A Deep dive into CATS evaluator algorithm: Quantification of the probability in serious game cloud security defense scenarios

Abstract

Cloud deployment has become increasingly common due to its flexibility and business value. However, cloud assets face cybersecurity challenges and need to be configured securely. Industry practitioners must be trained to understand key concepts in cloud security, including ’defense & attack’ and ’roles & responsibilities.’ A serious game provides an engaging and helpful way to convey such messages. This work introduces the core evaluator algorithm developed for Cloud of Asset and Threats (CATS), a serious game designed to enhance cloud security awareness. Maria Pinto-Albuquerque Instituto Universit´ ario de Lisboa (ISCTE-IUL) ISTAR, Av. das Forc¸as Armadas 1649–026 Lisboa, Portugal Email: maria.albuquerque@iscte-iul.pt This article extends previous work on the design of the CATS game [1], [2], [3] and presents evaluations of the game in industrial training. It is essential to note that the participants in our study were industry practitioners in various industry departments, including IoT devices, healthcare, and energy. This work builds upon our previous efforts, focusing on refining the Evaluator algorithm that quantifies the probabilities of the defender strategies as defined by the players to prevent a given attack vector from being successful. We present the results collected from industry training events where the refined algorithm was incorporated into CATS and compare them to the initial implementation. The promising results indicate that with the refinement of the evaluator algorithm, more elements derived from reality are addressed, and the game maintains a similar difficulty level for participants.