Elevation of Privilege (EoP) Threat Modeling Card Game

Purpose

The Elevation of Privilege (EoP) card game is designed to introduce people who are not information security practitioners or experts to the craft of threat modeling. Until now, considering a system from an attackers’ perspective was hard to wrap your head around. The game helps you identify threats to software or computer systems within a six category framework called STRIDE and is intended to be picked up and used by any development group.

Because the game uses STRIDE threats, it gives you a framework for thinking, and specific actionable examples of those threats.

 STRIDE stands for:

S Spoofing Impersonating something or someone else.
T Tampering Modifying data or code.
R Repudiation Claiming not to have performed an action.
I Information Disclosure Exposing information to someone not authorized to see it.
D Denial of Service Denying or degrading service to users.
E Elevation of Privilege Gain capabilities without proper authorization.

Who Invented the game

The EoP card game was invented by Adam Shostack during his tenure at Microsoft. The game was released in 2010. Adam wrote a white paper which explains the objectives and design of the game and his motivations for creating it. 

Where did the name come from?

An elevation of privilege occurs when a user or application gains rights (i.e., privileges) that should not be available to him or her. For example, a system’s user that should have “read-only” permission somehow elevates their system privileges to include “read and write” permissions.

How to play

The game consists of 84 cards, including 2 instruction cards, 1 play and strategy flowchart card, 74 playing cards, 6 reference cards, and an ‘about’ card. The cards are in six suits based on the STRIDE mnemonic. 

The 74 playing cards contain cyber security anti-patterns which supports players as they attempt to find validated security flaws in a system.

Instructions on how to play EoP

  • Draw a diagram of the system you want to threat model before you deal the cards.
  • Deal the deck to 3-6 players
  • Play starts with 3 of tampering
  • To play a card, each player reads their card, announced the threat and records it. 
  • Each round is won by the highest card played in the suit that was led, unless an Elevation of Privilege (EOP) card is played. 
  • In that case, the high value EOP card wins. 

More details on how to play the game are captured in the session given by Adam Shostack at the AppSec Cali conference. 

If you would also like to explain threat modeling itself before playing the game, please consider this experience report from the Leeds Digital Festival. 

Where to get the cards

You can buy the card deck on Agile Stationery

Buy the deck

You can also download a pdf copy of the cards 

Download a pdf copy