CyberSec Games Night in London. Book your place!
1 2

OWASP Cumulus for Cloud architectures & DevOps processes

£20.00

EU customers: Taxes included. No additional charges (including duties) on delivery.

Description

Modern cloud environments are complex, with security risks extending far beyond application code. 

OWASP Cumulus turns cloud security threat modelling into an engaging, collaborative card game, helping DevOps, development, operations and security teams take a proactive approach in exploring realistic threats, discussing how they might affect their own systems and identifying opportunities for improvement, 

OWASP Cumulus contains 60 cards covering five essential areas of cloud and DevOps security:

  • Access & Secrets – Identity and access management, permissions, credentials and secrets.
  • Delivery – Software builds, deployment pipelines and software supply chain security.
  • Recovery – Backups, restoration and the ability to recover from failures or attacks.
  • Monitoring – Logging, alerting, visibility and traceability across systems.
  • Resources – Cloud infrastructure, configuration and the security of deployed resources.

Together, these categories encourage teams to look beyond their individual responsibilities, examine the wider environment and uncover threats that might otherwise be overlooked.

Bulk Pricing

Automatically applied at checkout:

Buy Discount
5 or more decks 5% off
10 or more decks 10% off
20 or more decks 15% off
30 or more decks 20% off

Specifications
  • Suits
    Access & Secrets, Delivery, Recovery, Monitoring, Resources
  • # Cards
    60
  • Created by
    TNG Consulting

About the game

Developed by TNG Technology Consulting and part of the OWASP family of security projects, Cumulus builds on Adam Shostack's Elevation of Privilege threat modelling game.

Designed specifically for cloud infrastructure and the operational side of DevOps, it complements OWASP Cornucopia's focus on application security.

Try a branded version

If you'd like to encourage the use of this technique within your team or organisation, a branded deck is a great way to demonstrate your support and commitment to the process.

How to play?

  • Before you begin

    Collaboratively create a high level overview of your system. This can be a data flow diagram or any visual format your team understands.

    Each suit in the deck represents a type of threat. Pick one to start with. It will be your starting suit for the first round.

  • Deal the cards

    Deal the cards to all players. The player with the lowest card in the starting suit goes first.

    Everyone plays a card. Follow the lead suit if you can.

    The highest card wins the trick (trump suit: Access & Secrets).

  • Spot the threats

    As each card is played, discuss whether the threat it represents applies to your system.

    If the group agrees it’s a valid threat, note it down.

    The player who raised the threat earns an extra point.

  • Winning

    The winner of each trick gets 1 point.

    Players who identify an agreed-upon threat earn 1 bonus point.

    After each round, the winner chooses the next suit to play.

    Play continues until all cards are used or time runs out. Highest score wins!

Hybrid teams? No problem

Play our threat modeling games remotely
with the power of physical cards!

Croupier
Back to top