SHIFT3:00
CONTAINMENTS
ESTATE9/9
— tap a machine

BLUE HOUR

INCIDENT RESPONSE SHIFT · CYBERSECURITY ENCYCLOPEDIA

Something is already inside the network. You have three minutes, four containments, and no idea which machines answer to someone else.

1
Alerts are only leads. Machines ping when something happens nearby — and half the pings are noise.
2
LOOK before you act. Telemetry tells you the truth about one machine for a few seconds. You cannot watch everything at once.
3
CONTAIN stops the spread — and you only get four. Cut off a healthy machine and you have spent one on somebody's working night.
★
Protect the vault. The gold machine holds the backups. If the intrusion reaches it, the shift is over.
SOUND: ON
TAP a machine, then LOOK or CONTAIN   DRAG to turn the estate
L look   C contain   TAB next machine   M mute
← CYBERSECURITY ENCYCLOPEDIA FONDSITE

SHIFT OVER

DEFENSIVE LEARNING BOUNDARY This estate and everything in it is fictional. The game is about triage judgement — look before you act, and know what an action costs — not about techniques. It contains no exploit steps and no malware.
← CYBERSECURITY ENCYCLOPEDIA FONDSITE