A couple of weeks ago, I made a print-and-play version of my new game about collection management, Spymaster, available to anyone who reads this blog and would drop me an email (The offer is still open, by the way, in case you missed it the first time). Since then, I have mailed out over 100 copies to everyone from the DNI's office to troops deployed in Afghanistan to academics in Japan to the Norwegian police forces! Feedback is starting to trickle in and the comments have been largely positive (whew!) even from some very experienced collection managers (Thanks!). In addition, I have received a number of outstanding suggestions for enhancing or improving the game. Some of these include:
Making different collection assets work better or worse against different information requirements.
Increasing the point value of information requirements collected early.
Making some of the OSINT cards "Burn - 0" or impossible to burn.
Giving players a budget and assigning dollar values to each collection asset such that players had to stay within their budget as well.
I recognize that these suggestions may not make much sense if you haven't played the game but all of them (plus many more) are fantastic ideas designed to make the game more real. And therein lies the rub... One of the classic problems of games designed to simulate some aspect of the real world is the trade-off between realism and playability. Playability is really just how easy it is to play the game. Every time you add a new rule to make the game more realistic, you make the game more difficult to play and therefore less playable. Its not quite as simple as that but it gives you a good idea of how the problem manifests itself. Great games designed to simulate reality often give a strong sense of realism while remaining relatively simple but the truth of it is, like the Heisenberg Uncertainty Principle, the more you try to do one, the less, typically, you are able to do the other.
The problem of playability versus realism is analogous to the problem of feature creep in project management. Most people have been involved in a project that started out simple but, over time, grew incredibly complex as more and more "good ideas" were added. Each idea, in and of itself, was justifiable but, in the end, led to an unwieldy mess. Figuring out where to draw the line is just as important in game design as it is in project management. This constraint is even more strict when considering the modern intelligence classroom. Here, unless the course is entitled "collection management", there is likely a highly limited amount of time to devote to a game on collection management. Consider the case of Spymaster. I wanted a game which would replace a one-hour lecture on collection management for our intro classes. To make this work, I would need to be able to set-up the game, explain the rules, play the game and then conduct an outbrief all within an hour. That's pretty tough to do (at least for me) and still make the game meet your learning objectives. It becomes a very careful balance of putting good ideas into the game while not running out of time to play the game in class. The classic solution to this problem is to have a basic version and an advanced version (or several advanced versions). These can be included in the rules from the outset or added later as expansion packs. Right now, this is exactly what I am doing with all of the feedback I am receiving - scouring it for good ideas I want to put into more advanced versions of Spymaster!
Composition The expert group is currently composed of experts from: BNP Paribas, GAD eG - IT für Banken, European Banking Federation, La Banque Postale, Bank of America Merrill Lynch, Alpha Bank, ING, Finanz Informatik, European Central Bank, ECB / Serco Services, Dutch Payments Association, Danish Bankers Association, Belfius Bank, Febelfin, Hungarian Bankers Association, Capital One, Morgan Stanley, National Australia Bank Group, SEB, Piraeus Bank, Bankinter, KBC, Paypal, Erste Bank, UBS, SPB, Crédit Agricole, Citi, Société Générale and FS-ISAC.
Agenda topics The group first discussed about the need to complement (and not overlap) ongoing activities. ENISA's activities in this domain should not overlap with ongoing activities on NIS in the finance sector, but focus on cross-cutting and cross-sector issues. This means, for example;the financial sector's dependence on the telecom networks and services, the dependency on cloud computing, et cetera.
Focus net list of work Secondly, the group suggested a number of potential topics for focussing the work of the ENISA group. Below is a summary of the topics:.
1. NIS and outsourcing: The problem for organisations in the finance sector to manage NIS, across the outsourced assets, and across the supply chain, for example in the case of cloud computing. Can certification and accreditation help here?
2. Breach reporting: Breach reporting is becoming more and more important across the EU. How can we agree on a good and harmonized security breaches notification framework for the finance sector?
3. Security of the communication networks and services: Banks currently struggle with a range of security issues in the electronic communication networks and services (CCLID spoofing, fake calls from banks, spoofed emails, phishing, hacked voicemail boxes, spoofed messages, DoS attacks, and so on). There should be better collaboration with the telecom sector to address the risks for the financial sector.
Next steps We will continue the discussion about these topics, with the objective to agree on a shortlist of topics which should be addressed by ENISA in the future.
Ralph Mackiewicz : scadasec Digest, Vol 78, Issue 13:
Many OPC servers for protocols that use number based reporting ask the user to assign a name to the address of the tag. You are very likely to get a name like "12TH_ST_FDR_BRK_CTRL" at the interface. Providing context to data is not inherently a vulnerability. [...]
Brent Kimberley: HAVEX report:
Why not monitored acyclic graphs?
TFC-110MST sets the org back ~ 50$/pc. Shift the decimal point 1~4 digits for rugidization, diversity, etc.
On Monday, July 21, 2014 10:34:44 AM, Michael Toecker <michael.toecker at gmail. [...]
Michael Toecker: HAVEX report: Keith,
Disagree with your assessment that keeping the naughty from communicating
to C&C is going to somehow prevent Havex, et al from doing damage. THERE
IS A VIRUS ON THE CONTROL SYSTEM. Something has gone horribly wrong with
that 'defense in depth' posture, and that gap has allowed a virus to [...]
2013 has been a year of changes for ENISA, largely characterised by two major events: the publication of the EU's cybersecurity strategy and the adoption of the Agency's new mandate on 18th June 2013.
Among the highlights of this year's work are:
ENISA's Cloud Reports
The annual Threat Landscape Report
The Agency continues to be a principal player in Europe’s Cyber Incident Reporting framework
ENISA's continuous work to strengthen cooperation within the CERT community
The first fully fledged European Cyber Security Month (ECSM)
ENISA continues to be a recognised player and trusted partner for the EU Member States and globally. The Agency's experience, insight, expertise and added value have become increasingly acknowledged and appreciated among all cyber security actors.
Last year I was struggling with how to make the classroom discussion of collection management (you know... the allocation of collection assets such as spies and satellites in order to gather required information in a timely manner) more interesting. Couldn't do it. Even people who find the job enormously gratifying (and there are many), seem to have a hard time explaining why they like it so much. So...I decided to make a game out of it. I call the game Spymaster and I have been using it in classes and playing it in my weekly Game Lab for most of the last year. It seems to work really well both as a game and as a tool for making the challenges of collection management more real to students and young intel professionals. It plays fast - in about 15 minutes - and is a cooperative game. For those of you unfamiliar with this term, a cooperative game is one where all the players are on the same side trying to beat the game. If you have ever played the board games Pandemic or Forbidden Island, you have played a cooperative game). You can even play it solitaire but I have found it works best with 4-5 players and works really well in a classroom. I have spent the last week or so cleaning up the game and making it look pretty and writing down the rules and a brief tutorial. Now I am looking for people who would like to take this "beta" version out for a spin. If you are interested in receiving a print-and-play version of the game on the condition that you give me some feedback, drop me a line at firstname.lastname@example.org. If you just want to follow along as I develop the game, check out the Spymaster Facebook Page.
In order to judge the output from the participants, the challenge organizers asks for analysts to participate as reviewers of the submissions. Kris Cook, who is on the contest committee, has asked me to put the word out that the contest needs reviewers for this year’s challenge.
This is an unpaid, all volunteer effort to assist a non-profit sponsored contest. Kris’ note to me is reproduced below with additional links. If you are interested in participating or have any additional questions, please contact her directly.
For what it is worth, taking a look at the VAST entries is a very interesting and rewarding way to learn what is happening in the world of visual analytics.
Begin text of note:
We invite you to be a reviewer for this year’s IEEE Visual Analytics Science and Technology (VAST) Challenge. The VAST Challenge poses interesting problems that contestants solve using visualization-based software tools that support analysis of complex data sets.
We are soliciting reviewers for three mini-challenges and a grand challenge this year.
Mini-Challenge 1 challenges participants to identify the current organization of a fictitious terrorist organization and how that organization has changed over time, as well as to characterize the events surrounding the disappearance of multiple people. Participants will use visual analytics to analyze the specified data.
Mini-Challenge 2 challenges participants to describe the daily routines of employees of a fictitious company and to identify suspicious behaviors. This task focuses on the analysis of movement and tracking data and is thus primarily a spatiotemporal challenge.
Mini-Challenge 3 challenges participants to identify a timeline of significant events in a fictitious city and identify important participants, locations, and durations by monitoring real-time data feeds. This task poses a streaming analysis challenge.
The Grand Challenge asks participants to synthesize the discoveries made across the three mini-challenges to form a high level description of the entire scenario. This task focuses on the identification of who disappeared, who was responsible, and the underlying motivations. Significant information gaps will also be addressed by the participants.
As a reviewer you will be responsible for reading 3-4 submissions and providing written feedback for the committee and the submitters. Each submission consists of an entry form describing the submitter’s software, their technical approach, and their answers to the mini-challenge questions, as well as a short video showing an example of the analytic processes used by the submitters.
This year, the reviewing period is as follows: Entries will be available for review by July 12. Your reviews will be due by July 28.
All review materials will be accessible over the internet. Reviews will be conducted using the Precision Conference web-based reviewing system. Reviewers will be registered in the Precision Conference system and will submit their reviews using Precision Conference web pages.
If you are interested in reviewing please respond to email@example.com later than July 1. Please indicate which mini-challenges you would be most interested in reviewing and how many entries you are willing to review.
Thank you for your time and consideration!
VAST Challenge Committee
Kris Cook, Georges Grinstein, and Mark Whiting, co-chairs
Having to get a visa is a hassle - just ask anyone who has gone through the process. Likewise, being able to travel into and out of countries without a visa is a real benefit. Who then, has the "best" passport? Which country offers its citizens the most possibilities for visa-free travel? The answers, in the infographic below (from Movehub), are interesting (H/T to Jeremy!):