Star 0

Abstract

The Elevation of Privilege card game has been designed for threat modeling based on STRIDE threats, and has since become a widely-deployed tool for security and development teams. One of its many feats is to bridge the knowledge gap between development and security when analyzing a software system, allowing for a structured conversation with intensive knowledge sharing. This is achieved by leveraging elements of game design, allowing for reciprocity and better engagement. These feats make it an ideal candidate to help with other closely related areas where developers need to cooperate with departments like compliance, legal, or privacy. Specifically looking at privacy, due to its obvious relevance recently, this presentation will show an extension of the Elevation of Privilege card game that LogMeIn has adopted to meet its privacy by design requirements. It will show the research that helped define the cards of the suit and give a quick overview of the individual cards. By the end of the talk, practitioners will have a new toolset to include into their security and privacy processes. Furthermore interested listeners will hear methods on how to design extensions to already available games, allowing to incorporate topics they feel necessary for their work practices into fun exercises.

Videos