Decisions and Disruptions Table Top Exercise

Date: 29^th March 2019

Time: 9am– 12:00pm

Venue: Central Hall Westminster, Storey’s Gate, SW1H 9NH

This unique table top exercise is designed to explore the decisions that people make, in order to protect their businesses from modern day threats, such as hacking and malware attacks, in addition to physical security and crime prevention. The exercise was initially funded by the National Cyber Security Centre and developed by Lancaster University. It has been further developed by the Metropolitan Police Service in order to accurately represent current threats.

The exercise itself consists of two game boards which represent a company with separate premises. One board represents an office space, whilst the other represents a plant. Within these boards are staff, computers, databases, servers and turbines attached to an internet connected controller.

Although it is organised as a business with a plant location, it is based upon the same threats and risks that a company with different separate premises would face.

Participants are informed that the business has just been added to the company’s portfolio and that there is no current physical or cyber security. Participants will be given a yearly budget and multiple purchase options in order to make the company more secure. During the exercise, they will be faced with different scenarios and outcomes based upon their decisions, which will have a direct impact on their turnover. These scenarios are based upon real life situations and current threats. At the conclusion of the game, participants are debriefed and taken through ‘the perfect game’.

Although this exercise is targeted towards senior decision makers within companies, it can also be of benefit to other staff with varying levels of technical knowledge, as it creates an immersive experience in which participants have to use their problem solving, collaboration, leadership and communication skills.

Potential benefits of the exercise

• Due to the physical representation of the game board, it makes cyber security easier to understand.
• The exercise is beneficial to those with both limited and proficient knowledge of cyber security, due to the need to utilise other personal and decision making skills.
• This exercise is especially effective for those who are kinaesthetic and/or social learners.
• It highlights how the cyber world can affect the physical world and visa-versa.
• Current NCSC and Met Police cyber security guidance is provided in the post-exercise debrief.