Stuck on a mission? Start here.

Look before you act. Scan and Trace raise evidence quality. The clinical systems are reached through the File Server, so follow the route from the Email Gateway down to see how far the attacker can get.

Use your first turn to trace the Staff Workstations and the Email Gateway, then patch the Staff Workstations (2 AP). Restore anything that turns red, and conclude once nothing is compromised. The walkthrough above shows these steps.

The attacker starts inside, on the VPN Endpoint, the Dev Workstations and the Build Server. The Source Code Repository connects only to the Build Server, so it is one hop from danger. The board is wider than the screen, so drag it to see the Mail Server side.

Turn 1: Scan and Trace the Dev Workstations, then isolate the route from the Build Server to the Source Code Repository (tap the route line, then Isolate). Turn 2: the attacker heads for the Staging Environment, one hop from the Customer Database. Isolate the route between them, then put a Honeypot (2 AP) on Staging. It diverts the attacker and raises your evidence quality. Once evidence is Medium or better, Restore the red systems one at a time over turns 3 to 5 (Build Server, Dev Workstations, VPN Endpoint; 2 AP each), Trace until evidence is High, and conclude on a clean board. The walkthrough above finishes in 5 turns. Do not leave the attacker alone for long: if it digs in (persistence), Trust drops every turn.

Everything the attacker does starts at the CDN Gateway, and its only way onward is the Web Server. Public Notice costs Trust that you cannot win back, so only use it when your evidence supports it.

Isolating the route between the CDN Gateway and the Web Server (1 AP) closes every path at once, as long as the attacker has not already passed it. Use the rest of your AP to Scan and Trace. Broadcast Control can be reached two ways, through the Broadcast Encoder (via the CMS Platform) and through the Playout System (via the Editorial Workstations), so watch both. Use Restore Link to reconnect the route when the board is clean.

The Vendor Integration Link connects only to the DMZ Router. From there two roads lead toward power: one through the Historian Gateway and SCADA Gateway, the other through the Engineering Workstations and the HMI Workstation.

Isolate the link between the Vendor Integration Link and the DMZ Router early (1 AP). If the attacker is already past it, isolate the DMZ Router’s routes to the Historian Gateway and to the Engineering Workstations (1 AP each) so that neither road opens. The Power Management System is the last stop before the SCADA Control Node, so guard it, and use spare AP to Trace.

You only have 2 AP a turn. Scan, Trace and Isolate cost 1 AP, so you can do two of them. A Patch costs 2 AP, which is both of your AP. The Trading Gateway connects only to the Web Proxy.

Isolate the route between the Trading Gateway and the Web Proxy first, then Trace. Everything onward passes through the Message Queue and then the SWIFT Connector, which connects to both the SWIFT Gateway and the Settlement Database (the road to the Core Banking Database). A second isolation at the SWIFT Connector, on a later turn, is a good safety net.