City Police use Lego simulation to teach businesses cyber security

City of London Police are offering to train business leaders and IT security in cyber security using a Lego simulation that is surprisingly close to real life. The board of directors had some hard decisions to make. The company had just taken over a hydro-electric power plant. The office IT systems and the SCADA industrial control system were connected to the internet, and all were potentially at risk from hackers and viruses. There was little, if any, security in place. Welcome to the City of London Police’s cyber security simulation game. Unveiled this week as part of the force’s Cyber Griffin programme to help companies in the Square Mile improve their security, the game is designed to encourage company boards and their IT teams to think and prepare for security problems before they happen. Acting as directors, we had an annual security budget of £100,000 and a wide range of options to spend it on. Firewalls, anti-virus, CCTV, asset audits, threat assessments, operating system upgrades and security training – we needed them all, but with a limited budget, we had to prioritise. Everyone chipped in with their thoughts: “We could go for the basics like anti-virus first, and then do a threat assessment later.” “We also need CCTV because we don’t know who is working there.” “We need a firewall in the office as well because they are all on Facebook at lunchtime.” “What about the risks of GDPR [General Data Protection Regulation]? If our customers’ emails are hacked, we could be exposed to huge fines, which would put the company out of business.”