{"id":90441,"date":"2020-01-14T09:00:55","date_gmt":"2020-01-14T17:00:55","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=90441"},"modified":"2023-08-03T14:44:32","modified_gmt":"2023-08-03T21:44:32","slug":"rethinking-cyber-scenarios-learning-and-training-as-you-defend","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/","title":{"rendered":"Rethinking cyber scenarios\u2014learning (and training) as you defend"},"content":{"rendered":"<p>In two recent posts I discussed with <a href=\"https:\/\/www.circadence.com\/\" target=\"_blank\" rel=\"noopener\">Circadence<\/a> the <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/10\/01\/rethinking-how-we-learn-security\/\" target=\"_blank\" rel=\"noopener\">increasing importance of gamification for cybersecurity learning<\/a> and <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/11\/25\/rethinking-cyber-learning-consider-gamification\/\" target=\"_blank\" rel=\"noopener\">how to get started<\/a> as a practitioner while being supported by an enterprise learning officer or security team lead. In this third and final post in the series, Keenan and I address more advanced SecOps scenarios that an experienced practitioner would be concerned with understanding. We even show how Circadence and Microsoft help seasoned practitioners defend against some of the most prevalent and advanced attackers we see across industries.<\/p>\n<p>Here are more of Keenan\u2019s insights from our Q&amp;A:<\/p>\n<p><strong>Q:<\/strong>\u00a0Keenan, thanks for sharing in this digital conversation with me again. I admire your passion for gamified cyber learning. I\u2019d not put the two ideas together, that you can adopt gaming concepts\u2014and consoles\u2014in a way that makes learning the often difficult and evolving subject matter of \u201ccyber\u201d much more fun and impactful. Now that I\u2019ve used Project Ares for a year, it\u2019s hard to imagine NOT having an interactive, gamified platform to help me build and refine cybersecurity concepts and skills. Several friends and colleagues have also registered their teenagers for Circadence\u2019s <a href=\"https:\/\/www.circadence.com\/store\" target=\"_blank\" rel=\"noopener\">Project Ares Academy subscriptions<\/a> to kickstart their learning journey toward a cyber career path. If kids are going to game, let\u2019s point them to something that will build employable skills for the future.<\/p>\n<p>In our last two blogs, we introduced readers to a couple of new ideas:<\/p>\n<ul>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/10\/01\/rethinking-how-we-learn-security\/\" target=\"_blank\" rel=\"noopener\">WHY they need to re-think how they prepare cyber defenders in their organizations<\/a>.<\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/11\/25\/rethinking-cyber-learning-consider-gamification\/\" target=\"_blank\" rel=\"noopener\">HOW defenders and their managers and teams can get started<\/a>.<\/li>\n<\/ul>\n<p>Now, let\u2019s pivot and focus on practical cyber scenarios (let\u2019s say Tier 1 or Tier 2 defender scenarios)\u2014situations that would likely be directed to experienced cyber professionals to handle. Walk us through some of detail about how Circadence has built SecOps gaming experiences into Project Ares through mission scenarios that are inspired by real cyber incidents pulled from news headlines incorporating today\u2019s most common attack methods such as ransomware, credential theft, and even nation-state attacks?<\/p>\n<p><strong>A:<\/strong>\u00a0Sure. I\u2019ll start with descriptions of a couple of our foundational missions.<\/p>\n<p><strong>Scenario one: Ransomware<\/strong>\u2014Project Ares offers several mission scenarios that address the cyber kill chain around ransomware. The one I\u2019ll focus on is Mission 10, Operation Crimson Wolf. Acting as a cyber force member working for a transportation company, the user must secure networks so the company can conduct effective port activity. However, the company is in danger as ransomware has encrypted data and a hacker has launched a phishing attack on the network, impacting how and when operators offload ships. The player must stop the ransomware from spreading and attacking other nodes on the network before it\u2019s too late. I love this scenario because 1) it\u2019s realistic, 2) ransomware attacks occur far too often, and 3) it allows the player to engage in a virtual environment to build skills.<\/p>\n<p>Users who engage in this mission learn core competencies like:<\/p>\n<ul>\n<li>Computer network defense.<\/li>\n<li>Incident response management.<\/li>\n<li>Data forensics and handling.<\/li>\n<\/ul>\n<p>We map all our missions to the NIST\/NICE work role framework and Mission 10 touches on the following work roles: System Security Analyst, Cyber Defense Analyst, Cyber Defense Incident Responder, and the Cyber Defense Forensics Analyst.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-90442 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-1.png\" alt=\"Image from scenario one: Ransomware\" width=\"1432\" height=\"805\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-1.png 1432w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-1-300x169.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-1-768x432.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-1-1024x576.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-1-687x385.png 687w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-1-1083x609.png 1083w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-1-767x431.png 767w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-1-539x303.png 539w\" sizes=\"auto, (max-width: 1432px) 100vw, 1432px\" \/><\/p>\n<p><strong>Scenario two: Credential theft<\/strong>\u2014Another mission that\u2019s really engaging is Mission 1, Operation Goatherd. It teaches how credential theft can occur via a brute force attack. In this mission, the user must access the command and control server of a group of hackers to disable a botnet network in use. The botnet is designed to execute a widespread financial scam triggering the collapse of a national bank! The user must scan the command and control server located at myloot.com for running services, identify a vulnerable service, perform a brute force attack to obtain credentials, and then kill the web server acting as the command and control orchestrator.<\/p>\n<p>This scenario is powerful because it asks the player to address the challenge by thinking from an adversary\u2019s perspective. It helps the learner understand how an attacker would execute credential theft (though there are many ways) and gives the learner a different perspective for a well-rounded comprehension of the attack method.<\/p>\n<p>Users who engage in this mission learn core competencies like:<\/p>\n<ul>\n<li>Network protocols.<\/li>\n<li>Reconnaissance and enumeration.<\/li>\n<li>Password cracking and exploration.<\/li>\n<\/ul>\n<p>The NIST\/NICE work role aligned to this mission is a Cyber Operator. Specific tasks this work role must address include:<\/p>\n<ul>\n<li>Analyzing target operational architecture for ways to gain access.<\/li>\n<li>Conducting network scouting and vulnerability analysis of systems within a network.<\/li>\n<li>Detecting exploits against targeted networks.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-90443 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-2.png\" alt=\"Image from scenario two: Credential theft\" width=\"1432\" height=\"805\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-2.png 1432w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-2-300x169.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-2-768x432.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-2-1024x576.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-2-687x385.png 687w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-2-1083x609.png 1083w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-2-767x431.png 767w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-2-539x303.png 539w\" sizes=\"auto, (max-width: 1432px) 100vw, 1432px\" \/><\/p>\n<p><strong>Q:<\/strong> Can you discuss how Project Ares\u2019 learning curriculum addresses critical threats from advanced state or state-backed attackers. While we won&#8217;t name governments directly, the point for our readers to understand is that the national and international cybersecurity stage is built around identifying and learning how to combat the tools, tactics, and procedures that threat actors are using in all industries.<\/p>\n<p><strong>A:<\/strong>\u00a0Here\u2019s a good example.<\/p>\n<p><strong>Scenario three: Election security<\/strong>\u2014In this mission, we deploy in our next release of Project Ares, which now leverages cloud native architecture (running on Microsoft Azure), is Mission 15, Operation Raging Mammoth. It helps a cyber professional protect against an election attack\u2014something we are all too familiar with through recent headlines about election security. As an election security official, the user must monitor voting systems to establish a baseline of normal activity and configurations from which we identify anomalies. The user must detect and report changes to an administrator\u2019s access permissions and\/or modifications to voter information.<\/p>\n<p>The NIST\/NICE work roles aligned to this mission include professionals training as a Cyber Defense Analyst, Cyber Defense Incident Responder, or Threat\/Warning Analyst.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-90444 size-full\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-3.jpg\" alt=\"Image from scenario three: Election security\" width=\"1431\" height=\"774\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-3.jpg 1431w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-3-300x162.jpg 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-3-768x415.jpg 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-3-1024x554.jpg 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-3-389x209.jpg 389w\" sizes=\"auto, (max-width: 1431px) 100vw, 1431px\" \/><\/p>\n<p>I\u2019ve reviewed some of the specific cyber scenarios a Tier 1 or Tier 2 defender might experience on the job. Now I\u2019d like to share a bit <em>how<\/em> we build these exercises for our customers.<\/p>\n<p>It really comes down to the professional experiences and detailed research from our Mission and Battle Room design teams at Circadence. Many of them have explicit and long-standing professional experience as on-the-job cyber operators and defenders, as well as cyber professors and teachers at renowned institutions. They really understand <em>what<\/em> professionals need to learn, <em>how<\/em> they need to learn, and the most effective <em>ways to learn<\/em>.<\/p>\n<p>We profile Circadence professionals in the <a href=\"https:\/\/www.circadence.com\/blog\/living-our-mission-blog-series-how-tony-hammerling-curriculum-developer-orchestrates-a-symphony-of-cyber-learning-at-circadence\/\" target=\"_blank\" rel=\"noopener\">Living Our Mission Blog Series<\/a> to help interested readers understand the skill and dedication of the people behind Project Ares. By sharing the individual faces behind the solution, we hope current and prospective customers will appreciate Project Ares more knowing that Circadence is building the most relevant learning experiences available to support immersive, gamified learning of today\u2019s cyber professionals.<\/p>\n<h3>Learn more<\/h3>\n<p>To see Project Ares \u201cin action\u201d visit <a href=\"https:\/\/www.circadence.com\/request-a-demo\/\" target=\"_blank\" rel=\"noopener\">Circadence<\/a> and request a demonstration, or speak with your local Microsoft representative. You can also try your hand at it by attending an upcoming <a href=\"https:\/\/www.microsoft.com\/en-us\/ignite-the-tour\" target=\"_blank\" rel=\"noopener\">Microsoft Ignite: The Tour<\/a> event, which features a joint Microsoft\/Circadence \u201cInto the Breach\u201d capture the flag exercise.<\/p>\n<p>To learn more about how to close the cybersecurity talent gap, read the e-book: <a href=\"https:\/\/discover.microsoft.com\/ciso-essentials-how-to-bridge-security-talent-gap\/\" target=\"_blank\" rel=\"noopener\">CISO essentials: How to optimize recruiting while strengthening cybersecurity<\/a>. For more information on Microsoft intelligence security solutions, including guidance on Zero Trust, visit <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/zero-trust\" target=\"_blank\" rel=\"noopener\">Reach the optimal state in your Zero Trust journey<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gamified cybersecurity learning is an increasingly important must-have in your SecOps program, from understanding basic concepts all the way into advanced attacker and defense scenarios. Microsoft and Circadence are working together to democratize and scale cyber readiness globally.<\/p>\n","protected":false},"author":70,"featured_media":90445,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ms_queue_id":[],"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","footnotes":""},"content-type":[3659],"topic":[3684],"products":[],"threat-intelligence":[],"tags":[3896,3822],"coauthors":[1905],"class_list":["post-90441","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-best-practices","topic-security-operations","tag-credential-theft","tag-microsoft-security-insights"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Rethinking cyber scenarios\u2014learning (and training) as you defend | Microsoft Security Blog<\/title>\n<meta name=\"description\" content=\"Gamified cybersecurity learning is an increasingly important must-have in your SecOps program.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Rethinking cyber scenarios\u2014learning (and training) as you defend | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"Gamified cybersecurity learning is an increasingly important must-have in your SecOps program.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-01-14T17:00:55+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-08-03T21:44:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-FB.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mark McIntyre\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-Twitter.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mark McIntyre\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/mark-mcintyre\/\",\"@type\":\"Person\",\"@name\":\"Mark McIntyre\"}],\"headline\":\"Rethinking cyber scenarios\u2014learning (and training) as you defend\",\"datePublished\":\"2020-01-14T17:00:55+00:00\",\"dateModified\":\"2023-08-03T21:44:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/\"},\"wordCount\":1233,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-card.jpg\",\"keywords\":[\"Credential theft\",\"Microsoft Security Insights\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/\",\"name\":\"Rethinking cyber scenarios\u2014learning (and training) as you defend | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-card.jpg\",\"datePublished\":\"2020-01-14T17:00:55+00:00\",\"dateModified\":\"2023-08-03T21:44:32+00:00\",\"description\":\"Gamified cybersecurity learning is an increasingly important must-have in your SecOps program.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-card.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-card.jpg\",\"width\":440,\"height\":268},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Rethinking cyber scenarios\u2014learning (and training) as you defend\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Rethinking cyber scenarios\u2014learning (and training) as you defend | Microsoft Security Blog","description":"Gamified cybersecurity learning is an increasingly important must-have in your SecOps program.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/","og_locale":"en_US","og_type":"article","og_title":"Rethinking cyber scenarios\u2014learning (and training) as you defend | Microsoft Security Blog","og_description":"Gamified cybersecurity learning is an increasingly important must-have in your SecOps program.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/","og_site_name":"Microsoft Security Blog","article_published_time":"2020-01-14T17:00:55+00:00","article_modified_time":"2023-08-03T21:44:32+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-FB.jpg","type":"image\/jpeg"}],"author":"Mark McIntyre","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-Twitter.jpg","twitter_misc":{"Written by":"Mark McIntyre","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/mark-mcintyre\/","@type":"Person","@name":"Mark McIntyre"}],"headline":"Rethinking cyber scenarios\u2014learning (and training) as you defend","datePublished":"2020-01-14T17:00:55+00:00","dateModified":"2023-08-03T21:44:32+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/"},"wordCount":1233,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-card.jpg","keywords":["Credential theft","Microsoft Security Insights"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/","name":"Rethinking cyber scenarios\u2014learning (and training) as you defend | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-card.jpg","datePublished":"2020-01-14T17:00:55+00:00","dateModified":"2023-08-03T21:44:32+00:00","description":"Gamified cybersecurity learning is an increasingly important must-have in your SecOps program.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-card.jpg","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/01\/Rethinking-cyber-scenarios-learning-and-training-as-you-defend-card.jpg","width":440,"height":268},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/01\/14\/rethinking-cyber-scenarios-learning-and-training-as-you-defend\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"Rethinking cyber scenarios\u2014learning (and training) as you defend"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/90441","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/70"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=90441"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/90441\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/90445"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=90441"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=90441"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=90441"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=90441"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=90441"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=90441"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=90441"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}