Difference between revisions of "OWASP Cornucopia"

It is possible to play Cornucopia in many different ways. Here is one way.

A - Preparations

A1. Print a Cornucopia deck and separate/cut out the cards

A2. Identify an application or application process to review; this might be a concept, design or an actual implementation

A3. Create a data flow diagram

A4. Identify and invite a group of 3-6 architects, developers, testers and other business stakeholders together and sit around a table (try to include someone fairly familiar with application security)

A5. Have some prizes to hand (gold stars, chocolate, pizza, beer or flowers depending upon your office culture)

B - Play

One suit - Cornucopia - acts as trumps. Aces are high (i.e. they beat Kings). It helps if there is someone dedicated to documenting the results who is not playing.

B1. Remove the Jokers and a few low-score (2, 3, 4) cards from Cornucopia suit to ensure each player will have the same number of cards

B2. Shuffle the pack and deal all the cards

B3. To begin, choose a player randomly who will play the first card - they can play any card from their hand except from the trump suit - Cornucopia

B4. To play a card, each player must read it out aloud, and explain how (or not) the threat could apply (the player gets a point for attacks that work, and the group thinks it is an actionable bug) - don’t try to think of mitigations at this stage, and don’t exclude a threat just because it is believed it is already mitigated - someone record the card on the score sheet

B5. Play clockwise, each person must play a card in the same way; if you have any card of the matching lead suit you must play one of those, otherwise they can play a card from any other suit. Only a higher card of the same suit, or the highest card in the trump suit Cornucopia, wins the hand.

B6. The person who wins the round, leads the next round (i.e. they play first), and thus defines the next lead suit

B7. Repeat until all the cards are played

C - Scoring

The objective is to identify applicable threats, and win hands (rounds):

C1. Score +1 for each card you can identify as a valid threat to the application under consideration

C2. Score +1 if you win a round

C3. Once all cards have been played, whoever has the most points wins

D - Closure

D1. Review all the applicable threats and the matching security requirements

D2. Create user stories, specifications and test cases as required for your development methodology

Alternative game rules:

• If you are new to the game, remove the two Joker cards to begin with. Add the Joker cards back in once people become more familiar with the process. Apart from the “trumps card game” rules described above which are very similar to the EoP, the deck can also be played as the “twenty-one card game” (also known as “pontoon” or “blackjack”) which normally reduces the number of cards played in each round.
• Practice on an imaginary application, or even a future planned application, rather than trying to find fault with existing applications until the participants are happy with the usefulness of the game.
• Consider just playing with one suit to make a shorter session – but try to cover all the suits for every project. Or even better just play one hand with some pre-selected cards, and score only on the ability to identify security requirements. Perhaps have one game of each suit each day for a week or so, if the participants cannot spare long enough for a full deck.
• Some teams have preferred to play a full hand of cards, and then discuss what is on the cards after each round (instead of after each person plays a card).
• You can even play by yourself. Just use the cards to act as thought-provokers. Involving more people will be beneficial though.

Can I copy or edit the game?

Yes of course. All OWASP materials are free to do with as you like provided you comply with the Creative Commons Attribution-ShareAlike 3.0 license. Perhaps if you create a new version, you might donate it to the OWASP Cornucopia Project?

How can I get involved?

Please send ideas or offers of help to the project’s mailing list.

How were the attackers’ names chosen?

EoP begins every description with words like "An attacker can...". These have to be phrased as an attack but I was not keen on the anonymous terminology, wanting something more engaging, and therefore used personal names. These can be thought of as external or internal people or aliases for computer systems. But instead of just random names, I thought how they might reflect the OWASP community aspect. Therefore, apart from "Alice and Bob", I use the given (first) names of current and recent OWASP employees and Board members (assigned in no order), and then randomly selected the remaining 50 or so names from the current list of paying individual OWASP members. No name was used more than once, and where people had provided two personal names, I dropped one part to try to ensure no-one can be easily identified. Names were not deliberately allocated to any particular attack, defence or requirement. The cultural and gender mix simply reflects theses sources of names, and is not meant to be world-representative.

Why aren’t there any images on the card faces?

There is quite a lot of text on the cards, and the cross-referencing takes up space too. But it would be great to have additional design elements included. Any volunteers?

Are the attacks ranked by the number on the card?

Only approximately. The risk will be application and organisation dependent, due to varying security and compliance requirements, so your own severity rating may place the cards in some other order than the numbers on the cards.

How long does it take to play a round of cards using the full deck?

This depends upon the amount of discussion and how familiar the players are with application security concepts. But perhaps allow 1.5 to 2.0 hours for 4-6 people.

Volunteers

Cornucopia is developed by a worldwide team of volunteers. The primary contributors to date have been:

• Ken Ferris
• Colin Watson

Sponsors

But we have also been helped by many organizations, either financially or by encouraging their employees to work on Cornucopia:

• OWASP Federation
• Watson Hall Ltd

Others

• Microsoft SDL Team for the Elevation of Privilege Threat Modelling Game, published under a Creative Commons Attribution license, as the inspiration for Cornucopia and from which many ideas, especially the game theory, were copied.
• Keith Turpin and contributors to the “OWASP Secure Coding Practices - Quick Reference Guide”, originally donated to OWASP by Boeing, which is used as the primary source of security requirements information to formulate the content of the cards.
• Contributors, supporters, sponsors and volunteers to the OWASP ASVS, AppSensor and Web Framework Security Matrix projects, Mitre’s Common Attack Pattern Enumeration and Classification (CAPEC), and SAFECode’s “Practical Security Stories and Security Tasks for Agile Development Environments” which are all used in the cross-references provided.
• Playgen for providing an illuminating afternoon seminar on task gamification, and tartanmaker.com for the online tool to help create the card back pattern.

As of September 2013, the priorities are:

• Create and publish the Secure Coding Practices Quick Reference Guide identities used in the cross-referencing [Completed 10 May 2013]
• Build these project wiki pages out [Completed 19 May 2013]
• Include darker card yellow, green and grey colours, custom decks and cutting lines [Completed 12 June 2013, and updated further 18 September 2013]
• Update the document/deck to shorten some card text
• Map to OWASP T10 2013 and ASVS v2
• Translate into Spanish and other languages
• Source funding for graphical design
• Promote use of Cornucopia

Involvement in the development and promotion of Cornucopia is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:

Localization

Are you fluent in another language? Can you help translate Cornucopia into that language?

Design

Do you have a flair for innovative design and have the skills to create print-ready materials? We desperately need the cards to be worked up into a more attractive format. Let us know if you can offer your help.

Use and Promote the Cornucopia Card Decks

Please help raise awareness of Cornucopia by printing cards:

• Use Cornucopia with specifiers, architects, designers, developers, testers and others, in part to train them, but also to solicit feedback on their usability, practicality and appropriateness for their work
• Create video about how to play the game
• Develop a mobile app to play the game

Feedback

Please use the friendly project mailing list for feedback:

• What do like?
• What don't you like?
• What cards don't make sense?
• How could the guidance be improved?
• What other decks would you like to see?

Keep the Cards Updated

As the source referenced documents change, we have to update the decks. You may also find errors and omissions. In the first instance, please send a message to the friendly project mailing list if you have identified errors & omissions, have some time to maintain the source documents, or can help in other ways.

Create a New Deck

The only version currently available is the Cornucopia Ecommerce Website Edition in English. We would like to create a new mobile app specific deck, probably using the wonderful OWASP Mobile Security Project as inspiration for the card source materials. Do you have an idea for your own application security requirements card deck? Perhaps for mobile apps or something else?