Gamification of Information Security …Pauldotcom(mailist )

Gamification has been the buzz for the past few years. Game design concepts are appearing in everyday interactions like education, physical fitness/wellness, automotive design and even personal finances [and]. I am thinking about ways to use gameplay mechanics to reward employees for completing otherwise mundane tasks. I want to unlock that achievement “Making Work Fun”.

Typical gaming techniques include:

achievement “badges”

achievement levels

“leader boards”

a progress bar or other visual meter to indicate how close people are to completing a task a company is trying to encourage, such as completing a social networking profile or earning a frequent shopper loyalty award.

virtual currency

systems for awarding, redeeming, trading, gifting, and otherwise exchanging points

challenges between users

embedding small casual games within other activities

There are hacker challenges and competitions that encourage youth into the field of information security (or used as a recruiting ground by government agencies or companies)

What could day-to-day gamification of Information Security in the workplace look like? I want to brainstorm a few ideas first without thinking about the specific implementation (as this may put constraints or limits on the mechanics of the awards).

For example, awards could be something like:

“Security First”: # of days without violating security policy or acceptable use (30 days, 90 days, 6 months, 1 year, 2 years, 5 years)

“Security Smarts”: # of hours of security awareness training completed (users could also get credits for reading security bulletins).

“Security Star”: based on the score an employee receives on security awareness quiz (bronze: >80%, silver: >90%, gold: 100%)

“Strong Passwords”: employee uses strong passwords

“Memory Like an Elephant” – # days without a password reset (30 days, 90 days, 6 months, 1 year, 2 years, 5 years)

“Security Points”: some form of currency or experience points for completing security related tasks or activities

For IT staff there are other things I can think of regarding service management, system management, patch management, change management and risk management (this can apply to most employees).

Maybe these are tracked and displayed individually or as a department to foster friendly competition and encourage better security practices. Maybe these are used as part of an annual performance review.

Basically, informatio security departments tends to get a bad reputation because they are the stick enforcing security policies. I’m trying to think of ways to be the carrot. I would rather provide a wall of fame for the superstars rather than a wall of shame (though I remember in one organization we had a giant screw mounted on a piece of wood… “screw up award”… it was the hot potato… we were always quick to pass it along to the next deserving coworker).

Any examples of gamification you’ve experienced in the workplace? Or, can you think of any ways to gamify information security?


taken from :


Vulnerable by Design by g0tm1k blog’s

Hi again folks,reading my feeds i found a interesting post with the most important enviroments for practice your skills hacking, i wait that you like :

Pentest lab. “Hacker” training. Deliberately insecure applications challenge thingys.

Call it what you will, but what happens when you want to try out your new set of skills? Do you want to be compare results from a tool when it’s used in different environments? What if you want to explore a system (that is legal to do so!) that you have no knowledge about (because you didn’t set it up!)
If any of that sounds helpful, below is a small collection of different environments, so if you want to go from “boot to root”, “capture the flag” or just to dig around as much as you want to try out the odd thing here and there. These will allow you to do so and without getting in trouble for doing it!

The idea isn’t to cheat, the aim is to learn a thing or two 😉
I’m sure there are a lot more out there, if you want to recommend any others – please so do! =)

Complete Operating System. The idea of going from boot to root via any which way you can. Most of them have multiple entry points (some are easier than others) so you can keep using it 😉  They are all Linux OS (either in ISO or VM form) with vulnerable/configured software installed. (If you haven’t got any VM software, VMware Playeris free and will do the trick)

(Offline) Web based. Most of them you’ll need to download, copy and load the files yourself on your own web server (if you haven’t already got one, xampp is great). A few of them are VM images that can be loaded in to Virtual machines as they come with all the software & settings needed.

(Online) Web based. Same as above, however if you don’t want the hassle of setting it all up or to be able to do it where ever you have a Internet connection…

Complete Operating System
Name: Damn Vulnerable Linux

Brief descriptionDamn Vulnerable Linux (DVL) is everything a good Linux distribution isn’t. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. DVL isn’t built to run on your desktop – it’s a learning tool for security students.
Version/Levels: 1

Name: De-ICE

Homepage or
Brief descriptionThe PenTest LiveCDs are the creation of Thomas Wilhelm, who was transferred to a penetration test team at the company he worked for. Needing to learn as much about penetration testing as quickly as possible, Thomas began looking for both tools and targets. He found a number of tools, but no usable targets to practice against. Eventually, in an attempt to narrow the learning gap, Thomas created PenTest scenarios using LiveCDs.
Version/LevelsLevel 1 – Disk 1Level 1 – Disk 2Level 2 – Disk 1
Support/Walk-throughForumsWiki,  Level 1 – Disk 1Level 1 – Disk 2Level 2 – Disk 1

Name: Holynix

Brief descriptionHolynix is a Linux distribution that was deliberately built to have security holes for the purposes of penetration testing.

Name: Kioptrix

Brief descriptionThis Kioptrix VM Image are easy challenges. The object of the game is to acquire
root access via any means possible (except actually hacking the VM server or player).
The purpose of these games are to learn the basic tools and techniques in vulnerability
assessment and exploitation. There are more ways then one to successfully complete the challenges.

Version/Levels: 2
Support/Walk-throughBlogLevel 1 – mod_sslLevel 2 – Injection

Name: Metasploitable

Brief descriptionOne of the questions that we often hear is “What systems can i use to test against?” Based on this, we thought it would be a good idea throw together an exploitable VM that you can use for testing purposes.
Version/Levels: 1

Name: NETinVM

Brief descriptionNETinVM is a single VMware virtual machine image that contains, ready to run, a series ofUser-mode Linux (UML) virtual machines which, when started, conform a whole computer network inside theVMware virtual machine. Hence the name NETinVM, an acronym for NETwork in Virtual Machine. NETinVM has been conceived mainly as an educational tool for teaching and learning about operating systems, computer networks and system and network security, but other uses are certainly possible.
Version/Levels: 3 (2010-12-01)

Name: pWnOS

Brief descriptionIt’s a linux virtual machine intentionally configured with exploitable services to provide you with a path to r00t. 🙂 Currently, the virtual machine NIC is configured in bridged networking, so it will obtain a normal IP address on the network you are connected to. You can easily change this to NAT or Host Only if you desire. A quick ping sweep will show the IP address of the virtual machine.
Version/Levels: 1
Support/Walk-throughForumsLevel 1

(Offline) Web Based
Name: BadStore

Brief is dedicated to helping you understand how hackers prey on Web application vulnerabilities, and to showing you how to reduce your exposure. Our Badstore demonstration software is designed to show you common hacking techniques.
Version/Levels: 1 (v1.2)

Name: Damn Vulnerable Web App

Brief descriptionDamn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
Version/Levels: 1 (v1.0.7)

Name: Hacking-Lab

Brief descriptionThis ist the LiveCD project of Hacking-Lab ( It gives you OpenVPN access into Hacking-Labs Remote Security Lab. The LiveCD iso image runs very good natively on a host OS, or within a virtual environment (VMware, VirtualBox).
The LiveCD gives you OpenVPN access into Hacking-Lab Remote.You will gain VPN access if both of the two pre-requirements are fulfilled.
Version/Levels: 1 (v5.30)

Name: HackUS HackFest Web CTF

Brief descriptionThe Hackfest is an annual event held in Quebec city. For each event, a competition is held where participants competed at solving challenges related to security. For the 2010 edition, I got involved in the competition by creating the web portion of the competition.
Version/Levels: 1 (2010)
Support/Walk-throughBlogSolutionnaire (English)

Name: Hacme

Brief descriptionFoundstone Hacme Casino™ is a learning platform for secure software development and is targeted at software developers, application penetration testers, software architects, and anyone with an interest in application security.
Version/Levels: 5 (2006)

Name: LAMPSecurity

Brief descriptionFoundstone Hacme Casino™ is a learning platform for secure software development and is targeted at software developers, application penetration testers, software architects, and anyone with an interest in application security.
Version/Levels: v6 (4x)

Name: Moth

Brief descriptionMoth is a VMware image with a set of vulnerable Web Applications and scripts, that you may use for:

  1. Testing Web Application Security Scanners
  2. Testing Static Code Analysis tools (SCA)
  3. Giving an introductory course to Web Application Security

Version/Levels: v6

Name: Mutillidae

Brief descriptionMutillidae: A Deliberately Vulnerable Set Of PHP Scripts That Implement The OWASP Top 10
Version/Levels: v1.5
Support/Walk-through: N/A

Name: Open Web Application Security Project (OWASP) Broken Web Applications Project

Brief descriptionThis project includes applications from various sources (listed in no particular order).
Intentionally Vulnerable Applications:

Old Versions of Real Applications:

  • WordPress 2.0.0 (PHP, released December 31, 2005, downloaded from
  • phpBB 2.0.0 (PHP, released April 4, 2002, downloaded from
  • Yazd version 1.0 (Java, released February 20, 2002)
  • gtd-php version 0.7 (PHP, released September 30, 2006)
  • OrangeHRM version 2.4.2 (PHP, released May 7, 2009)
  • GetBoo version 1.04 (PHP, released April 7, 2008)

Version/Levels: v0.92rc1
Support/Walk-through: N/A

Name: SecuriBench

Brief descriptionStanford SecuriBench is a set of open source real-life programs to be used as a testing ground for static and dynamic security tools. Release .91a focuses on Web-based applications written in Java.
These applications suffer from a variety of vulnerabilities including

  • SQL injection attacks
  • Cross-site scripting attacks
  • HTTP splitting attacks
  • Path traversal attacks

Version/Levels: v0.91a
Support/Walk-through: N/A

Name: UltimateLAMP

Brief descriptionUltimateLAMP is a fully functional environment allowing you to easily try and evaluate a number of LAMP stack software products without requiring any specific setup or configuration of these products. UltimateLAMP runs as a Virtual Machine with VMware Player (FREE). This demonstration package also enables the recording of all user entered information for later reference, indeed you will find a wealth of information already available within a number of the Product Recommendations starting with the supplied Documentation.
Version/Levels: v0.2

Name: Virtual Hacking Lab

Brief descriptionA mirror of deliberately insecure applications and old softwares with known vulnerabilities. Used for proof-of-concept /security training/learning purposes. Available in either virtual images or live iso or standalone formats
Version/Levels: 1 (2009)

Name: WackoPicko

Brief descriptionWackoPicko is a vulnerable web application used to test web application vulnerability scanners.
Version/Levels: 1
Support/Walk-through: N/A

Name: WebGoat

Brief descriptionWebGoat is a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application.
Version/Levels: 1
Support/Walk-throughUser GuideGoogleCodeSourceForge

Name: WebMaven

Brief descriptionWebMaven (better known as Buggy Bank) was an interactive learning environment for web application security. It emulated various security flaws for the user to find. This enabled users to safely & legally practice web application vulnerability assessment techniques. In addition, users could benchmark their security audit tools to ensure they perform as advertised.
Version/Levels: 1.0.1

Name: Web Security Dojo

Brief descriptionA free open-source self-contained training environment for Web Application Security penetration testing. Tools + Targets = Dojo
Various web application security testing tools and vulnerable web applications were added to a clean install of Ubuntu v10.04.1, which is patched with the appropriate updates and VM additions for easy use.
Version 1.1 includes an exclusive speed-enhanced version of Burp Suite Free. Special thanks to PortSwigger .
Version/Levels: 1

(Online) Web Based
Name: Gruyere / jarlsberg

Brief descriptionThis codelab shows how web application vulnerabilities can be exploited and how to defend against these attacks. The best way to learn things is by doing, so you’ll get a chance to do some real penetration testing, actually exploiting a real application
Version/Levels: 1 (v1.0.7)
Support/Walk-throughPDFDownload offline

Name: HackThis

Brief descriptionWelcome to HackThis!!, this site was set up over 2 years ago as a safe place for internet users to learn the art of hacking in a controlled environment, teaching the most common flaws in internet security.
Version/Levels: 32 (40?)
Support/Walk-through: N/A

Name: HackThisSite

Brief descriptionHack This Site is a free, safe and legal training ground for hackers to test and expand their hacking skills. More than just another hacker wargames site, we are a living, breathing community with many active projects in development, with a vast selection of hacking articles and a huge forum where users can discuss hacking, network security, and just about everything. Tune in to the hacker underground and get involved with the project.
Version/Levels: Lots
Support/Walk-through: N/A

Name: Vicnum

Brief descriptionA mirror of deliberately insecure applications and old softwares with known vulnerabilities. Used for proof-of-concept /security training/learning purposes. Available in either virtual images or live iso or standalone formats
Version/Levels: 1.4 (2009)
Support/Walk-throughSourceForge (Download)

Taken from : ©