Description

DevSecOps is a serious game designed as part of a 10 week course on Secure Software Design and Development. It is introduced at the beginning of the course as an introduction to many of the concepts taught in the class and presented again late in the course as an opportunity for review. It is designed with the following lesson objectives in mind:

• Judge the cost and risk trade offs between secure and unsecured software aspects including code, data and usability.
• Devise a strategy to produce a system under threats.
• Comprehend that partial security may equate to no security.
• Identify examples of insecure code and methods of mitigating them.

• Resource Production: players simultaneously select 4 cards from any combination of decks (e.g., 2 usability cards, 1 DevSecOps card, and 1 data card). The only caveat is that each player must take at least one DevSecOps card.
• Project Advancement: players play any number of cards from their hand to their tableau. Each card has a cost associated with it. To play a card, a player must discard cards from his hand equal to the cost of the card.
• A card is turned up from the event deck that affect all players and generally involves losing cards in their tableau.
• Check for Project Completion: If a player has 2 Progress Points in each area and an ``Authority to Operate card in their tableau, that player wins (ties are possible).

Game components consist of five decks of cards. There are three component decks that represent management focus on Usability, Software, and Data. Cards in these decks provide personnel and data security from attacks as well as Progress Points. The fourth deck, DevSecOps, improves players' ability to advance in the component areas as well as containing several copies of "Authority to Operate" (needed to win). The final deck is an event deck that causes players to lose a card in one of the component areas if it isn't sufficiently protected.

—description from the designer