# Cybersecurity in Society

## Overview

Break Escape exists in 2025, where cybersecurity has become increasingly important but remains poorly understood by most of society. This document explores how cyber security fits into the broader world: public understanding, industry practices, education systems, career paths, and cultural attitudes toward the field.

---

## Public Understanding of Cybersecurity

### The Awareness Gap

#### What Most People Think Cybersecurity Is

**Common Misconceptions:**
- Antivirus software on home computer
- Strong passwords (but still using "password123")
- "Hackers" are all criminals in hoodies
- Cybersecurity is an IT problem, not everyone's problem
- "I have nothing to hide, so I have nothing to worry about"
- Two-factor authentication is too inconvenient
- "My data isn't valuable to anyone"

**Media Influence:**
- Hollywood hacking shapes expectations
- News focuses on dramatic breaches
- "Cyber expert" talking heads oversimplify
- Confusion between privacy and security
- Technical details lost in translation

**Reality Gap:**
- Vastly underestimate personal risk
- Don't understand how attacks work
- Assume someone else handles security
- Don't connect digital and physical security
- Reactive rather than proactive

#### What Cybersecurity Actually Is

**Professional Reality:**
- Risk management and threat modeling
- Defense in depth and layered security
- Incident response and recovery
- Continuous monitoring and adaptation
- Human factors and security awareness
- Offensive and defensive techniques
- Compliance and governance

**Scope Beyond Consumer:**
- Critical infrastructure protection
- Corporate espionage and IP theft
- Nation-state cyber warfare
- Supply chain security
- IoT and embedded systems
- Cloud security and data protection
- Application security and secure development

**Why the Gap Matters:**
- Poor user practices enable attacks
- Social engineering exploits ignorance
- Organizations underinvest in security
- Public policy inadequately addresses threats
- Security professionals struggle with communication

---

## Industry Practices

### Corporate Security Maturity Levels

#### Level 0: Oblivious
**Characteristics:**
- No dedicated security staff
- Default passwords and configurations
- No security policies
- Reactive only after breach
- "It won't happen to us" mentality

**Prevalence:**
- Small businesses
- Some non-profits
- Low-tech industries
- Organizations with minimal budgets

**Vulnerability:**
- Extremely high
- Easy ENTROPY targets
- Often compromised without knowing
- Devastating impact when breached

**In Scenarios:**
- Sympathetic victims
- Ethical considerations
- Educational opportunities
- Collateral damage concerns

#### Level 1: Compliance-Driven
**Characteristics:**
- Security for regulatory requirements
- Checkbox approach
- Minimal beyond compliance
- Outsourced security
- Security theater common

**Prevalence:**
- Regulated industries (healthcare, finance)
- Government contractors
- Mid-size corporations
- International businesses

**Vulnerability:**
- Medium to high
- Compliant doesn't mean secure
- Focus on audits, not real threats
- Sophisticated attacks bypass compliance

**In Scenarios:**
- Policies exist but poorly enforced
- Security team understaffed
- Bureaucracy can help or hinder player
- Documentation trails

#### Level 2: Security-Aware
**Characteristics:**
- Dedicated security team
- Proactive measures
- Security training programs
- Incident response capabilities
- Regular assessments

**Prevalence:**
- Technology companies
- Major corporations
- Financial institutions
- Defense contractors

**Vulnerability:**
- Medium
- Better defenses but still vulnerable
- Insider threats remain
- Zero-day exploits work
- Human factors persist

**In Scenarios:**
- More challenging targets
- Security staff can be allies or obstacles
- Better monitoring increases detection risk
- More sophisticated ENTROPY operations

#### Level 3: Security-Mature
**Characteristics:**
- Security integrated into culture
- Continuous improvement
- Threat intelligence programs
- Red teaming and adversarial testing
- Security by design

**Prevalence:**
- Top technology firms
- Major financial institutions
- Intelligence agencies
- Security-focused companies

**Vulnerability:**
- Low to medium
- Still vulnerable to sophisticated attacks
- Nation-state level threats challenging
- Supply chain vulnerabilities
- Insider threats difficult to prevent

**In Scenarios:**
- Challenging targets requiring creativity
- Advanced ENTROPY cells only
- May be SAFETYNET partner
- High-value operations

### Security Practices by Role

#### IT Departments
**Responsibilities:**
- Network security
- Patch management
- User access control
- System administration
- Help desk support

**Common Challenges:**
- Overworked and understaffed
- Balancing security with usability
- Legacy systems
- User resistance
- Limited budget

**In Scenarios:**
- Potential allies (helpful IT person)
- Potential obstacles (paranoid admin)
- Source of information
- Access to systems
- Varying competence

#### Security Teams (Where They Exist)
**Responsibilities:**
- Security operations center (SOC)
- Incident response
- Vulnerability management
- Security architecture
- Threat intelligence

**Capabilities:**
- Detect intrusions
- Respond to incidents
- Analyze threats
- Recommend improvements
- Monitor compliance

**In Scenarios:**
- Formidable obstacles if alerted
- Potential SAFETYNET allies
- May be ENTROPY infiltrators
- Time pressure before detection
- Sophisticated cat-and-mouse

#### Developers
**Security Involvement:**
- Secure coding practices (sometimes)
- Code reviews (sometimes)
- Vulnerability remediation (when forced)
- Security testing (if required)

**Common Issues:**
- Security often afterthought
- Deadline pressure
- Insufficient security training
- "It works, ship it" mentality
- Technical debt accumulates

**In Scenarios:**
- Source of vulnerabilities
- Potential inside help
- May notice suspicious activity
- Code repositories valuable
- Comments and documentation revealing

#### Executives
**Security Perception:**
- Business risk to be managed
- Cost center vs. profit center
- Compliance requirement
- Board-level concern (after major breaches)
- Insurance and liability issue

**Common Attitudes:**
- Underinvest until breach
- Don't understand technical details
- Want simple answers
- Resistant to inconvenience
- Concerned about reputation

**In Scenarios:**
- Poor security practices (post-it passwords)
- High-value credentials
- Authority to access anything
- Social engineering targets
- May ignore security advice

---

## Educational System

### Formal Education

#### University Programs
**Availability (2025):**
- Dedicated cybersecurity degree programs growing
- Computer science programs adding security tracks
- Information assurance programs
- Graduate programs increasing
- Still insufficient to meet demand

**Curriculum:**
- Cryptography and network security
- Ethical hacking and penetration testing
- Secure software development
- Digital forensics
- Security policy and governance
- Hands-on labs and CTF competitions

**Challenges:**
- Rapidly evolving field
- Faculty shortage (professionals paid more in industry)
- Equipment and lab costs
- Keeping current with threats
- Balancing theory and practice

**Quality Variation:**
- Top programs excellent
- Others superficial or outdated
- Certifications sometimes more valued than degrees
- Practical skills vs. academic theory

#### High School and Below
**Current State (2025):**
- Minimal cybersecurity education
- Basic "internet safety" in some schools
- After-school clubs (CyberPatriot, etc.)
- Digital literacy programs (varying quality)
- Mostly focused on being good digital citizens

**Needs:**
- Security awareness for all students
- Critical thinking about digital threats
- Understanding of privacy implications
- Basic security practices
- Career path awareness

**Barriers:**
- Lack of trained teachers
- Competing priorities
- Budget constraints
- Curriculum development lag
- Parental understanding gaps

### Industry Certifications

**Major Certifications (2025):**
- **CompTIA Security+**: Entry-level, foundational
- **CEH (Certified Ethical Hacker)**: Penetration testing focus
- **CISSP (Certified Information Systems Security Professional)**: Management and architecture
- **OSCP (Offensive Security Certified Professional)**: Hands-on penetration testing
- **GIAC Certifications**: Specialized technical areas
- **Cloud Security Certifications**: Growing importance (AWS, Azure, GCP)

**Value:**
- Industry recognition
- HR checkbox for hiring
- Demonstrates baseline knowledge
- Hands-on certs more respected
- Experience matters more than paper

**Controversies:**
- "Paper tigers" with certs but no skills
- Expensive and require renewal
- Some more valuable than others
- Experience vs. certification debates
- Boot camps vs. university education

### Self-Education

**Resources:**
- Online platforms (Cybrary, Hack The Box, TryHackMe)
- YouTube tutorials and channels
- Capture The Flag (CTF) competitions
- Bug bounty programs (learning by doing)
- Open-source tools and documentation
- Blogs, podcasts, conference talks

**Community:**
- Reddit communities
- Discord servers
- Twitter security community
- Local meetups and chapters
- Online forums

**Advantages:**
- Accessible and often free
- Learn at own pace
- Current with latest techniques
- Practical hands-on experience
- Portfolio building

**Challenges:**
- Information overload
- Quality varies wildly
- Requires self-discipline
- No credential for HR
- Easy to go down rabbit holes

---

## Career Paths in Cybersecurity

### Entry Points

#### How People Enter the Field

**Traditional Path:**
- Computer science or IT degree
- Entry-level IT position
- Specialize into security
- Certifications and training
- Security role

**Alternative Paths:**
- Self-taught hackers going legitimate
- Military/intelligence background
- Career changers from other technical fields
- Boot camps and accelerated programs
- Bug bounty hunters going professional

**SAFETYNET Recruitment:**
- Scouts at universities and conferences
- Identifies talented self-taught individuals
- Recruits from military and intelligence
- Looks for skills, ethics, and discretion
- Offers purpose beyond paycheck

**ENTROPY Recruitment:**
- Targets disaffected professionals
- Finds skilled but marginalized individuals
- Promises belonging and purpose
- Offers wealth or ideological fulfillment
- Exploits grievances and frustrations

### Career Progression

#### Technical Track
**Progression:**
1. Junior security analyst/pentester
2. Security analyst/engineer
3. Senior security engineer
4. Security architect/principal engineer
5. Distinguished engineer/technical fellow

**Focus:**
- Hands-on technical work
- Deep specialization
- Tool development
- Vulnerability research
- Staying current with techniques

#### Management Track
**Progression:**
1. Security analyst
2. Senior analyst/team lead
3. Security manager
4. Security director
5. Chief Information Security Officer (CISO)

**Focus:**
- Team leadership
- Budget and resource management
- Strategy and policy
- Board communication
- Risk management

#### Consulting/Independent
**Progression:**
1. Junior consultant
2. Security consultant
3. Senior consultant/specialist
4. Principal consultant
5. Independent practice/firm owner

**Focus:**
- Client relationships
- Diverse engagements
- Business development
- Thought leadership
- Flexibility and variety

### Specializations

**Common Specializations:**
- Penetration testing and red teaming
- Incident response and forensics
- Security operations and monitoring
- Application security and secure development
- Cloud security
- Compliance and governance
- Cryptography and secure communications
- Threat intelligence and analysis

**Emerging Specializations:**
- AI security and adversarial ML
- IoT and embedded security
- Blockchain and cryptocurrency security
- Privacy engineering
- DevSecOps

### Compensation

**Salary Ranges (2025, USD, approximate):**
- Entry-level: $60,000-$80,000
- Mid-level: $90,000-$130,000
- Senior: $130,000-$180,000
- Principal/Architect: $180,000-$250,000+
- CISO/Executive: $200,000-$500,000+
- Bug bounty (variable): $0-$1,000,000+

**Geographic Variation:**
- Major tech hubs pay more
- Remote work expanding opportunities
- Cost of living considerations
- International variation significant

**Industry Variation:**
- Technology companies pay most
- Finance also pays well
- Government/non-profit pays less (but other benefits)
- Consulting variable by firm

**Why It Matters:**
High salaries make recruitment easier but also create targets for ENTROPY corruption attempts.

---

## Cultural Attitudes

### Society's View of Hackers

#### The "Hacker" Label

**Connotations:**
- **Negative (Most Common):** Criminal, malicious, antisocial
- **Positive (Growing):** Skilled, clever, problem-solver
- **Neutral:** Technical expert, security professional

**Media Representation:**
- Movies: Hoodie-wearing genius or criminal
- News: Threat to security or helpful expert (context-dependent)
- TV: Usually criminal, occasionally hero
- Social media: Varied, often admiring of skills

**Self-Identification:**
- Security professionals avoid "hacker" label (prefer "security researcher")
- Ethical hackers reclaim term
- Black hat hackers embrace it
- Cultural divide over terminology

#### The "Cybersecurity Professional" Label

**Connotations:**
- Professional, legitimate, boring (to some)
- Protector, defender
- Skilled but less exciting than "hacker"
- Corporate, establishment

**Reality:**
- More accurate descriptor
- Encompasses broad field
- Includes offensive and defensive
- Removes criminal connotation

### Within the Community

#### Ethical Debates

**Disclosure:**
- Responsible disclosure vs. full disclosure
- Vendor response times
- Public good vs. security through obscurity
- Bug bounties vs. selling exploits

**Offensive Security:**
- Is "ethical hacking" ethical?
- Authorization boundaries
- Collateral damage in testing
- Red team vs. penetration test distinctions

**Privacy vs. Security:**
- Encryption backdoors debate
- Surveillance and monitoring
- Anonymity tools
- Balancing individual rights and collective security

**Grey Hat Activities:**
- Unauthorized research
- Hacking for good without permission
- Publishing vulnerabilities
- Hacktivism

#### Community Values

**Generally Valued:**
- Technical skill and continuous learning
- Sharing knowledge
- Responsible disclosure
- Protecting users and systems
- Innovation and creativity

**Generally Frowned Upon:**
- Recklessness and collateral damage
- Gatekeeping and elitism (though it exists)
- Taking credit for others' work
- Selling exploits to criminals/nation-states (though lucrative)
- Security through obscurity

**Internal Tensions:**
- Academic vs. practical knowledge
- Certification vs. experience
- Disclosure timing and methods
- Working for "the man" vs. independence
- Profit vs. principles

### Generational Differences

#### Older Generation (40+)
**Characteristics:**
- Experienced traditional computer security
- More conservative approach
- Values stability and process
- Risk-averse
- Compliance-focused

**Attitudes:**
- Security is serious business
- Methodical and thorough
- Skeptical of new technologies
- Emphasis on fundamentals

#### Middle Generation (25-40)
**Characteristics:**
- Grew up with internet
- Balances innovation and caution
- Practical and pragmatic
- Career-focused
- Bridge between old and new

**Attitudes:**
- Security is important but evolving
- Embrace useful new tools
- Results-oriented
- Mentor younger generation

#### Younger Generation (Under 25)
**Characteristics:**
- Digital natives
- Comfortable with rapid change
- Bold and innovative
- Less risk-averse (sometimes reckless)
- Challenge traditional approaches

**Attitudes:**
- Security should be accessible
- Old methods are outdated
- Move fast and break things (then secure them)
- Question authority and established practices

**ENTROPY's Appeal:**
Younger generation more susceptible to recruitment—questioning authority, idealistic, sometimes frustrated with "the system."

---

## Industry Culture

### Conferences and Community Events

**Major Conferences:**
- **DEF CON**: Hacker culture, villages, CTFs, Vegas
- **Black Hat**: Professional, vendor hall, expensive, training
- **RSA Conference**: Corporate, compliance, products
- **BSides**: Community-driven, local, accessible

**Purpose:**
- Knowledge sharing
- Networking
- Recruiting (both SAFETYNET and ENTROPY)
- Vendor marketing
- Community building
- Socializing

**Culture:**
- Mix of serious and playful
- Technical talks and workshops
- Social events and parties
- Competitions (CTF, Hacker Jeopardy)
- Badge hacking and physical challenges

**In Break Escape World:**
- SAFETYNET recruits here
- ENTROPY networks here
- Intelligence gathering on both sides
- Neutral ground (usually)
- Characters may reference conferences

### Workplace Culture

#### Security Teams

**Characteristics:**
- Often understaffed and overworked
- Reactive fire-fighting vs. proactive
- "Security says no" reputation
- Balancing security and business needs
- Camaraderie from shared challenges

**Dynamics:**
- Close-knit teams
- Gallows humor
- On-call rotations and burnout
- Pride in protecting organization
- Frustration with lack of resources/support

**Relationship with Other Departments:**
- IT: Allied but sometimes tension
- Development: Often adversarial ("security slows us down")
- Business: Misunderstood ("why can't you just fix it?")
- Executive: Seeking support and resources

#### Consulting Firms

**Characteristics:**
- Project-based work
- Travel (or remote)
- Variety of clients
- Competitive and high-pressure
- Up-or-out culture (some firms)

**Culture:**
- Professional and client-focused
- Knowledge sharing within firm
- Competitive for advancement
- Work-life balance challenges
- High turnover

### Diversity and Inclusion

**Current State (2025):**
- Field historically male-dominated
- Improving but slowly
- Women in security initiatives growing
- LGBTQ+ representation increasing
- Racial/ethnic diversity still lacking

**Challenges:**
- Pipeline problems (fewer entering field)
- Bro culture in some environments
- Harassment and discrimination persist
- Imposter syndrome
- Lack of visible role models

**Positive Trends:**
- Mentorship programs
- Diversity-focused conferences and groups
- Companies prioritizing diverse hiring
- Community recognition of problem
- Younger generation more diverse

**In Break Escape:**
- SAFETYNET diverse by design (recruits best talent regardless)
- ENTROPY varies by cell
- Scenarios feature diverse characters
- Gender, race, orientation not plot points (just represented)

---

## Public Policy and Government

### Regulatory Environment (2025)

**Major Regulations:**
- **GDPR** (Europe): Data protection and privacy
- **CCPA** (California): Consumer privacy rights
- **HIPAA** (US Healthcare): Health data protection
- **PCI DSS** (Payment Cards): Credit card security
- **SOX** (US Finance): Financial data integrity
- **NIST Frameworks**: Voluntary guidelines

**Impact:**
- Compliance requirements drive security investment
- Penalties for breaches increase
- Data protection officer roles created
- International operations complicated
- Security theater vs. actual security

**Controversy:**
- Regulation stifles innovation (business view)
- Regulation insufficient (privacy advocates view)
- Enforcement inconsistent
- Loopholes and exemptions
- Compliance doesn't guarantee security

### Government Cybersecurity

**Capabilities:**
- **NSA/Cyber Command**: Offensive and defensive operations
- **FBI**: Cybercrime investigation
- **CISA**: Critical infrastructure protection
- **State/Local**: Variable capabilities

**Challenges:**
- Bureaucracy and slow adaptation
- Talent recruitment (can't match industry salaries)
- Legacy systems
- Political considerations
- Coordination challenges

**Secrecy:**
- Capabilities largely classified
- SAFETYNET even more secret
- Public doesn't know extent of government cyber operations
- Surveillance programs controversial

### International Cooperation

**Current State:**
- Some cooperation on cybercrime
- Mutual legal assistance treaties
- Intelligence sharing (limited)
- Interpol and Europol involvement

**Challenges:**
- Conflicting national interests
- Different legal frameworks
- Trust deficits
- Attribution difficulties
- Nation-state involvement in cybercrime

**In Break Escape:**
- SAFETYNET primarily operates domestically (implied US or allied nation)
- ENTROPY global network
- International implications
- Cross-border operations complicated

---

## The Future of Cybersecurity in Society

### Growing Awareness

**Positive Trends:**
- More people understand basic security
- Companies investing more in security
- Education improving
- Tools becoming more accessible
- Profession gaining respect

**Drivers:**
- High-profile breaches
- Personal impact (everyone knows someone affected)
- Media coverage increasing
- Regulatory pressure
- Insurance requirements

### Growing Threats

**Negative Trends:**
- Attacks growing in sophistication
- More valuable data at risk
- Greater connectivity = more attack surface
- Nation-state cyber warfare normalizing
- Ransomware epidemic continuing

**New Frontiers:**
- AI-powered attacks and defenses
- Quantum computing implications
- IoT vulnerabilities at scale
- Deepfakes and synthetic media
- Supply chain attacks

### Society's Role

**Individual Responsibility:**
- Better security practices needed
- Critical thinking about digital threats
- Protecting personal data
- Supporting security measures
- Being informed citizens

**Collective Action:**
- Industry standards and cooperation
- Government regulation and enforcement
- Educational initiatives
- Cultural shift toward security
- Accountability for negligence

---

## Scenario Design Implications

### Using Society in Stories

#### Authentic Environments
- Corporate security culture reflects industry
- Characters have appropriate attitudes
- Workplace dynamics realistic
- Conferences and community referenced
- Career motivations authentic

#### Educational Opportunities
- Show how real security works
- Demonstrate why practices matter
- Illustrate consequences of poor security
- Challenge misconceptions
- Inspire players to learn more

#### Cultural Context
- Security professionals are people with lives
- Organizations have cultures
- Society's attitudes affect operations
- Ethical questions reflect real debates
- Players see themselves in world

---

## Summary

Cybersecurity in Break Escape's world is:

**Growing:** Increasing importance and awareness
**Challenging:** Complex threats and insufficient defenses
**Professional:** Mature field with career paths
**Cultural:** Community with values and debates
**Imperfect:** Gaps in understanding and practice
**Essential:** Critical to modern society

This creates rich environment for:
- Realistic scenarios
- Relatable characters
- Educational content
- Career inspiration
- Authentic world-building

Players experience cybersecurity as a field, not just a mechanic.

---

**Version:** 1.0
**Last Updated:** November 2025
**Maintained by:** Break Escape Design Team
