Oh Noes!—A Role Playing Incident Response Game

Conference:  Defcon 26



The term"incident response exercise" can strike fear in the hearts of even the mostly steely-eyed professional. The idea of sitting around a table, talking through a catastrophic security event can be both simultaneously exhausting and incredibly boring. However, what instead of an participating in an"incident response exercise," you instead got to plan an"incident response role playing game?" Enter our IR roleplaying game,"Oh Noes! An Adventure Through the Cybers and Shit." As part of our day job, we do quarterly IR exercises. In order to make these exercises more engaging, more fun, and more useful, we turned these exercises into a role playing game. We found it so useful and fun, we're releasing it at DEF CON along with numerous scenarios for your dungeon master to take you through. At this talk, we will talk about gamifying IR exercises and the rules of Oh Noes! We will equip you with dice and your own character sheet and we will walk you through the character creating process. That's right, in Oh Noes! you create your own character with specific skills and abilities that you level up as you play. A group of us will play through a short scenario so you can see how the game works. We will provide several sample scenarios, some ripped from the headlines (and some cribbed from @badthingsdaily) as well as provide guidance on what makes successful scenarios as you transition to be your own dungeon master.



Post a comment

Related work

Conference:  RSA Conference 2023
Authors: Jason Blanchard, John Strand

Conference:  Defcon 31
Authors: Katitza Rodriguez Policy Director for Global Privacy Electronic Frontier Foundation, Bill Budington Senior Staff Technologist Electronic Frontier Foundation

Conference:  RSA Conference 2023
Authors: Dr. Christopher Pierson, James Shreve

Conference:  BlackHat USA 2020