Shane Steiger Are You Playing with a Full Deck

### The Asymmetry of the Cyber Attack Lifecycle In cybersecurity operations, defensive teams often struggle with operational fatigue, attempting to monitor every endpoint, patch every vulnerability, and inspect every network packet. Meanwhile, threat actors need only discover a single misconfiguration or unpatched flaw to achieve their objectives. In this presentation, veteran security architect Shane Steiger introduces "Maelstrom," a structured tabletop simulation and card game framework designed to educate security teams, demonstrate attack lifecycle dynamics, and transform defensive operational strategy.

### Modeling Threat Actors as Enterprise Project Managers Steiger challenges the myth of the lone, erratic hacker by presenting advanced persistent threat (APT) teams as disciplined corporate project managers: - **The Shift Work Reality:** Analysis of advanced adversary command-and-control operations reveals clear business hours, scheduled lunch breaks, and shift handovers, reflecting organized operational teams working within state or criminal enterprises. - **Project Schedules and Script Execution:** Attack campaigns operate with milestones, dependencies, and execution scripts. When tools fail or scripts encounter unexpected syntax errors, adversaries make observable mistakes, page support colleagues, and retry operations. - **Dependencies and Resource Constraints:** Attackers possess limited time, specific toolsets, and finite human capital. Steiger argues that instead of reacting passively to adversary actions, defenders can strategically target and disrupt the attacker's underlying "project plan."

### The Maelstrom Game: Rules and Conceptual Mechanics The Maelstrom game operationalizes the Cyber Attack Lifecycle (synthesized from the Lockheed Martin Cyber Kill Chain, Mandiant threat models, and the MITRE CAPEC catalog): - **Phased Progression:** Players navigate through seven distinct phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control (C2), and Actions on Objectives. - **Card Categories:** Players draw Attack Technique cards (e.g., spear-phishing, port scanning, lateral movement via WMI/PsExec) and must assemble the requisite prerequisites before executing actions. - **Defensive Counter-Plays:** Defensive cards represent security capabilities categorized as Preventative, Detective, Deceptive, or Responsive. By laying down controls at specific milestones, defenders force attackers to discard cards, divert effort, or accumulate delays.

### Defending by Attacking the Attacker's Project Plan The core strategic insight of Maelstrom is using defensive controls to induce maximum friction, delay, and scope creep on the adversary: - **Introducing Scope Creep:** Defenders can deliberately deploy "honey information"—fabricated internal documents, fake network shares, and synthetic credential logs planted within directory structures—that adversaries must spend time analyzing and validating. - **Depleting Attacker Resources:** Introducing tarpits, honeypots, and decoy infrastructure forces adversaries into unproductive rabbit holes, burning their limited operational windows and exposing their proprietary toolchains. - **Choke-Point Invalidation:** Eliminating vital lateral movement mechanisms (such as disabling unconstrained delegation or restricting administrative tool protocols) severs predecessor dependencies, forcing attackers back to earlier, high-risk operational phases.

### Strategic Resource Allocation and Defensive ROI The card game format provides a powerful visual metric for measuring defensive return on investment (ROI): - **The Pitfalls of Big Data Lakes:** Steiger demonstrates that massive security information and event management (SIEM) investments and petabyte data lakes often yield poor operational ROI, offering only late-stage, post-exploitation detective visibility while consuming exorbitant engineering budgets. - **Prioritizing Asymmetric Disruptions:** High-ROI investments focus on proactive architecture hardening, deception technology, credential segregation, and host-level execution controls. By gamifying these trade-offs, Maelstrom enables technical teams to clearly evangelize strategic security priorities to executive leadership.

(AI summary — Gemini 3.8 Flash)