tabletop excercise cootie catcher

This interstitial from BSidesLV 2021's Camp Stay At Home segment is a playful craft session hosted by a camp counselor character. Its subject is a paper fold-and-write tool, known as a cootie catcher, that can be used to build a tabletop exercise on the spot.

The segment walks through the folding steps. The host creases a square sheet, folds the corners into the center, and then marks the visible panels. The outer flaps are labeled for threat actors, such as an insider, the next layer for attack vectors, such as a misconfiguration, and the eight inner triangles for business impacts, such as the loss of employee personal data. Players choose a value from each layer, open the folds, and read out the resulting scenario.

The host finishes by refolding the paper into its finger-puppet shape, with the threat actors showing on the outside. The takeaway is a low-cost, low-tech way for a group to generate and vary incident response scenarios before running a discussion-based exercise.