> ## Documentation Index
> Fetch the complete documentation index at: https://stem-docs.intellectualpoint.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Wargame: attack phase
> Face real-world attack scenarios against your Donuts & Dragons defenses and see if your security plan holds up.
## Time to face the attacks
You have spent the past three days learning about cybersecurity, studying threats, and building your defenses. Now it is time to find out if your security plan actually works.
Welcome to the **attack phase** of the Donuts & Dragons wargame.
This is the moment of truth. Every control you purchased - and every control you didn't - will be tested. There are no second chances to buy more controls. You go to battle with what you have.
***
## How the attack phase works
The attack phase simulates real-world cyber and physical threats against your Donuts & Dragons donut shop. Here is the structure:
Your instructor (acting as the **Red Team**) presents an attack scenario to the entire class. Each scenario describes a specific threat against your shop.
Each team (acting as the **Blue Team**) reviews their purchased security controls. Does your team own the controls that would stop this attack?
For each correctly implemented control that thwarts the attack, your team earns **+1 point**. If you don't have any controls that defend against it, the attack succeeds and you earn nothing for that round.
Your Report Specialist documents what happened, which controls activated, and what the outcome was. This is your incident response in action.
After each attack, the class discusses what happened. Which teams were prepared? Which weren't? What can everyone learn?
Remember your team roles from Day 1. The **Team Captain** leads your discussion. The **Budget Specialist** tracks the financial impact. The **Report Specialist** documents everything. And **everyone** is an incident responder.
***
## Attack scenarios
Each attack below represents a realistic threat that a small business like Donuts & Dragons could face. Open each scenario, check whether your team purchased the defending controls, and tally your score.
### The scenario
It is 2:00 AM on a Tuesday. An intruder approaches the back entrance of Donuts & Dragons. The door was left unlocked by the closing crew. The intruder enters, grabs cash from the register, takes a laptop from the office, and disappears into the night.
The opening manager discovers the break-in at 6:00 AM when they find the register open and the laptop missing.
### What happened
This is a **physical security** attack. The attacker didn't need any technical skills - just an unlocked door and the cover of darkness. The stolen laptop may contain employee records, financial data, and POS configuration files.
### Controls that thwart this attack
| Control | Cost | How it helps |
| -------------------- | ------- | ------------------------------------------------------------------------------------------ |
| Deadbolt Locks | \$800 | Prevents unauthorized physical entry even if staff forgets to lock up |
| Monitored Alarm | \$3,000 | Triggers an alert to the security monitoring company the moment the door opens after hours |
| Lockable Cash Drawer | \$500 | Even if the intruder enters, they cannot access cash without the key |
| Interior Cameras | \$2,000 | Records the intruder's face and actions, providing evidence for law enforcement |
**Check your controls and add +1 for each one your team purchased.**
### Discussion questions
* Why is physical security the foundation of all cybersecurity?
* What data could an attacker extract from a stolen laptop?
* How does this attack relate to the CIA Triad?
### The scenario
At 10:15 AM, your lead barista receives an email that appears to be from your POS vendor:
> **From:** [support@p0s-vendor-update.com](mailto:support@p0s-vendor-update.com)
> **Subject:** URGENT: Critical Security Update Required
>
> Dear Valued Customer,
>
> A critical vulnerability has been discovered in your POS system. Please download and install the attached security patch immediately to protect your customers' payment data.
>
> Failure to update within 24 hours may result in PCI compliance violations.
The barista, worried about compliance, downloads and runs the "update." It is ransomware. Within minutes, the POS system and office computer begin encrypting.
### What happened
This is a classic **phishing attack** combined with **ransomware deployment**. The attacker used urgency ("URGENT," "24 hours") and authority (pretending to be the POS vendor) to trick the employee into installing malware.
Notice the fake domain: `p0s-vendor-update.com` - the zero replacing the letter "o" is a common trick.
### Controls that thwart this attack
| Control | Cost | How it helps |
| --------------------------- | ------- | ----------------------------------------------------------------------------------------------------------- |
| Antivirus | \$800 | Detects and blocks the ransomware before it can execute |
| Security Awareness Training | \$1,500 | Teaches employees to recognize phishing emails - suspicious sender, urgency tactics, unexpected attachments |
| Cloud Backups | \$1,200 | Even if ransomware encrypts everything, you can restore from a clean backup without paying the ransom |
**Check your controls and add +1 for each one your team purchased.**
### Discussion questions
* What red flags in the email should have tipped off the barista?
* Why did the attacker mention PCI compliance in the email?
* If you have Cloud Backups but no Antivirus, what happens?
### The scenario
At 11:30 AM, a person in business casual walks into Donuts & Dragons and approaches the counter. They flash an official-looking badge and say:
> "Hi, I'm from the county health department. We're doing surprise inspections this week. I need to access your office computer to verify your food safety compliance records."
A helpful employee escorts them to the back office. Left alone for "just a few minutes," the impersonator installs a **keylogger** on the office computer - a small device plugged between the keyboard and the USB port that records every keystroke, including passwords.
### What happened
This is a **social engineering** attack - specifically, **pretexting** (creating a fake scenario to gain trust). The "inspector" is not real. The badge is fake. Once the keylogger is installed, the attacker can remotely collect every password typed on that machine.
### Controls that thwart this attack
| Control | Cost | How it helps |
| --------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------ |
| Smart Access System | \$1,200 | Restricts access to the office area - requires badge or code. A stranger cannot walk in unchallenged. |
| Security Awareness Training | \$1,500 | Teaches employees to verify identities, never leave strangers alone with equipment, and report suspicious visitors |
| Antivirus | \$800 | Some antivirus tools detect keylogger software (though hardware keyloggers are harder to catch) |
| Interior Cameras | \$2,000 | Records the impersonator installing the device, providing evidence and deterrent |
**Check your controls and add +1 for each one your team purchased.**
### Discussion questions
* How should employees verify the identity of someone claiming to be an inspector?
* Why is it dangerous to leave a stranger alone with a computer?
* What type of threat actor is this most likely to be?
### The scenario
During the morning shift, a barista finds a USB drive in the break room labeled **"Employee Discount Codes - Summer 2026."** Curious, they plug it into the POS system to see what's on it.
The USB contains no discount codes. Instead, it silently installs **card-skimming malware** on the POS system. From this moment, every credit and debit card swiped at Donuts & Dragons is copied and sent to the attacker.
### What happened
This is a **USB drop attack** (also called **baiting**). The attacker left an enticing USB drive where an employee would find it, counting on human curiosity to do the rest. The malware specifically targets the POS system to steal payment card data - a direct PCI DSS violation.
This is exactly the kind of attack the **USB Rubber Ducky** you'll use on Day 5 can perform. The difference: you will use it ethically, for educational purposes.
### Controls that thwart this attack
| Control | Cost | How it helps |
| --------------------------- | ------- | ---------------------------------------------------------------------------------------------------- |
| POS Security Suite | \$2,000 | Locks down the POS system so unauthorized software cannot be installed, even from a USB device |
| Security Awareness Training | \$1,500 | Teaches employees to **never** plug unknown USB devices into any computer, especially the POS system |
**Check your controls and add +1 for each one your team purchased.**
### Discussion questions
* Why would someone plug in a random USB drive they found?
* How long could card-skimming malware go undetected?
* What PCI DSS requirements does this attack violate?
### The scenario
Donuts & Dragons offers free Wi-Fi for customers. An attacker sitting in the corner booth connects to the shop's Wi-Fi network - the same network the POS system uses.
Using a **man-in-the-middle (MitM) attack**, the attacker positions themselves between the POS system and the payment processor. They intercept card transaction data in transit, collecting card numbers, expiration dates, and CVVs.
### What happened
Because the POS system and customer Wi-Fi are on the **same network**, the attacker has a direct path to the POS system. A properly segmented network would place the POS on its own isolated network, invisible to Wi-Fi users.
### Controls that thwart this attack
| Control | Cost | How it helps |
| ------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| POS Security Suite | \$2,000 | Encrypts POS transactions end-to-end, making intercepted data useless to the attacker |
| Antivirus | \$800 | Detects MitM tools running on the network |
| Separate Guest WiFi | \$1,000 | Isolates customer Wi-Fi from the business network. The POS system is on a completely separate network segment that Wi-Fi users cannot reach. |
**Check your controls and add +1 for each one your team purchased.**
### Discussion questions
* Why is network segmentation one of PCI DSS's most important requirements?
* How does encrypting transactions protect against a MitM attack?
* What other business systems could an attacker reach from the shared Wi-Fi?
### The scenario
Sometime during the night, someone accesses the back area and tampers with the walk-in refrigerator's thermostat, raising the temperature from 36°F to 68°F. By morning, the entire donut inventory - dough, fillings, dairy - is spoiled. The shop cannot open for business.
Estimated loss: \$2,500 in inventory plus a full day of lost revenue.
### What happened
This is a **physical sabotage** attack targeting **availability**. The attacker didn't steal data or install malware - they destroyed business operations by targeting a critical physical asset. This could be a disgruntled former employee, a competitor, or a random act of vandalism.
### Controls that thwart this attack
| Control | Cost | How it helps |
| -------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| Fridge Lock & Temp Monitor | \$400 | Locks the fridge controls and sends an alert if the temperature deviates from the safe range, allowing staff to respond before inventory is lost |
| Interior Cameras | \$2,000 | Records who accessed the back area and when, providing evidence and deterrent |
**Check your controls and add +1 for each one your team purchased.**
### Discussion questions
* How does this attack relate to the "A" in the CIA Triad?
* What type of threat actor is most likely responsible?
* Is $400 for a fridge lock worth it to prevent $2,500+ in losses?
***
## Bonus scenario: ransomware strikes
This scenario is a narrative - it does not count toward your team's score. But it demonstrates why one particular control is more valuable than any other.
You arrive Monday morning to open the shop. Something is wrong. The POS screen is not showing the usual login. Instead, you see this:
> 🐉 **YOUR FILES HAVE BEEN ENCRYPTED**
>
> All your files have been locked by DragonCrypt ransomware. Your documents, databases, and backups are encrypted with military-grade AES-256 encryption.
>
> To recover your data, send **2 Bitcoin** (\~\$140,000) to the following wallet address within 72 hours. After 72 hours, the price doubles. After 7 days, your data is permanently deleted.
>
> **Do not contact law enforcement.** Do not attempt to decrypt. Your only option is to pay.
The office computer shows the same screen. The file server shows the same screen. All customer data, payroll records, inventory systems, and transaction history - locked.
### The critical question
**Does your team have Cloud Backups (\$1,200)?**
You call your IT team. They wipe the encrypted systems, rebuild from clean images, and restore all data from the most recent cloud backup. You lose a few hours of data at most. The shop reopens by afternoon.
**Total cost:** A few hours of downtime and IT labor.
The ransomware demanded $140,000. You paid $0.
You have three options, and none of them are good:
1. **Pay the ransom (\$140,000+).** Even then, there is no guarantee the attacker will actually provide the decryption key. The FBI reports that about 20% of organizations that pay never get their data back.
2. **Rebuild from scratch.** Reinstall everything, re-enter all data manually, contact every customer whose data was lost. Estimated time: 2-4 weeks. Estimated cost: potentially more than the ransom when you factor in lost business.
3. **Close the business.** For some small businesses, a ransomware attack without backups is the end. They simply cannot recover.
**The lesson:** Cloud Backups at \$1,200 is the single most important control in the entire game. Without it, a single ransomware attack can destroy everything.
***
## Bonus scenario: advanced phishing
Your barista receives another email, this time from "HR":
> **From:** [hr-benefits@donutsanddragons-hr.com](mailto:hr-benefits@donutsanddragons-hr.com)
> **Subject:** Action Required: New Benefits Enrollment for 2026
>
> Hi team,
>
> Open enrollment for our updated benefits package is now live. Please log in to the benefits portal below to review and update your selections by Friday.
>
> **\[Log in to Benefits Portal →]**
>
> If you have questions, contact HR at this email address.
>
> Best regards,
> Human Resources
The barista clicks the link and lands on a professional-looking login page. They enter their work email and password. The page says "Thank you, your selections have been saved" - but nothing actually happened. The login page was fake. The attacker now has the barista's credentials.
### What makes this dangerous
* The domain `donutsanddragons-hr.com` looks legitimate but is not the real company domain
* The email doesn't contain malware - it won't trigger antivirus
* The request is reasonable (benefits enrollment happens every year)
* The fake login page looks identical to a real one
### What stops it
| Control | How it helps |
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Security Awareness Training** (\$1,500) | Teaches employees to verify email domains, hover over links before clicking, and report suspicious emails |
| **Multi-Factor Authentication (concept)** | Even with stolen credentials, the attacker cannot log in without the second factor (phone code, authenticator app) |
Multi-factor authentication is not a purchasable control in the wargame, but it is one of the most effective defenses in the real world. Even if a password is compromised, MFA stops the attacker from using it.
***
## Attack debrief
After all scenarios have been played, discuss these questions with your team and the class.
Look around the room. Which attack scenarios caught the most teams without defenses? Why do you think those controls were under-purchased?
Common pattern: Teams with tight budgets often skip physical security controls (locks, cameras) in favor of technical ones - or vice versa. Attackers exploit whatever gap you leave open.
Review the attack scenarios. Which control appeared in the most "thwarts" lists?
**Security Awareness Training (\$1,500)** defends against four of the six core attacks. No other single control matches it. This reflects reality - human awareness is the single most effective defense against social engineering, phishing, and physical intrusion.
Imagine money was no object. What additional controls would you purchase? Is there anything the wargame doesn't offer that you wish you could buy?
Think about: network monitoring, intrusion detection systems, incident response retainer, employee background checks, penetration testing.
This is the hardest question. With only three controls, you cannot cover everything. What do you prioritize?
A strong argument can be made for:
1. **Security Awareness Training** (\$1,500) - defends against the most attacks
2. **Cloud Backups** (\$1,200) - prevents catastrophic data loss from ransomware
3. **POS Security Suite** (\$2,000) - protects the most sensitive data (customer payment cards)
Total: \$4,700. But other combinations are valid - defend your choices.
Notice that no single control stops every attack. Real security requires **defense in depth** - multiple overlapping controls that cover each other's gaps.
* Physical controls (locks, cameras) stop physical intrusion
* Technical controls (antivirus, POS suite, backups) stop digital attacks
* Administrative controls (training, policies) stop human error
An attacker only needs to find **one** gap. You need to cover **all** of them.
***
## Scoring summary
Use this table to track your team's score across all six attack scenarios. Mark a **✓** for each control you purchased that defends against each attack.
| Attack | Control 1 | Control 2 | Control 3 | Control 4 | Team score |
| -------------------------- | ---------------------------------- | ------------------------------------- | ----------------------------- | -------------------------- | ---------- |
| **1. Backdoor breach** | Deadbolt Locks (\$800) | Monitored Alarm (\$3,000) | Lockable Cash Drawer (\$500) | Interior Cameras (\$2,000) | /4 |
| **2. Phishing email** | Antivirus (\$800) | Security Awareness Training (\$1,500) | Cloud Backups (\$1,200) | - | /3 |
| **3. The impersonator** | Smart Access System (\$1,200) | Security Awareness Training (\$1,500) | Antivirus (\$800) | Interior Cameras (\$2,000) | /4 |
| **4. POS malware via USB** | POS Security Suite (\$2,000) | Security Awareness Training (\$1,500) | - | - | /2 |
| **5. Guest WiFi hijack** | POS Security Suite (\$2,000) | Antivirus (\$800) | Separate Guest WiFi (\$1,000) | - | /3 |
| **6. Spoiled inventory** | Fridge Lock & Temp Monitor (\$400) | Interior Cameras (\$2,000) | - | - | /2 |
| | | | | **Total** | **/18** |
A perfect score of 18 would require purchasing **every** control - which your budget probably didn't allow. The real lesson is not about getting a perfect score. It is about making smart decisions with limited resources, just like real security teams do every day.
***
## Key takeaways
Real organizations face the same budget constraints you did. Security is about prioritizing risks and making the best choices with what you have.
Security Awareness Training stopped more attacks than any other single control. Technology alone is not enough - trained humans are your strongest layer.
Without Cloud Backups, a single ransomware attack can end a small business. Backups are the ultimate safety net.
No single control stops every attack. Layer physical, technical, and administrative controls so that if one fails, another catches the threat.