My shopping cart
Your cart is currently empty.Continue Shopping
The Elevation of Privilege (EoP) card game is designed to introduce people who are not information security practitioners or experts to the craft of threat modeling. Until now, considering a system from an attackers’ perspective was hard to wrap your head around. The game helps you identify threats to software or computer systems within a six category framework called STRIDE and is intended to be picked up and used by any development group.
Because the game uses STRIDE threats, it gives you a framework for thinking, and specific actionable examples of those threats.
STRIDE stands for:
|S||Spoofing||Impersonating something or someone else.|
|T||Tampering||Modifying data or code.|
|R||Repudiation||Claiming not to have performed an action.|
|I||Information Disclosure||Exposing information to someone not authorized to see it.|
|D||Denial of Service||Denying or degrading service to users.|
|E||Elevation of Privilege||Gain capabilities without proper authorization.|
The EoP card game was invented by Adam Shostack during his tenure at Microsoft. The game was released in 2010. Adam wrote a white paper which explains the objectives and design of the game and his motivations for creating it.
An elevation of privilege occurs when a user or application gains rights (i.e., privileges) that should not be available to him or her. For example, a system’s user that should have “read-only” permission somehow elevates their system privileges to include “read and write” permissions.
The game consists of 84 cards, including 2 instruction cards, 1 play and strategy flowchart card, 74 playing cards, 6 reference cards, and an ‘about’ card. The cards are in six suits based on the STRIDE mnemonic.
The 74 playing cards contain cyber security anti-patterns which supports players as they attempt to find validated security flaws in a system.
More details on how to play the game are captured in the session given by Adam Shostack at the AppSec Cali conference.
If you would also like to explain threat modeling itself before playing the game, please consider this experience report from the Leeds Digital Festival.
You can buy the card deck on Agile Stationery
You can also download a pdf copy of the cards