Shostack + Friends Blog


Lessons Learned: Playing Elevation of Privilege

We learn while we're having fun. Some takeaways from a recent play to learn session. Amongst the takeaways image

After the previous Elevation of Privilege Play to Learn session, Nigel Hanson shared some of his thoughts on Slack. I thought they were worth sharing more broadly.

"Absolutely loved today's game as I can guarantee that some of the misunderstandings that we all had will be the same issues that my teams will strike around the globe."

After I asked for more details, he continued:

"What I was meaning by misunderstandings (or what I interpreted as misunderstandings) was what the underlying focus of the game actually is. I was initially caught up (and suspect others were too) about the details of the game (scoring etc), but then had a few “Aha” moments. I had 4 key takeaways:"

  1. The cards are simply prompts/ideas of things that could go wrong. They help ensure that we think broadly - even for a system we may have never seen before.
  2. The usage of physical cards help with keeping people’s attention when playing remotely. Suspect if I just had a list of cards on screen, I’d easily find myself distracted when it wasn’t my turn. Holding the physical cards I found myself really thinking about which one to play next.
  3. The game format will really help with teams where I have 1-2 strong members (who probably claim they know all the things that could go wrong so don’t even need to play the game) as it will somewhat focus them on the threats on their cards.
  4. Flipside of #3 is that it will give the less vocal team members an opportunity to voice their ideas and have them equally have the opportunity to put them forward.
  5. All models are wrong, but some are useful
  6. Don’t feel overwhelmed by the size of the deck of cards. It’s perfectly ok to play a couple of rounds, get some findings, work on those, rinse+repeat (get some wins, feel positive about the experience). Look forward to the next round!