Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I am looking for table top or card games related to risk management or information security. A kind of "serious" game that can be used as a teaching tool of infosec/risk management.

I know only about Microsoft's Elevation of Privilege.

share|improve this question

5 Answers 5

I haven't played anything like this myself, but I found this on Google: http://www.itgovernance.co.uk/products/3831 - Is this similar to what you are looking for?

share|improve this answer
Unfortunately, this is not what I was looking for. That card game is a regular playing cards with concepts printed on the back. –  Konrads May 10 '12 at 8:49
this might be a bit off topic but I remember hearing a bout this and being intrigued: cbsnews.com/2100-501563_162-4930814.html basically what happens if that you get different teams in different rooms and each team can only see status of the others after the other team makes a move, teams can make as many moves as they like and it gets broadcast to the others and the resulting effects are evaluated. It was designed as a way of assessing the risk of non-lethal economic attacks (economic war game) on the US. interested me at the time. –  Alex May 18 '12 at 0:10
FlipIt? rsa.com/rsalabs/node.asp?id=3911 –  adric Aug 21 '12 at 15:07

How about hacker by Steve Jackson games?


I've used it for exactly what you are asking about.

share|improve this answer


Pretty interesting game. I think a book would be a better teacher though.

share|improve this answer
Saw that one being presented at BlackHat. Looks quite interesting to break the basic concepts. –  Konrads Aug 7 '12 at 14:03

There is a site you can use for team play (laptops,iPads,etc)


share|improve this answer

Actually I think that classic "Risk" is a great example of Risk Management.

Think about it:

A: You are assessing vulnerabilities in your "system" and figure out all potentially threatening scenarios

B: Based on you assessment you are allocating security resources, while using risk management principles to make all decisions. (i.e. how many resources are needed for "full-proof" defense, what is an "acceptable" risk to take and etc)

C: The random/unexpected factors are represented by a dice and cards.

D: The Game Theory factors are also there; as there are different players involved, with intertwined different agendas.

No real connection to Info. Security but it's a Risk Management game thru-and-thru...

share|improve this answer
I disagree, I think it tends to be more about diplomacy, and who can take North America successfully (only 3 entrances to defend, but 5 bonus troops makes it by far the best). –  sweeneyrod Apr 23 at 21:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.