DDOS

​Objectives:
Attackers: Execute a DDoS attack on TechNova Corp by launching a flood of malicious traffic to overwhelm their servers and take down their services.
Defenders: Detect, respond to, and mitigate the DDoS attack while keeping services operational and minimizing downtime.
Game Setup:
Players:

One player acts as the Attacker.
One player acts as the Defender.
Deck Composition:

Attacker's Deck: Composed of reconnaissance, botnet deployment, and traffic flood cards.
Defender's Deck: Composed of detection, mitigation, and recovery cards, including traffic filtering and server hardening tools.
Starting Hands:

Both players draw 7 cards to start.
Players can mulligan once if they are not satisfied with their starting hand.
Gameplay Phases:
Attackers:
Recon Phase:

Perform reconnaissance to gather information about TechNova Corp's network.
Use cards like "Network Scanning," "Traffic Analysis," and "Vulnerability Probe" to identify weak points.
Botnet Deployment Phase:

Deploy botnets to prepare for the DDoS attack.
Use cards like "Botnet Command," "Malware Distribution," and "Compromised Devices."
Traffic Flood Phase:

Launch the DDoS attack by flooding the target's servers with malicious traffic.
Use cards like "HTTP Flood," "SYN Flood," and "Amplification Attack."
Defenders:
Detection Phase:

Identify and detect the DDoS attack early.
Use cards like "Anomaly Detection," "Traffic Monitoring," and "Intrusion Detection System (IDS)."
Mitigation Phase:

Respond to the attack by mitigating malicious traffic and protecting servers.
Use cards like "Rate Limiting," "Web Application Firewall (WAF)," and "Traffic Scrubbing."
Recovery/Reinforce Phase:

Recover from the attack and reinforce defenses to prevent future incidents.
Use cards like "Server Redundancy," "Load Balancer," and "Incident Response Team."
Example Cards:
Attacker Cards:
Botnet Command:

Type: Botnet Deployment
Effect: Deploy a botnet to launch a DDoS attack. Allows the attacker to draw 2 additional traffic flood cards.
SYN Flood:

Type: Traffic Flood
Effect: Overwhelm the target’s server with SYN packets. If successful, the defender must discard 2 cards from their hand.
Amplification Attack:

Type: Traffic Flood
Effect: Use amplification techniques to increase traffic volume. The attacker can play an additional traffic flood card in the next turn.
Defender Cards:
Traffic Monitoring:

Type: Detection
Effect: Monitor network traffic for anomalies. Allows the defender to reveal the attacker’s hand and discard one traffic flood card.
Web Application Firewall (WAF):

Type: Mitigation
Effect: Block malicious traffic. The attacker cannot play any traffic flood cards in the next turn.
Server Redundancy:

Type: Recovery/Reinforce
Effect: Utilize backup servers to maintain operations. Restore 2 discarded cards to the defender’s hand.
Victory Conditions:
Attacker Wins: If the attacker successfully overwhelms TechNova Corp’s servers, leading to significant downtime and operational disruption.
Defender Wins: If the defender successfully detects, mitigates, and recovers from the DDoS attack while maintaining service availability.
Campaign Notes:
Encourage strategic thinking and coordination between reconnaissance, attack, detection, and mitigation phases.
Highlight real-world cybersecurity practices and techniques for managing and defending against DDoS attacks.
Conclude with a debrief to discuss the strategies used and the lessons learned, reinforcing the educational aspect of the campaign.