Cyber wargaming on the technical/tactical level: The Cyber Resilience Card Game (CRCG)

Abstract

NATO understands cyber within a cognitive, virtual and physical domain and on technical, tactical, operational, strategic and political levels. The NATO Research Task Group 129 "Gamification of Cyber Defence/Resilience" explores the advantages of gamification, especially Serious Games in an example in the form of manual wargames but also card-driven games and matrix wargames to support training and education in all domains and on all these levels. Within their task is the development of specific prototypes for these specific domains and levels. The Basic Staff Officer Course of The Bundeswehr Command and Staff College (Führungsakademie der Bundeswehr) developed within their competence-based training and education system the “Cyber Resilience Card Game” (CRCG) for training and education on the technical/tactical level. The CRCG was already used several times for training at the NATO Centre of Excellence Defence against Terrorism (NATO COE DAT) in the “Terrorist Use of Cyber Space” course. It is also used within the curricula of the Bundeswehr Command and Staff College and is currently under development for a localised German version to increase awareness and resilience. This paper describes the history of the development of the game, the different iterations, evaluations from the development team, test groups and actual course participants and insights from the most recent research and development workshop in June 2019. It will examine how gamification can be used to incentivise player behaviour that is officially recommended. Essential cyber hygiene measures like Two Factor Authentication (2FA) are usually not applied in real life because they are too inconvenient. It will also illustrate how cyber awareness can be enhanced using a card-driven game. Insights are based on observed player behaviour and the subjective evaluation of players concerning the effectiveness to reach specific cyber-related cognitive learning goals. It describes a good practice approach to a research and development and education (RD&E) approach to awareness building and competence-based training. It provides a blueprint to implement a student-centred and student-driven learning and teaching approach to circumvent death by PowerPoint. This is the first of three articles for the Conference Proceedings of ECCWS 2020. There are redundancies in each introduction, and this article examines terminological uncertainties more.