ThreatGEN: Red vs. Blue

From dev post on discord dated — 12/07/2023: [quote=n4mely (Greg) (Developer)] the Steam version has been discontinued (it will no longer receive updates past 1.10, you'll have to buy the professional version off threatgen.com/pricing/ which is offered as a subscription) [/quote] This is not reflected on a store page in any shape or form.

First, this is not a game [i]per se[/i] – [b]education[/b] is its primary mission, and if you have a packet of fun while learning, all the better. Reading the manual and existing community guides was [i]necessary[/i], but not [b]sufficient[/b] – I had to experiment, and make my own mistakes. Although there’s been a bit of a learning curve, I obviously like ThreatGEN:Red vs Blue (RvB) enough to put 260-odd hours into it (as of this writing). It’s a fun, deep experience that rarely plays the same way twice – and well worth the price. Your role is either attacking a network (Red Team), or defending (Blue Team). Either way, you have limited resources, and must make tradeoffs under that constraint (Do I install a VPN, or harden the terminal server? Do I attack a machine now, or prepare a covert attack and research some class of vulnerability to boost my chances later?), while not knowing exactly what the opposition is up to. Antoine de Saint-Exupéry said “Perfection is achieved, not when there is nothing more to add, but when there is nothing left to [b]take away[/b].” I think the interface makes large strides in that direction. Fancier graphics, video, etc would not advance RvB’s educational mission anyway, take extra time + money to develop, would bloat the download and add in more things that can go wrong. In keeping with that minimalism, RvB is [b]detailed[/b] but not notably [b]technical[/b] – you aren’t personally scanning network segments, developing exploits, deploying or rebooting servers, etc; that’s someone else’s job. It’s the old (presumably Commonwealth forces) crack about the difference between how an officer builds a flagpole and how a sergeant builds one: the officer figures out [u]what[/u] needs to be done, and tells the sergeant, who then figures out [u]how[/u] it gets done. In RvB, you’re the officer. RvB pulls in [i]operational[/i] technology (OT - programmable logic controllers, human-machine interfaces, SCADA systems) alongside [i]information[/i] technology (IT - computers, routers, switches, firewalls). The operational technology is the stuff that makes a business money – pumping oil through a pipeline, automatically filling vodka or whiskey bottles, or churning out metaWidget™ by the hundred. If IT speaks modern English, OT speaks anything [b]but[/b]. Ancient Sanskrit, for example. Blindly treating OT kit the same as IT kit is, at best, a recipe for trouble – at worst, catastrophic. Pros: - High-fidelity strategic-level simulation of real-world cybersecurity; - Detailed enough to learn cybersecurity concepts, strategies and tactics, but not technical – no command lines in sight; - In-game wiki describes individual network assets, cybersecurity concepts, game actions, and [b]even initial suggested strategy outlines[/b] to get you started; - Developers welcome bug reports; - Red Team vs Blue Team balance can change as a round progresses – usually Red Team has the upper hand early, then Blue Team gains it as they lock their network down. That doesn’t stop Red Team clawing their way back on top, such as skilling up to physically sneak past video surveillance and onto the production floor. - Delivers solid learning – one round, playing Blue Team against a good mate, I didn’t secure my wifi. He rowed up at the fence, cracked my wifi, and gleefully rampaged inside my network. One loss later, I had learned my lesson. Cons: - If you’re expecting to be spoon-fed, [i]RvB isn’t for you[/i]. Go forth, try things, read the wiki, learn; - You do need [i]some[/i] networking knowledge, and it wasn’t made clear at the time I bought RvB; - Some parts of game wiki may not be completely up to date. To their credit, the devs do tackle this as needed; - AI players could stand to be improved, Blue Team especially. That’s supposed to be landing for version 1.11 (currently version 1.10 as of this writing); - Small player-vs-player community; Each team has a few ways to win. Blue Team wins if: - The turn limit runs out; - They collect sufficient threat intelligence to shut down Red Team; - All bugs and compromises are removed from their network; Blue Team [i]loses[/i] if they damage their own industrial process. Red Team wins if: - They damage Blue Team’s industrial process, with or without help from Blue Team. StuxNet did this, back in 2010. - Reduce Blue Team’s profit/cash flow enough to cause them to shut down / go bust. Red Team can choose among three ways to attack: - Cyber – What is classically thought of as “hacking”; - Physical – Enter the Blue Team’s physical premises (either by breaking in, cloning an RFID badge, or talking your way in); - Social Engineering – Tricking someone into opening a phishing email, or accessing a compromised website; Likewise, Blue Team’s efforts are significantly boosted by figuring out what type(s) of attack Red Team are using, and concentrating their defensive efforts on those. Each turn has a time limit, that can be set when you start the round. Especially when you are just starting, the combination of time pressure and (if you’re anything like me) the analysis paralysis caused by so many choices is challenging, to say the least.

I just finished reading previous reviews and there is not much else to write. Personally I am grateful that games like these exist, because it provides an entertaining way to learn cyber security. Yes, the graphics aren't flashy moving objects, the game is rather simplistic, but I think it is good enough for the purpose. I have mostly played as Blue team in Single player, completed all 3 levels and won all 3 by Weathering the storm. Now why am I recommending this game? In my opinion, it is a great starting point, if you want to decide whether to get into Cyber Security or not. For me as someone with a background in IT it was not too hard, but sometimes it revealed what I need to refresh my memory on or study again. I will certainly try the professional version, since Im curious to see what changed in the latest version (I am not paid to write this).

I've never come across a game quite like this on Steam and I thought it was pretty great. Some of the critcisms of the negative reviews are right on the money - There's no tutorial and you won't be able to just jump into the game without a cybersecurity background, but for someone with an understanding of the field you will have fun with the Blue side. The Red side is lacking. As a game it's not very fun or engaging (there are other, much better hacking simulators out there), but if playing with a friend the Red team could be a lot more fun. I recommend for cybersecurity learners (or professionals, if you're the sort that would drive a truck all day at work then head home to play EuroTruck Simulator to unwind.)

Disclaimer: I purchased the Steam version of Red vs. Blue at retail, played it a lot, volunteered as a beta tester (unpaid), and later received a free copy of the Pro version. I love this game. That being said, if you don't like turn-based strategy games and are not professionally interested in cybersecurity, then it's not for you. [b]This is not your regular hacking game.[/b] [h1]Gameplay[/h1] Red vs. Blue simulates a conflict between an attacker (Red) and a defender (Blue) to illuminate the strategy behind cybersecurity programs. Players take turns spending action points on their own tech tree/menu of a few dozen actions. Blue's actions typically also cost money. Red wins either by damaging Blue's industrial control systems or by causing a sufficient economic loss. Blue wins either by surviving to the end of the game or by gathering enough threat intelligence to put Red away for good. You can play against an AI or against other humans (hot-seat or Internet). The current AI (there's a new one that's almost done) can challenge new players for many games, though against skilled opponents, it is predictable as Red and exploitable as Blue. The player versus player scene is small but growing. (Definitely join the ThreatGEN Discord for matchmaking.) To give you an idea of the simulation level, Red's first turns might be [list] [*] Recruit Hackers, OSINT (Recon), Research Weak Passwords [*] Host Scan [*] Port Scan [*] Service Enumeration [*] Fuzzing, Password Attack [*] Spearphishing, [/list] and Blue's, [list] [*] Policies and Procedures, Install Video Surveillance, Gateway Firewall [*] Security Awareness Training, Create Backup Process [*] Segment Network. [/list] No, you will not learn how to use command line tools like Nmap or Hydra, configure firewalls and network sensors, craft phishing emails, exploit stack overflows, pick locks, etc. That's a good thing as far as I'm concerned, because all that detail would slow down the core game. (Note that the developers are considering adding an optional command line aspect.) Nevertheless, there's a lot more depth than meets the eye. Red can tell which assets are in the same network segment from the third number of IP addresses, for example, and Blue's SIEM cannot monitor assets if an intermediate switch is offline. The developers are respected cybersecurity professionals who coauthored a book on securing industrial control systems. One of the best parts of the game is its book-length collection of articles on cybersecurity concepts, arguably living up to its price tag for that alone. [h1]My recommendation[/h1] I don't work in cybersecurity, so I'll review Red vs. Blue as a game and let others speak to educational value. If you put the time in, I think that Red vs. Blue will more than repay you. The competitive strategy is deep and getting deeper. The balance is good for an asymmetric game (Large Oil & Gas is the fairest map in my opinion; the others lean Blue). The latter half of the game can admittedly be repetitive as Blue, though if Red researches Persistence, they should be able to create some excitement with stealth play. Unfortunately, there is [b]no in-game tutorial yet[/b], so you need to be willing to read the documentation, watch streams on the ThreatGEN YouTube channel, or ask questions on Discord (we don't bite!). I also find it helpful to review the other player's action log after games. The graphics are good but not amazing. You're not buying this game for the graphics, are you? I usually keep the audio off (sorry, Clint).

Knocked over my own ICS system doing vulnerability assessments, and lost the match due to not making enough money.

Awesome game, cant recommend it enough

Great for testing cyber security strategies.

Interesting game if you're into OT cyber security

Not a bad little game, to pass the time. There is no audio unless you run the game as admin.