Privacy & oversharing
What you publish about your work, and what an attacker can build from it.
A photo of a new desk setup, an out-of-office naming your stand-in, a public org chart — each is harmless, and together they are a script for a convincing pretext.
Would you get these right?
Real items, not examples written for a brochure — these are the same 7 questions the games draw on for this topic. Answer one and see what a player sees.
Publishing your role, team and tools on a public profile
Assume it will be used to write a convincing message to you
Assume it will be used to write a convincing message to you
None of it needs hiding, and all of it will be used. Knowing that is what makes a well-researched message feel suspicious rather than reassuring.
RememberExpect the pretext to know who you are.
A team photo with a whiteboard behind it
Check the background before posting
Check the background before posting
Roadmaps, architecture, names and door codes all get published by accident this way. Attackers read your social feed precisely because it is unguarded.
RememberThe background is part of the post.
Posting a photo of your desk with the whiteboard behind you
Roadmaps, names, ticket numbers and screens end up in the background of a friendly photo, and they are exactly the raw material a convincing pretext is built from.
RememberCheck what is behind you before you post.
6 games carry this topic
The same material, in whichever game your people will actually open. That is the whole design: the lesson is content, so it is not tied to one set of rules.
Threat & Defence Match
Match every risk to the habit that beats it.
Link each risk to the habit that defeats it, so the defence comes to mind with the threat.
Cyber Hygiene Run
Dodge the risky habit. Pick up the safe one.
Build the reflex to take the secure option and step around the risky one, at speed.
Spot the Threat
Judge it in the two seconds you actually get.
Tell a hostile message from a genuine one in the two seconds you actually get.
Threat Range
Report the threats. Let real mail through.
Judge before you act: report the real threats and leave legitimate messages alone.
Security Scenarios
What would you actually do?
Choose the right response to the security situations that actually come up at work.
Cyber Tambola
Dab the control that stops the call.
Know which control stops which attack, and know when a threat is not yours to act on.