Every gaming experience has valuable lessons to learn. In Among Us, players are unintentionally engaging in tabletop exercises similar to what businesses are conducting annually.
This blog will show you how playing Among Us could be considered a tabletop exercise that can teach players business continuity, disaster recovery, and incident response.
What is Among Us?
Among Us is a multiplayer game that was created in 2018 by InnerSloth, an indie game company. It did not get popular until the summer of 2020. According to InnerSloth, there were 3 million concurrent Among Us players across Steam and mobile platforms in late September 2020.
The game consists of four to ten players and each player is designated as either:
- a crewmate that has designated tasks to win the game, or
- an imposter whose main goal is to kill the crewmates and/or sabotage the game operations.
Each crewmate needs to complete all of their tasks for the whole team to win the game.
Among Us teaches players the importance of teamwork, attention to detail, and communication. These three qualities are important to have for employees engaging in business continuity (BCP), disaster recovery (DR), and incident response (IR).
How is Among Us a Tabletop Exercise?
I did not think about Among Us being like a tabletop exercise until our team conducted an internal training on tabletops. After considering it, I was surprised by the similarities between tabletop exercises and Among Us:
Business Continuity, Disaster Recovery, and Incident Response in Among Us
For this section, I will break down every activity you could do as a crewmate or imposter in Among Us and relate it to business continuity, disaster recovery, or incident response.
Every crewmate is assigned unique tasks to achieve the game objective. The progress of every task completed is tracked on a dashboard that both the crewmates and imposter are able to view.
In business, the game tasks represent the predetermined and documented responsibilities for every employee. The success of the Company will depend on the employee’s commitment to fulfilling their work tasks.
The imposter’s objective is to either kill all of the crewmates or sabotage the in-game operations like breaking the lights, disrupting the oxygen levels, etc.
Any event caused by the imposter is like a business disruption at the Company. Imposters can be considered as malicious players in the business world seeking to expose, take advantage, or damage the Company.
When the imposter sabotages the in-game operations, every crewmate is notified of the sabotage and can resolve the issue. Failure to resolve the sabotage will end the game.
For example, when an imposter sabotages the oxygen tank in the game, the crewmates need to drop everything and go to the appropriate spots on the map to fix the oxygen tank. Failure to do so will cause the game to end as oxygen is needed for every player to have to do their tasks.
In business, this is how the Company activates the Disaster Recovery Plan. The situation focuses on how the Company recovers the key systems following a disaster like hardware failure, natural disasters, cyber-attacks, etc.
The Company should maintain a criticality ranked order of systems to recover and procedures to recover those systems to maintain service level commitments to the Company’s customers.
Crewmates can also report any deaths or call an emergency meeting on any “sus” (suspicious) activities. Every player (both crewmates and imposters) will gather and discuss their findings.
In business, this is the Company’s Incident Response Plan. The Company should focus on the containment and procurement of systems impacted by an incident.
Any employee could act as a malicious player. That is why every employee should be aware of their environment and know how to report any suspicious events to the Company.
In the emergency meeting, every player has the chance to discuss the details of the murder or the reason why they called the emergency meeting. It is important that the player knows how to clearly communicate the details in order to convince the players on who is the imposter.
In business, this highlights the importance of forensics in the incident response process. The employee needs to accurately report the details of the incident and conduct proper lessons learned to prevent future incidents.
When a crewmate dies, this is not the end for the player in the game. Dead crewmates can continue completing their tasks and help out the crewmate team in achieving the game objective.
In business, the crewmate’s ability to continue their tasks is a key focus in business continuity. Business continuity is the plan of action to ensure regular business operations or processes will continue during and after a disruption (market conditions, natural disaster, incident, etc.)
The game ends when all the crewmates completed their tasks or when the imposter wins by killing all the crewmates or wins by destroying the in-game operations.
Conclusion
Among Us is a nice, fun introduction for all people, young or old, to the importance of business continuity, disaster recovery, and incident response. Being aware and knowing how to respond to disruptions is a key part of how employees can ensure the success of their business operations.
To learn more about tabletop exercises, you can reference our blog or reach out to a security craftsman here on how we can help with your tabletop exercises!
Leave A Comment