Backdoors & Breaches: Live Tabletop Exercise Demo

### Overview In this live tabletop exercise demonstration, John Strand and Jason (Incident Master) from Black Hills Information Security showcase *Backdoors & Breaches*, a gamified incident response tool designed to make tabletop exercises engaging and educational. Available physically and as a free open-source digital tool on GitHub (play.backdoorsandbreaches.com), the game blends mechanics inspired by *Clue* and *Dungeons & Dragons* with the cyber kill chain. A panel comprising Chris Cochran, John Hammond, Maril Vernon, Leslie, and Ron Eddings works together with the audience to uncover a simulated breach within 10 turns by choosing defensive procedures and rolling a 20-sided die.

### Key Topics - **Backdoors & Breaches Mechanics**: The game uses four primary attack categories mirroring the cyber kill chain: Initial Compromise, Pivot and Escalate, C2 and Exfiltration, and Persistence. Defenders select blue procedure cards (e.g., SIEM, User and Entity Behavior Analytics, Endpoint Analysis, Server Analysis, Network Threat Hunting, Isolation) to uncover hidden attack cards. - **Dice Rolling and Modifiers**: Success is determined using a 20-sided die (D20), where 1–10 is unsuccessful and 11–20 is successful. Written/documented procedures grant a +3 modifier. A three-turn cooldown prevents teams from repeatedly brute-forcing the same tool. - **Inject Cards and Incident Chaos**: Rolling a 1, a 20, or suffering three consecutive failures triggers Inject Cards that introduce real-world chaos (e.g., losing a procedure, staff leaving on family leave, or finding out data was uploaded to Pastebin). - **Defining a Crisis**: The session explores when an incident escalates to a crisis, contrasting technical, business, and operational definitions (e.g., leaks to the press, involving legal counsel, exceeding available response resources, or executive disruption).

### Technical Details - **Initial Compromise**: The scenario starts with an alert on an elevated baseline of failed logins to an external web portal that stopped three days prior. The panel uses User and Entity Behavior Analytics (UEBA)—evaluating aggregated event logs rather than single events—and successfully rolls a 15, identifying a **Password Spray** attack that culminated in a successful login to the badge reader system. - **Pivoting & Escalation**: In subsequent turns, the team evaluates options to inspect the badge reader server. A roll of 9 for server analysis fails, demonstrating how real-world roadblocks (e.g., unsupported legacy systems like Windows NT, inability to install agents, or unshared credentials) impede analysis. After a critical failure (roll of 1) during network threat hunting causes the loss of the firewall log review modifier, the panel successfully leverages **SIEM log analysis** (rolling an 11) to discover that **Kerberoasting** occurred via authenticated service account tickets. - **Chaos Injects & Threat Hunting**: Later attempts at firewall log review (rolled 7) and endpoint security analysis (rolled 4) both fail. A subsequent threat hunting roll lands on a 1 (triggering double injects: three consecutive failures plus a critical 1). One inject reveals data uploaded to Pastebin, requiring a successful crisis management roll (11), while the other awards a random procedure card modifier (+3 to SIEM).

### Takeaways - **Learning from Failure**: Failed rolls are the most valuable aspect of the exercise because they force teams to identify institutional, political, technical, or personnel gaps that prevent tools and procedures from functioning during an incident. - **Iterative Improvement**: Tabletop facilitators should aim to fix only one identified issue per exercise to avoid overwhelming the team. - **Pre-defining Crisis Thresholds**: Organizations must explicitly define severity levels and crisis thresholds ahead of time rather than attempting to determine escalation criteria in the middle of an active breach.