Elevation of Privilege Game

 
group of cards from the Elevation of Privilege game

About

The Elevation of Privilege (EoP) threat modeling card game is the easy way to get started threat modeling. Adam Shostack created it in 2010, after hearing Laurie Williams describe Protection Poker.

Play the Game!

The easiest way to get a nice physical copy is from Agile Stationery (direct, or via Amazon). They have a lovely landing page with more information. You can also download the Creative Commons licensed files from Github or Microsoft. Instructions are included.

In the pandemic, one of the questions I get over and over is "how does it work remotely?" I was initially worried, but my answer now is it works great, because we do sessions where we play to learn, and they work. You might think we're biased, and in that case, read what the Financial Times has shared about their experience.

Versions

Derivatives

Elevation of Privilige is part of a growing movement of security games. Many people have made games built on EoP, including:

Translations and Online Versions

There's also an ever-growing body of translations and plaftform implementations:

Other Links

There's also a BoardGameGeek description of Elevation of Privilege, and a number of videos showing how to play, including this one by Sunny Wear.