Time to face the attacks
You have spent the past three days learning about cybersecurity, studying threats, and building your defenses. Now it is time to find out if your security plan actually works. Welcome to the attack phase of the Donuts & Dragons wargame.How the attack phase works
The attack phase simulates real-world cyber and physical threats against your Donuts & Dragons donut shop. Here is the structure:1
The instructor reveals an attack
Your instructor (acting as the Red Team) presents an attack scenario to the entire class. Each scenario describes a specific threat against your shop.
2
Teams check their defenses
Each team (acting as the Blue Team) reviews their purchased security controls. Does your team own the controls that would stop this attack?
3
Score your response
For each correctly implemented control that thwarts the attack, your team earns +1 point. If you don’t have any controls that defend against it, the attack succeeds and you earn nothing for that round.
4
Document your response
Your Report Specialist documents what happened, which controls activated, and what the outcome was. This is your incident response in action.
5
Debrief and discuss
After each attack, the class discusses what happened. Which teams were prepared? Which weren’t? What can everyone learn?
Remember your team roles from Day 1. The Team Captain leads your discussion. The Budget Specialist tracks the financial impact. The Report Specialist documents everything. And everyone is an incident responder.
Attack scenarios
Each attack below represents a realistic threat that a small business like Donuts & Dragons could face. Open each scenario, check whether your team purchased the defending controls, and tally your score.Attack 1: Backdoor breach
Attack 1: Backdoor breach
The scenario
It is 2:00 AM on a Tuesday. An intruder approaches the back entrance of Donuts & Dragons. The door was left unlocked by the closing crew. The intruder enters, grabs cash from the register, takes a laptop from the office, and disappears into the night.The opening manager discovers the break-in at 6:00 AM when they find the register open and the laptop missing.What happened
This is a physical security attack. The attacker didn’t need any technical skills - just an unlocked door and the cover of darkness. The stolen laptop may contain employee records, financial data, and POS configuration files.Controls that thwart this attack
Check your controls and add +1 for each one your team purchased.
Discussion questions
- Why is physical security the foundation of all cybersecurity?
- What data could an attacker extract from a stolen laptop?
- How does this attack relate to the CIA Triad?
Attack 2: Phishing email
Attack 2: Phishing email
The scenario
At 10:15 AM, your lead barista receives an email that appears to be from your POS vendor:From: support@p0s-vendor-update.com Subject: URGENT: Critical Security Update Required Dear Valued Customer, A critical vulnerability has been discovered in your POS system. Please download and install the attached security patch immediately to protect your customers’ payment data. Failure to update within 24 hours may result in PCI compliance violations.The barista, worried about compliance, downloads and runs the “update.” It is ransomware. Within minutes, the POS system and office computer begin encrypting.
What happened
This is a classic phishing attack combined with ransomware deployment. The attacker used urgency (“URGENT,” “24 hours”) and authority (pretending to be the POS vendor) to trick the employee into installing malware.Notice the fake domain:p0s-vendor-update.com - the zero replacing the letter “o” is a common trick.Controls that thwart this attack
Check your controls and add +1 for each one your team purchased.
Discussion questions
- What red flags in the email should have tipped off the barista?
- Why did the attacker mention PCI compliance in the email?
- If you have Cloud Backups but no Antivirus, what happens?
Attack 3: The impersonator
Attack 3: The impersonator
The scenario
At 11:30 AM, a person in business casual walks into Donuts & Dragons and approaches the counter. They flash an official-looking badge and say:“Hi, I’m from the county health department. We’re doing surprise inspections this week. I need to access your office computer to verify your food safety compliance records.”A helpful employee escorts them to the back office. Left alone for “just a few minutes,” the impersonator installs a keylogger on the office computer - a small device plugged between the keyboard and the USB port that records every keystroke, including passwords.
What happened
This is a social engineering attack - specifically, pretexting (creating a fake scenario to gain trust). The “inspector” is not real. The badge is fake. Once the keylogger is installed, the attacker can remotely collect every password typed on that machine.Controls that thwart this attack
Check your controls and add +1 for each one your team purchased.
Discussion questions
- How should employees verify the identity of someone claiming to be an inspector?
- Why is it dangerous to leave a stranger alone with a computer?
- What type of threat actor is this most likely to be?
Attack 4: POS malware via USB drop
Attack 4: POS malware via USB drop
The scenario
During the morning shift, a barista finds a USB drive in the break room labeled “Employee Discount Codes - Summer 2026.” Curious, they plug it into the POS system to see what’s on it.The USB contains no discount codes. Instead, it silently installs card-skimming malware on the POS system. From this moment, every credit and debit card swiped at Donuts & Dragons is copied and sent to the attacker.What happened
This is a USB drop attack (also called baiting). The attacker left an enticing USB drive where an employee would find it, counting on human curiosity to do the rest. The malware specifically targets the POS system to steal payment card data - a direct PCI DSS violation.This is exactly the kind of attack the USB Rubber Ducky you’ll use on Day 5 can perform. The difference: you will use it ethically, for educational purposes.Controls that thwart this attack
Check your controls and add +1 for each one your team purchased.
Discussion questions
- Why would someone plug in a random USB drive they found?
- How long could card-skimming malware go undetected?
- What PCI DSS requirements does this attack violate?
Attack 5: Guest WiFi hijack
Attack 5: Guest WiFi hijack
The scenario
Donuts & Dragons offers free Wi-Fi for customers. An attacker sitting in the corner booth connects to the shop’s Wi-Fi network - the same network the POS system uses.Using a man-in-the-middle (MitM) attack, the attacker positions themselves between the POS system and the payment processor. They intercept card transaction data in transit, collecting card numbers, expiration dates, and CVVs.What happened
Because the POS system and customer Wi-Fi are on the same network, the attacker has a direct path to the POS system. A properly segmented network would place the POS on its own isolated network, invisible to Wi-Fi users.Controls that thwart this attack
Check your controls and add +1 for each one your team purchased.
Discussion questions
- Why is network segmentation one of PCI DSS’s most important requirements?
- How does encrypting transactions protect against a MitM attack?
- What other business systems could an attacker reach from the shared Wi-Fi?
Attack 6: Spoiled inventory
Attack 6: Spoiled inventory
The scenario
Sometime during the night, someone accesses the back area and tampers with the walk-in refrigerator’s thermostat, raising the temperature from 36°F to 68°F. By morning, the entire donut inventory - dough, fillings, dairy - is spoiled. The shop cannot open for business.Estimated loss: $2,500 in inventory plus a full day of lost revenue.What happened
This is a physical sabotage attack targeting availability. The attacker didn’t steal data or install malware - they destroyed business operations by targeting a critical physical asset. This could be a disgruntled former employee, a competitor, or a random act of vandalism.Controls that thwart this attack
Check your controls and add +1 for each one your team purchased.
Discussion questions
- How does this attack relate to the “A” in the CIA Triad?
- What type of threat actor is most likely responsible?
- Is 2,500+ in losses?
Bonus scenario: ransomware strikes
You arrive Monday morning to open the shop. Something is wrong. The POS screen is not showing the usual login. Instead, you see this:🐉 YOUR FILES HAVE BEEN ENCRYPTED All your files have been locked by DragonCrypt ransomware. Your documents, databases, and backups are encrypted with military-grade AES-256 encryption. To recover your data, send 2 Bitcoin (~$140,000) to the following wallet address within 72 hours. After 72 hours, the price doubles. After 7 days, your data is permanently deleted. Do not contact law enforcement. Do not attempt to decrypt. Your only option is to pay.The office computer shows the same screen. The file server shows the same screen. All customer data, payroll records, inventory systems, and transaction history - locked.
The critical question
Does your team have Cloud Backups ($1,200)?- If you have Cloud Backups
- If you don't have Cloud Backups
You call your IT team. They wipe the encrypted systems, rebuild from clean images, and restore all data from the most recent cloud backup. You lose a few hours of data at most. The shop reopens by afternoon.Total cost: A few hours of downtime and IT labor.The ransomware demanded 0.
Bonus scenario: advanced phishing
Your barista receives another email, this time from “HR”:From: hr-benefits@donutsanddragons-hr.com Subject: Action Required: New Benefits Enrollment for 2026 Hi team, Open enrollment for our updated benefits package is now live. Please log in to the benefits portal below to review and update your selections by Friday. [Log in to Benefits Portal →] If you have questions, contact HR at this email address. Best regards, Human ResourcesThe barista clicks the link and lands on a professional-looking login page. They enter their work email and password. The page says “Thank you, your selections have been saved” - but nothing actually happened. The login page was fake. The attacker now has the barista’s credentials.
What makes this dangerous
- The domain
donutsanddragons-hr.comlooks legitimate but is not the real company domain - The email doesn’t contain malware - it won’t trigger antivirus
- The request is reasonable (benefits enrollment happens every year)
- The fake login page looks identical to a real one
What stops it
Multi-factor authentication is not a purchasable control in the wargame, but it is one of the most effective defenses in the real world. Even if a password is compromised, MFA stops the attacker from using it.
Attack debrief
After all scenarios have been played, discuss these questions with your team and the class.Which attacks hit the most teams?
Which attacks hit the most teams?
Look around the room. Which attack scenarios caught the most teams without defenses? Why do you think those controls were under-purchased?Common pattern: Teams with tight budgets often skip physical security controls (locks, cameras) in favor of technical ones - or vice versa. Attackers exploit whatever gap you leave open.
Which single control protected against the most attacks?
Which single control protected against the most attacks?
Review the attack scenarios. Which control appeared in the most “thwarts” lists?Security Awareness Training ($1,500) defends against four of the six core attacks. No other single control matches it. This reflects reality - human awareness is the single most effective defense against social engineering, phishing, and physical intrusion.
If you had unlimited budget, what would you add?
If you had unlimited budget, what would you add?
Imagine money was no object. What additional controls would you purchase? Is there anything the wargame doesn’t offer that you wish you could buy?Think about: network monitoring, intrusion detection systems, incident response retainer, employee background checks, penetration testing.
If you could only buy THREE controls, which three?
If you could only buy THREE controls, which three?
This is the hardest question. With only three controls, you cannot cover everything. What do you prioritize?A strong argument can be made for:
- Security Awareness Training ($1,500) - defends against the most attacks
- Cloud Backups ($1,200) - prevents catastrophic data loss from ransomware
- POS Security Suite ($2,000) - protects the most sensitive data (customer payment cards)
What did you learn about layered defense?
What did you learn about layered defense?
Notice that no single control stops every attack. Real security requires defense in depth - multiple overlapping controls that cover each other’s gaps.
- Physical controls (locks, cameras) stop physical intrusion
- Technical controls (antivirus, POS suite, backups) stop digital attacks
- Administrative controls (training, policies) stop human error
Scoring summary
Use this table to track your team’s score across all six attack scenarios. Mark a ✓ for each control you purchased that defends against each attack.Key takeaways
No budget covers everything
Real organizations face the same budget constraints you did. Security is about prioritizing risks and making the best choices with what you have.
People are the best defense
Security Awareness Training stopped more attacks than any other single control. Technology alone is not enough - trained humans are your strongest layer.
Backups save businesses
Without Cloud Backups, a single ransomware attack can end a small business. Backups are the ultimate safety net.
Defense in depth works
No single control stops every attack. Layer physical, technical, and administrative controls so that if one fails, another catches the threat.