Practice threat analysis by searching for zombies

During the Halloween season, I break out all my favorite board and video games and immerse myself in the ancient lore of vampires in the gothic land of Ravenloft, wander through a brisk autumnal zombie apocalypse, and test my mettle against the other-worldly intrigue of Cthulu.

[ Build a flexible foundation for your organization with An architect's guide to multicloud infrastructure. ]

Even my KDE Plasma Desktop isn't immune from this haunting, as I also enjoy switching the theme of the casual KMines game over to the Graveyard Mayhem theme.

Image

KMines

The KMines game is part of the KDE Gear application suite, and it's a fun implementation of the classic desktop pastime Minesweeper. The goal is simple: Click on all squares (or grave plots, in the case of the Graveyard Mayhem theme) without clicking on one containing a zombie.

You can install KMines from its KDE applications page. Once it's installed, click the Settings menu and select Configure KMines. In the Theme settings panel, select Graveyard Mayhem.

Image

You're not forced to click arbitrarily in KMines. After your first click, all adjacent safe grave plots are revealed until a zombie is detected within two squares. Even better, each bordering "threatened" square displays the number of squares it is from the threatened space. Sounds simple, except that this is a matrix, and a threat can exist in any one of the eight surrounding squares.

[ Check out Red Hat's Portfolio Architecture Center for a wide variety of reference architectures you can use. ]

In this screenshot, I've clicked on the extreme northwest square:

Image

To continue without uncovering a zombie, you must analyze the squares adjacent to each threat and decide for yourself what square is safe. Technically, there are always eight possible positions for a threat, but realistically, a threatened square is never uncovered without some safe squares bordering it. I usually start at the edges because those eliminate even more squares.

Image

Because both the grave plot at the top of column 3 and the plot below it are marked as threatened, the probability of a zombie in the top two spaces of column 4 is extremely high.

You continue this threat analysis for each threatened space, and ultimately, you build a mental image of your threat vectors. Everyone has their own strategy in a zombie apocalypse, and KMines is no different. (Except that in KMines, you're starting the zombie apocalypse. Stop digging up graves!) You could build up your threat map by clicking on the northeast grave plot, slowly encroaching on the threatened squares until it (hopefully) becomes obvious which square to avoid. You could just take your chances and click on a square you feel is safest.

The cold, hard truth of the game is that, ultimately, you have to keep clicking. You'll probably uncover a zombie eventually, and all it takes is one. When one zombie is exposed, the game is over. It's abrupt, it's frustrating, and it's...​ actually really good training.

Threat analysis

Clicking through a graveyard trying to avoid zombies is a fun way to kill time (and you may as well kill time, because you can't kill the undead), but the analysis is what intrigues me. Is KMines a game of probability? Or is it a game of investigation? Is there ever a way to be sure of what threat lurks on the game board?

It can feel a little hopeless. And yet, you opened the game. It's your job to clear the board, so it's your job to ascertain where the threat exists.

Stop me if this is actually sounding like work, but in the tech industry, this has to be the goal of not just the CIO, not just the architect, not just the systems administrator, but literally everyone.

Is that email with the subject "Your inbox is too full!" asking employees to enter their password into an official-looking website really from IT? If so, what are the ways IT could have avoided phishing and instilled confidence in its own clients? If not, why are the employees seeing the email at all?

Are employees using external, non-approved services to broker sensitive information? If so, what are the ways IT can provide a safe and supported means of achieving the same results? If not, how secure are the internal solutions that do exist?

It's essential work, and KMines in zombie mode is often my reminder that there's probably something within my sphere of influence that could be analyzed, considered, and possibly dug up from its dusty resting place, at least for a quick once over.

Work can also be fun

Most importantly, though, KMines in zombie mode is just fun. Honest.

You don't have to think about work when you play it, although I do. You can just click on squares randomly and see how long you lost. Just know that the zombies will probably win in the end, but the human spirit is strong, and the KDE Plasma Desktop is very good at making its idle games fun with silly themes.

[ Take a Linux infrastructure planning assessment. ]