---

This is the browser equivalent of the resources given to one player in the Threat Agents card game.

To play remotely you should:

• Join using your preferred video conferencing software.
• Screenshare the data flow diagram.
• Each player opens this page in their browser.

Setup

A data flow diagram should be drawn on a whiteboard or similar. Every player gets one of each Threat Agent cards placed face up, plus one of these pages.

Each Turn

The player identifies a threat and plays the appropriate Threat Agent to make an attack. This is left face down. Click the card to do this.

Other players must analyse the system and see how the attack could be mitigated or blocked. They can use one of the Counter Agents or explain their domain knowledge. Click on the Counter Agents card to pop up the full size image.

End of Turn

• 0 points awarded if attack isn’t valid.
• 1 point if the attack is mitigated.
• 2 points if the mitigation is weak.
• 5 points if a vulnerability is found.

Threat Agents can be turned face up if you have none remaining or were unable to identify a threat. The group may agree that you can turn over all your cards when there are only one or two available to you.

Game Over

The game should end 5 minutes before the end of the meeting. This allows time to agree who should follow up on vulnerabilities.

To learn more about Threat Agents, visit the Threat Agents website.