Cyber Wargaming: Finding, Designing, and Playing Wargames for Cyber Security Education
Total Page：16
File Type：pdf, Size：1020Kb
Cyber Wargaming: Finding, Designing, and Playing Wargames for Cyber Security Education Andreas Haggman Submitted to Royal Holloway, University of London for the award of Doctor of Philosophy in Information Security Supervised by Professor Keith Martin Professor Klaus Dodds February 2019 1 Declaration of authorship I, Andreas Haggman, hereby declare that this thesis and the work presented in it is entirely my own. Where I have consulted the work of others, this is always clearly stated. Signed: Date: 2 Abstract This thesis investigates, and contributes to, the use of wargaming in cyber security education. Wargaming has a rich history of pedagogic use, but little work exists that addresses the critically important subject of cyber security. Cyber security is a global problem that frequently makes news headlines, yet the field is dogged with a reputation as a domain only for technologists, when in fact cyber security requires a whole gamut of approaches to be properly understood. The thesis is broadly divided into three parts. The first part is a comprehensive literature review of wargaming scholarship, analysing the benefits and drawbacks of wargaming, and some of the justifications for why a tabletop boardgame may be more effective than a game enhanced by technology. Following on from this, the thesis provides an outline of current work in cyber wargaming by analysing existing games, evaluating their contributions as educational tools, and identifying successful game mechanics and components. The second part of the thesis outlines the design process of an original wargame created for cyber security education and awareness training. The analysis outlines what the game design intends to achieve in terms of pedagogical outcomes and how the design evolved through the development process. In this part some methodological considerations around the research are also analysed, including how the thesis uses grounded theory and ethnography as academic underpinnings, and issues around the researcher’s positionality during fieldwork. The final part of the thesis reports on the deployment of the original game to a wide variety of organisations. Both quantitative and qualitative data is analysed to ascertain what players learned from playing the game and evaluates the effectiveness of the game by comparing it to previous theoretical findings. Finally, the researcher's experiences of conducting the thesis are evaluated with close reference to the identified methodological considerations. 3 Acknowledgements I want to acknowledge the stimulating and supportive Centre for Doctoral Training in Cyber Security at Royal Holloway, University of London (funded by the EPSRC and the UK government (EP/K035584/1)). The CDT is an amazing programme and I am proud to have been a part of it. Thanks to Tom Mouat and Rob Black for helping arrange and take part in some of the most valuable game sessions; to Thorsten Kodalle for making possible one of the most incredible experiences of my professional life; and to Simon Shiu for believing in the research at its earliest stages. This thesis has been far from ordinary in many ways, and enormous thanks goes to my supervisors Klaus Dodds and Keith Martin for enduring more trials and tribulations than could reasonably be expected. Their advice and guidance has been nothing short of invaluable. Thanks to all the participants who played the game, whom I regret I cannot thank individually in these pages, but especially to my peers at Royal Holloway who contributed to early playtesting sessions when the game was, frankly, rubbish. Without their input the game would not be what it is today. Thanks to Kim Burchill for casting her expert eye over the final drafts to pick out my spelling and grammar errors. Thanks also to my parents for their nurture and care. Who knew lilla gubben would end up writing a PhD thesis?! Finally, on a personal level, my eternal gratitude goes to my partner Ellie, without whose support and understanding none of this would have been possible. Andreas Haggman Twickenham, February 2019 4 Table of Contents DECLARATION OF AUTHORSHIP 2 ABSTRACT 3 ACKNOWLEDGEMENTS 4 LIST OF FIGURES 8 LIST OF TABLES 9 CHAPTER 1: INTRODUCTION – WHY CYBER WARGAMING? 10 1.1 MOTIVATION 11 1.2 A DEARTH OF CYBER GAMES 12 1.3 GENESIS OF THE THESIS 14 1.4 THESIS STRUCTURE 16 1.5 KEY ORIGINAL CONTRIBUTIONS 18 CHAPTER 2: USES, ADVANTAGES, AND LIMITATIONS OF WARGAMING 19 2.1 USES OF WARGAMING 20 2.1.1 CATEGORISING THE USES OF WARGAMING 21 2.1.2 FUTURES AND ANTICIPATION 26 2.1.3 SKILLS 32 2.1.4 PLAY AND PLAYFULNESS 36 2.2 ADVANTAGES OF WARGAMING 39 2.2.1 ADVANTAGES OVER COMPUTERS 39 2.2.2 THE HUMAN FACTOR 43 2.2.3 COST 45 2.2.4 CREATIVITY 46 2.2.5 EXPERIENCE AND SIMULATION 47 2.2.6 FLEXIBILITY 48 2.2.7 SAFETY 49 2.3 LIMITATIONS OF WARGAMING 50 2.3.1 ABSTRACTION 50 2.3.2 OPPONENTS 53 2.3.3 OUTCOME 54 2.3.4 POLITICS OF REPRESENTATION 55 CHAPTER 2 CONCLUSION 57 CHAPTER 3: THE STATE OF PLAY – EXISTING CYBER WARGAMES 60 3.1 LUDIC COMPONENTS 64 3.1.1 GAMES THAT ARE PLAYABLE AND ENJOYABLE 64 3.1.2 GAMES THAT ARE NOT QUITE GAMES 69 3.2. ADVERSARIAL NATURE 72 3.2.1 PLAYER VERSUS PLAYER 73 5 3.2.2 PLAYER VERSUS SYSTEM 76 3.3 CARDS 78 3.4 SIMULATING UNPREDICTABILITY 81 3.5 MARKETPLACE 84 CHAPTER 3 CONCLUSION 88 CHAPTER 4: DESIGNING A CYBER SECURITY WARGAME 90 4.1 REALISM VERSUS COMPLEXITY IN GAME DESIGN 92 4.1.1 LENGTH OF RULES 93 4.2 KEY CONSTITUENTS OF CYBERSPACE 94 4.2.1 ENTITIES 96 4.2.2 RELATIONSHIPS BETWEEN CONSTITUENTS 107 4.3 STRATEGIC GOAL-SETTING IN CYBER SECURITY 111 4.3.1 PLAYER OBJECTIVES 113 4.3.2 MANAGING LIMITED RESOURCES 116 4.4 CYBER ATTACK AND DEFENCE DYNAMICS 118 4.4.1 DYNAMICS OF TIME PROGRESSION 118 4.4.2 DYNAMICS OF CYBER CAPABILITY DEVELOPMENT 121 4.4.3 ATTACK VECTORS 127 4.4.4 DYNAMICS OF ATTACK RISK AND REWARD 130 4.4.5 DYNAMICS OF ATTRIBUTION 132 4.5 GEOPOLITICAL REALITIES OF CYBER SECURITY 134 4.5.1 CLUMSY CIVIL SERVANT EVENT CARD 135 4.5.2 BANKING ERROR EVENT CARD 136 4.5.3 PEOPLE’S REVOLT EVENT CARD 137 4.5.4 QUANTUM BREAKTHROUGH EVENT CARD 138 4.6 VISIBILITY IN CYBERSPACE 139 CHAPTER 4 CONCLUSION 141 CHAPTER 5: METHODOLOGY FOR STUDYING GAMES AND PLAYERS 144 5.1 GROUNDED THEORY AND ITS LINKS TO WARGAMING 146 5.2 ETHNOGRAPHIC PRACTICE 149 5.2.1 STRATEGIC POSITIONALITY 150 5.2.2 STRATEGY FOR TARGETING RESEARCH PARTICIPANTS 155 5.2.3 SECURITY AND CLASSIFICATION OF INFORMATION 157 5.3 FACILITATION AND ADJUDICATION 159 5.3.1 TACTICAL POSITIONALITY I 161 5.4 METHODS FOR CAPTURING GAME RESULTS AND PLAYER EXPERIENCES 163 5.4.1 DATA GATHERING METHODS 164 5.4.2 TACTICAL POSITIONALITY II 170 5.5 DATA ANALYSIS METHODS 171 CHAPTER 5 CONCLUSION 173 CHAPTER 6: PEDAGOGY AND PRACTICE IN CYBER WARGAMING 174 6 6.1 GAMING BY NUMBERS: QUANTITATIVE USES OF METADATA AND GAME DATA 175 6.1.1 THE GENDER IMBALANCE IN WARGAMING 176 6.1.2 IN-GAME PERFORMANCE AS A GUIDE TO REAL-WORLD PERFORMANCE 177 6.1.3 IN-GAME RESULTS AS A GUIDE TO REAL-WORLD RESULTS 179 6.1.4 PLAYING STYLES OF DIFFERENT GROUPS 181 6.2 LEARNING THROUGH THE GAME: EXPECTED AND UNEXPECTED RESULTS 183 6.2.1 ENTITIES 184 6.2.2 ENTITY RELATIONSHIPS 189 6.2.3 OBJECTIVES 191 6.2.4 RESOURCE MANAGEMENT 194 6.2.5 ATTACK AND DEFENCE DYNAMICS 196 6.2.6 GEOPOLITICAL REALITIES AND LANDSCAPES 209 6.2.7 VISIBILITY IN AND OF CYBERSPACE 211 6.3 PRACTICING WARGAMING THEORY 214 6.3.1 REALISM VERSUS COMPLEXITY 215 6.3.2 DECISION-MAKING EXPERIENCE 217 6.3.3 ENGAGEMENT 218 6.3.4 MANUAL WARGAMING AND ADVANTAGES OVER COMPUTERS 227 CHAPTER 6 CONCLUSION 230 CHAPTER 7: A WARGAMING PRACTITIONER’S EXPERIENCE 233 7.1 THE IMPACT OF THE RESEARCHER’S POSITIONALITY 234 7.1.1 CREATING RESEARCH OPPORTUNITIES 235 7.1.2 TACTICAL POSITIONALITY 242 7.2 SECRECY, SECURITY, AND CLASSIFICATION OF INFORMATION 258 7.2.1 ACCESS DENIED 259 7.2.2 STIFLED PARTICIPANTS 261 7.3 HUMOUR AS A PEDAGOGICAL TOOL 263 7.3.1 ELEVATING MUNDANITY THROUGH HUMOUR 265 7.3.2 POKING FUN AT PRESIDENTS 267 7.3.3 USING HUMOUR TO ENGINEER AFFECTIVE ATMOSPHERES 268 CHAPTER 7 CONCLUSION 270 CHAPTER 8: CONCLUSIONS 274 8.1 RESEARCH FINDINGS COMPARED TO THE LITERATURE 275 8.1.1 CORROBORATING THE STORY-LIVING EXPERIENCE 276 8.1.2 CORROBORATING THE MODIFIABILITY ADVANTAGE OF MANUAL GAMES 276 8.1.3 CORROBORATING THE BALANCE BETWEEN REALISM AND COMPLEXITY 277 8.1.4 GAME RULES ARE NOT EASY TO WRITE 278 8.2 NOVEL TAKEAWAYS FOR WARGAMERS 278 8.2.1 MERGING DISTANT LITERATURE 279 8.2.2 A CATALOGUE FOR BEST-PRACTICE IN CYBER GAMES DESIGN 279 8.3 KEY ORIGINAL CONTRIBUTIONS OF THE RESEARCH 280 8.3.1 DEVELOPMENT OF A NOVEL CYBER WARGAME 280 8.3.2 A WARGAMING PRACTITIONER’S EXPERIENCE 281 7 8.3.3 ADDRESSING THE CENTRAL THESIS OBJECTIVE 282 8.4 THE WAY AHEAD 283 APPENDICES 285 APPENDIX A: PLAYER DOSSIERS 285 UK GOVERNMENT 285 ELECTORATE 286 UK PLC 287 GCHQ 288 UK ENERGY 289 RUSSIA GOVERNMENT 290 ONLINE TROLLS 291 ENERGETIC BEAR 292 SCS 293 ROSENERGOATOM 294 APPENDIX B: GAME RULES 295 APPENDIX C: GAME SESSIONS 297 BIBLIOGRAPHY 308 List of Figures FIGURE 1: A GAME OF [D0X3D!] IN ACTION 68 FIGURE 2: SCREENSHOT FROM SPOT THE RISKS, OFFICE VERSION 72 FIGURE 3: OPERATION DIGITAL CHAMELEON GAME BOARD 74 FIGURE 4: CTRL+ALT+HACK GAME BOX AND CONTENTS 79 FIGURE 5: MAELSTROM GAME BOARD 87 FIGURE 6: VERSION 1.0 OF THE GAME BOARD 97 FIGURE 7: FINAL VERSION OF THE GAME BOARD 97 FIGURE 8: THE IN-GAME BLACK MARKET 122 FIGURE 9: BLACK MARKET ASSET CARDS 123 FIGURE 10: VERSION 1.0 COMBAT RESULTS TABLE 131 FIGURE 11: FINAL VERSION COMBAT RESULTS TABLE 131 FIGURE 12: EVENT CARDS 135 FIGURE 13: NON-EVENT CARD 135 FIGURE 14: WARGAME OUTCOME PROBABILITY DISTRIBUTIONS.