 54 cards. The Defense Control (DC) deck also includes two joker cards that are used to represent White Hat defensive controls. This also brings the DC deck to a total of 54 cards.

@@ Line 23: / Line 23: @@
 Cybersecurity activities and training are frequently designed around the concept of red (attacking) and blue (defending) teams.
-| valign="top"  style="padding-left:25px;width:260px;border-right: 1px dotted gray;padding-right:25px;" |
+| valign="top" style="padding-left:25px;width:260px;border-right: 1px dotted gray;padding-right:25px;" |
 == What is the OWASP Top 10 Card Game? ==
@@ Line 49: / Line 49: @@
 GitHub - https://github.com/OWASP/Top-10-Card-Game/
-| valign="top"  style="padding-left:25px;width:260px;" |
+| valign="top" style="padding-left:25px;width:260px;" |
 == What Type of Project is This? ==
@@ Line 75: / Line 75: @@
     {| width="200" cellpadding="2"
     |-
-    | align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
+    | width="50%" align="center" valign="top" rowspan="2" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
-    | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
+    | width="50%" align="center" valign="top" | [[File:Owasp-builders-small.png|link=]]
     |-
-    | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
+    | width="50%" align="center" valign="top" | [[File:Owasp-defenders-small.png|link=]]
     |-
-    | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
+    | align="center" colspan="2" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
     |-
-    | colspan="2" align="center"  | [[File:Project_Type_Files_DOC.jpg|link=]]
+    | align="center" colspan="2" | [[File:Project_Type_Files_DOC.jpg|link=]]
     |}
@@ Line 172: / Line 172: @@
 TA card status:
-* Inactive – Offline rack bay.
+* Inactive – Offline rack bay (face down).
 * Active – Online and masked (face down).
 * Active – Online and unmasked/deprecated (face up).
-* Decommissioned – Offline rack bay.
+* Decommissioned – Offline rack bay (face up).
 There are three attack vector pathways. Each pathway includes three defense-in-depth controls that must be defeated:
@@ Line 420: / Line 420: @@
 | 11 || Stalemate || Similar to chess, it has been recommended that when a stalemate occurs, the game ends as a draw. || To be determined || Dennis Johnson
 <headertabs />
 [[Category:OWASP Project]]
 [[Category:OWASP_Document]]
 |}

@@ Line 291: / Line 291: @@
 ! Special Attack and Defense Rules
 |-
-| Observation Attack - If the TA site is not masked, the color of TA’s attacking card (A1 through A9) must match the color (red or black) of the TA’s attack site card. For example, an attacking unmasked TA Queen of Hearts (Red) can only use a Red (Diamond or Heart) attack (A1 through A9) card.
+| Observation Attack - If the TA site is not masked, the color of TA’s attacking card (A1 through A9) must match the color (red or black) of the TA’s attack site card. For example, an attacking unmasked TA Queen of Hearts (Red) may only use a Red (Diamond or Heart) attack (A1 through A9) card.
 |-
 | Assess Web Platform Technical Weaknesses Attack - If the TA site is not masked, the suit of the TA’s attacking card (A1 through A9) must match the suit (hearts, diamonds, spades, or clubs) of the defending DC site card.
 |-
-| PWN Attack - If the TA site is not masked, the attacking TA site (Queen or King) must match the face card (Queen or King) of the defending DC site card. An unmasked Jack may still attack any other face card.
+| PWN Attack - If the TA site is not masked, the attacking TA site (Queen or King) must match the face card (Queen or King) of the defending DC site card. An unmasked Jack may still attack any other face card. For example, an attacking unmasked TA Queen of Hearts may only launch a PWN attack against a DC Queen (Hearts, Diamond, Club or Spades).
 |}

@@ Line 291: / Line 291: @@
 ! Special Attack and Defense Rules
 |-
-| Observation Attack - If the TA site is not masked, the color of TA’s attacking card (A1 through A9) must match the color (red or black) of the TA’s attack site card. For example, an attacking unmasked TA Queen of Hearts (Red) can only use a Red (Diamond or Heart)attack (A1 through A9)card.
+| Observation Attack - If the TA site is not masked, the color of TA’s attacking card (A1 through A9) must match the color (red or black) of the TA’s attack site card. For example, an attacking unmasked TA Queen of Hearts (Red) can only use a Red (Diamond or Heart) attack (A1 through A9) card.
 |-
 | Assess Web Platform Technical Weaknesses Attack - If the TA site is not masked, the suit of the TA’s attacking card (A1 through A9) must match the suit (hearts, diamonds, spades, or clubs) of the defending DC site card.

@@ Line 262: / Line 262: @@
   || None ||    || User Education - Effective DC actions to blunt a phishing attack are limited.
 |-
-|| A10 || 10 || Logging & Monitoring - TAs rely on ineffective application runtime security logging, inconsistent operational data reviews, and the poor overall management of monitoring activities, coupled with weak responses by the DC team, to achieve their goals without being detected. This card represents additional malware that supports the attack card (A1 through A9). It is used during the attack phase. It is not a stand-alone attack card.  The A10 card may be added to support the TA’s attack card during the current or subsequent attack rounds. The A10 card can only be played during an Assess Web Platform Technical Weaknesses Attack or PWN Attack. The TA’s A10 card may be any color. ||  ||  ||
+|| A10 || 10 || Logging & Monitoring - TAs rely on ineffective application runtime security logging, inconsistent operational data reviews, and the poor overall management of monitoring activities, coupled with weak responses by the DC team, to achieve their goals without being detected. This card represents additional malware that supports the attack card (A1 through A9). It is used during the attack phase. It is not a stand-alone attack card.  The A10 card may be added to support the TA’s attack card during the current or subsequent attack rounds. The A10 card may only be played during an Assess Web Platform Technical Weaknesses Attack or PWN Attack. The TA’s A10 card may be any color. ||  ||  ||
 |-
 ||  ||  ||   || C9 || 9 || Logging and Monitoring - This card represents the effective logging and monitoring of the web platform’s operational data and application’s processing activities.

@@ Line 231: / Line 231: @@
 {| class="wikitable"
 |-
-! Attacks !! TA Playing Card !! TA Point of View !! Proactive DC !! DC Playing Card !! DC Concepts
+! Attacks !! TA Playing Card !! Threat Agent (TA) Point of View !! Proactive DC !! DC Playing Card !! Defense Control (DC) Concepts
 |-
 | A1 || Ace || Injection – TAs send simple text based data as part of a command or query that exploits the syntax rules of the targeted system’s interpreter. Many DC teams continue to allow the use of unsafe APIs and are lax in reviewing legacy code for injection flaws, keeping data separate from commands and limiting SQL injection mass disclosures. || C3 || 3 || Secure Database Access - Untrusted data and input is properly controlled and handled by database and platform authentication and communication controls.

@@ Line 53: / Line 53: @@
 == What Type of Project is This? ==
-The OWASP Top 10 Card Game is a documentation project that seeks to further overall OWASP goals and to raise awareness about application security. Spin-offs from this project may take any media form (e.g. CBT, videos, games, etc.) and are not limited to a print deliverable.
+The OWASP Top 10 Card Game is a documentation project that seeks to further OWASP goals and raise awareness about application security. Spin-offs from this project may take any media form (e.g. CBT, videos, games, etc.) and are not limited to a print deliverable.
 == Available Downloads ==
@@ Line 132: / Line 136: @@
 The Masked / Unmasked status (face down / face up) of the attacking and defending sites will affect the strength and weaknesses of the opposing sites (face cards).  Face down TA site cards may have more flexible attack options and may be more difficult to defense and face down DC site cards may limit some TA attacks or trigger additional TA workload counts. The following design, of an OWASP branded card set, was drafted during the initial proof of concept phase to provide how the cards might look.
-[[File:OWASP Game Card Sample.jpg| Sample of Card Fronts]]
+[[File:OWASP Game Card Sample Draft 2.jpg| Sample of Card Fronts]]
 ==Setup==