Over the years, I’ve been fortunate to work with many different organizations from various industries around the world as a consultant tasked with changing security behaviors. My first steps always include assessing the company’s security awareness program and measuring its security culture, because without a baseline, it’s difficult to show any return on investment.

I always try to create a buzz around security to help make sure these behavioral changes stick. I’m not referring to the posters, mouse pads, mugs and articles that are traditionally passed around. Instead, I focus on game-based security learning designed to engage employees.

One concept that’s been a huge success is a simple classroom-based exercise that combines the setting of an escape room with components of security training. There are many vendors out there offering this type of training, but without bringing these vendors in, it’s still easy to run an escape room on a budget. In fact, I was able to build my concept for around $30 per group.

How Does a Security Escape Room Work?

My information security escape room draws from similar training exercises conducted by my peers and incorporates my own research into how traditional escape room game mechanics work. The objective of the game is to find a 13-digit password. Let’s take a closer look at each step of the process.

Stage 1: Identify

First, participants receive several email templates, including a mixture of phishing and genuine emails. Each email has a number at the top.

Participants must separate the emails so they are left with only the phishing messages and a set of corresponding numbers. For training purposes, these numbers can be the number of your IT help desk or phishing help line, for example.

Stage 2: Brute Force

Next, participants are asked to unlock a toolbox. The numbers they identify should correspond to all but one of the numbers needed to unlock the box. Participants input the numbers into the lock and circle through the possibilities for the last number until they open the toolbox.

Inside the toolbox is a wooden box that is designed to open when the lid is pulled in a certain direction. Once opened, participants will find an ultraviolet (UV) light.

Stage 3: Translate

Also inside the toolbox is a dictionary. Written on the front cover is a page number and a string of ASCII characters. When participants turn to the correct page, they’ll find the word “binary” circled. They’ll then need to convert the ASCII characters into binary to find three more page numbers. On the respective pages, the words “under,” “the” and “chair” are circled.

Stage 4: Find, Assemble and Hunt

Participants are asked to look under their chairs. Taped to the bottom of one of the chairs is a note prompting the participants to speak to the training facilitator, who gives them a paper puzzle. Once assembled, the puzzle reads “top right corner.”

If participants shine the UV light found earlier in the exercise in the top right corner, they’ll reveal the 13-digit password needed to end the game.

Make Sure the Security Lessons Stick

Let’s be honest: Most people who participate in an escape room activity aren’t in it for learning opportunity. However, it’s possible to organically weave in security lessons that will prove valuable to your team in the future.

Start the exercise with a security presentation — something along the lines of: “Everything I’m about to tell you will help you complete the escape room within the allocated time. Every team that completes the game will have paid attention to the following presentation.” If you do this, I guarantee that most participants will have a full page full of notes by the time you’re done talking.

Loosely tie each stage of the game to a security concept. For example, stage one (Identify) might focus on how to spot and report phishing incidents, and stage five (Find) can focus on threat detection.

At the end of the presentation, conduct a quiz. Let participants know that each correct answer will unlock a clue that can be used throughout the information security escape room. Finally, conduct a survey after the exercise to reinforce the lessons and key takeaways.

Feedback on my escape room concept has always been positive — not only around the interactive gaming experience, but also the educational aspect. The key is to remember that an escape room is only as successful as the energy you create in the room. So make sure you smile, engage with participants and relay your security training information with passion.

More from Incident Response

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Everyone Wants to Build a Cyber Range: Should You?

In the last few years, IBM X-Force has seen an unprecedented increase in requests to build cyber ranges. By cyber ranges, we mean facilities or online spaces that enable team training and exercises of cyberattack responses. Companies understand the need to drill their plans based on real-world conditions and using real tools, attacks and procedures. What’s driving this increased demand? The increase in remote and hybrid work models emerging from the COVID-19 pandemic has elevated the priority to collaborate and…

People, Process and Technology: The Incident Response Trifecta

Let's say you are the CISO or IT security lead of your organization, and your incident response program needs an uplift. After making a compelling business case to management for investment, your budget has been approved and expanded. With your newfound wealth, you focus on acquiring technology that will improve your monitoring, detection and analysis of data traffic. Has the incident program really improved by the technology acquisition, or is the uplift merely cosmetic? If no other changes have been…

Self-Checkout This Discord C2

This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by an attacker to introduce a command and control (C2) channel built upon Discord channel messages. Discord is a chat, voice, and video service enabling users to join and create communities associated with their interests. While Discord and its related software…