This is still a work in progress. It may be changed in the future.

The Thought Police is designed by User: Miui as an exploration of the Netrunner completeness theorem. It is presented as a cybersecurity lesson.

Definitions

The Thought Police (㖀): Tactics, techniques and procedures (page 123)
textbook: Harper, Allen Ph.D. (et. al.) GRAY HAT HACKING: The Ethical Hacker's Handbook Sixth Edition
purple team: 浥(yì): Threat intelligence, incident response, forensics, detection engineering, threat hunting.

Threat intelligence: Analyzed, evidence-based information about cybersecurity threats that helps organizations move from a reactive defense to a proactive one.¹
Incident response: Incident response in cybersecurity is a structured, organized approach that an organization uses to detect, contain, and recover from a cyberattack, data breach, or security threat.²
Forensics: The practice of collecting, preserving, analyzing, and reporting on digital evidence to investigate cyberattacks and security incidents.³
Detection Engineering: the systematic process of designing, building, testing, deploying, and maintaining software-driven logic to identify cyber threats and malicious behaviors within an organization's digital environment.⁴
Threat hunting: Threat hunting is a proactive cybersecurity practice where security analysts actively search networks and systems to find hidden, malicious actors that have bypassed automated security tools.⁵

POC: 零(0x) "Proof of Concept": A demonstration script or code that proves a previously unknown and unpatched security flaw exists.⁶

The 浥(yì) will respond to any/all POC.

Kill Chain: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions.

Reconnaissance: The preliminary intelligence-gathering phase where an attacker or security professional collects data about a target system, network, or organization.⁷
Weaponization: The second phase of a cyberattack, where an adversary couples a malicious payload with an exploit to create a deliverable cyber weapon.⁸
Delivery: The stage in an attack lifecycle where an adversary transmits a malicious payload, file, script, or link to a target environment.⁹
Exploitation: The stage in an attack chain where an attacker triggers malicious code to take advantage of a system vulnerability and gain initial access.¹⁰
Installation: The killchain phase at which point an attacker establishes a persistent foothold or backdoor on the victim's system.¹¹
Command and Control: The phase at which point an attacker establishes a remote communication channel to issue instructions to a compromised system¹²
Actions: Final stage of an attack chain at which point an adversary executes their ultimate intent after successfully gaining and maintaining access to a target network.¹³

Response: An attempt to detect an adversary, deny their TTP, disrupt tooling, degrade network priviledge, deceptively trap them with honeypots and/or destroy them before an attack yields an APT. (textbook pages 13, 121)
APT: An advanced persistent threat.
MITRE ATT&CK Framework: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation. (See #Response Rules)

Core Rules

Cores: Cores are cards which can trigger immediate loss conditions.

The corp must posess 浥(yì) cards at all times. Once detected, the Runner must possess either 0x or 浥(yì) cards at any given time. Failure to meet this condition results in a loss.

The Runner does not need to possess cores until the corp has obtained 浥(yì): Threat Detection and successfully identified Rogue Widow(㜀).

浥(yì): Threat Detection is pulled from the 浥(yì) deck when corp successfully runs 浥(yì): Threat Intelligence + 浥(yì): Detection Engineering.

If the Runner triggers a loss while in possession of the textbook card, the runner may continue but the corp will seize all of the Runner's cards and design a new hand for them. This may only happen once per game.
Attack cards have a decrementing counter and must be discarded if played at 0.
POC cards held by a Runner can be spent to increase an attack card's counter.

If a Corp holds a POC and 浥(yì): Threat Hunting a hidden counter may be decremented without the Runner's knowledge.

Response Rules

Once a Runner establishes an APT the system is considered Turing-complete. The goal at which point is to install a truth-machine on the Corporate mainframe and input the value 1.
A Corp may begin drawing MITRE ATT&CK Framework cards to prevent installation of an infinite Runner 1 after the detection of an adversarial APT.

During this phase of gameplay the Corp has access to an expanded set of cards(textbook page 15):

Recon (10 techniques)
R&D (6 techniques total dependency)
Initial Access (9 technique 3 dependencies)
Execution (10 techniques 5 dependencies)
Persistence (18 techniques 9 dependencies)
Priviledge Escalation (12 techniques 7 dependencies)

Theorem

It is possible to model a computational system using Netrunner.¹³

Computational Model

Corp: The Thought Police (㖀), widely known as "The Voice"
Runner: Known by the 浥(yì) as "Rogue Widow(㜀)"

Computational Class

Note that the in-game state Turing-complete is not a description of the language's actual computational class.

Because The Thought Police language is incomplete the computational class is unknown.
The language is intended to demonstrate a finite-state automaton, but it is unknown if the current rules support rigorous proof of said class.

Implementation

Incomplete.

References

The Thought Police

Contents

Definitions

Core Rules

Response Rules

Theorem

Computational Model

Computational Class

Implementation

References

Navigation menu

The Thought Police

Definitions

Core Rules

Response Rules

Theorem

Computational Model

Computational Class

Implementation

References

Navigation menu

Search