In the early days of the SANS Leadership Curriculum (formerly known as the Management Curriculum), we tried various experiments to provide students with "hands-on" leadership labs.
Some classes had technical labs with a course virtual machine and various tools, giving managers the technical exposure to what their teams did every day. This was good but, as the industry matured, it wasn't enough to give advancing managers the insights they needed to make real-world decisions.
We then introduced various case scenarios and case studies like the ones from Harvard Business School. Using a variety of fictional companies, this put students in real-world cybersecurity situations they might face at work, helping them understand and address complex issues. We still use case studies in our Leadership courses today.
But we knew we still needed something more. We wanted students to build their capabilities in a competitive way. This led to the creation of the first version of the Cyber42 game which originally used, get this, a physical game board and Post-it "sign here" flags to keep track of various scoring items. It was a different era.
The Cyber42 game has evolved a lot since then and is now an easy-to-use web application used across most SANS Leadership classes. Each Leadership class has its own version of the Cyber42 game aligned with the specific topics for that course.
For example, the LDR512 course lets students implement various capabilities (e.g., cloud security, vulnerability management, and security operations center (SOC)) to improve their ability to Identify, Protect from, Detect, and Respond to incidents. Along the way, students are presented with various challenges to which they need to respond, just like in real life.
In the LDR514 course, students still respond to various challenges but also have stakeholder sessions to gain insight into the organization to try and improve their strategic planning capabilities (Decipher, Develop, Deliver, and Lead).
Despite the differences across various courses, the overall game mechanics remain the same. The goal is to finish with the highest possible security culture score. As the game progresses, you are presented with different scenarios to which you have to respond in a “choose your own adventure” style selection process. Each choice may take a different amount of time and money. Just like in real life, your decisions can have both positive and uncertain outcomes.
Along the way, you improve your security capabilities. When your capabilities reach a certain level, it increases your security culture. On the flip side, if you have negative time or money at certain points in the game, this can decrease your culture score. At work, if your projects are always late or over budget, this results in a negative perception of you and your team. The game puts you in situations where you have to consider these tradeoffs.
In the end, the combination of technical labs, case studies, and the Cyber42 leadership simulation game combine to help put you in situations you might face at work. And they are a lot of fun along the way!
Learn more about Cyber42.
