> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Open House - URL: https://www.ostering.com/open-house-threat-modeling-game/ - Published: 2026-11-05T20:57:00.000Z - Updated: 2026-11-05T21:34:50.952Z - Description: Open House is a trick-taking threat modeling card game for smart home teams: two decks, your own floor plan, and a findings log you can act on. - Author: Brett Crawley - Tags: IoT Security, Smart Home, Threat Modeling ![Open House header: the thermal cross-section of a connected house](https://www.ostering.com/media/posts/205/launch-linkedin-1920x1080.png =1920x1080) # Open House: A Threat Modeling Card Game for the Connected Home > **TL;DR** > - **Open House** is a trick-taking threat modeling card game for the teams who build smart home products: hubs, devices, apps, clouds and energy kit. > - It ships as **two decks** that each play on their own: **The Things** (103 cards, seven device suits) and **The Control** (90 cards, six suits for what controls the house). Both carry ten Trumps, the structural hazards of the connected home. > - You play against **your own design**, drawn on an A3 floor plan. Every card is a threat with three mitigation prompts, and a Scribe turns the game into a findings log your team can act on. > - The game came first. The **Smart Home Threat Taxonomy** is its reference: 179 entries, each with the same ID as its card, mapped to STRIDE, CAPEC and CWE. A smart home is a building that runs software. When software in an office fails, you lose data. When software in a house fails, you can lose a lot more than that: an oven left on, a front door left open to the street, a house left cold in January, or a camera in a child's bedroom with a stranger on the other end. I've spent the last few months building threat modeling games for areas that the usual card decks don't reach: email infrastructure, the software factory and care monitoring at home. The smart home is the biggest of them all, and it's the one where I couldn't find a threat taxonomy that took the house seriously. So I built a game for it, and the game came with a taxonomy. Let me introduce **Open House**. ## Why "Open House"? At first glance it's an estate agent's phrase: the door is open and anyone can walk around. That is exactly the problem. Smart home products tend to **fail open**: when the battery dies, the cloud goes down, the app is out of date or the person who set it up moves out, the house is left in a state nobody chose. The tagline says it plainly: **Every connected home fails open somewhere.** The game is there to help you find out where in yours, before your customers do. ## Two decks, each playable on its own A smart home has two halves. There are the **things** on the walls, in the cupboards and on the roof, and there is everything that **controls** them: the network, the vendor's cloud, the phone in a pocket, voice and automations, the household and the device lifecycle. Teams usually own one half or the other, so Open House ships as two decks. ![The two decks of Open House: The Things and The Control, with their suits](https://www.ostering.com/media/posts/205/launch-two-decks.png =1600x790) - **The Things** (103 cards): Hub and Bridges, Radio and Mesh, Domotics, Cameras and Doorbells, Alarms and Locks, Appliances and Energy. Seven suits of 13 cards, ten Trumps, a quick-reference card and a taxonomy card. Use it when you are designing devices and the hub. - **The Control** (90 cards): Home Network, Vendor Cloud, Remote Control, Voice and Automations, Household and Lifecycle. Six suits of 13 cards, the same ten Trumps and the same two reference cards. Use it when you are designing the cloud, the apps and who can do what. The **Trumps** are structural hazards: properties of the connected home as a whole rather than of any one device. *The House Is the Blast Radius*. *Houses Change Hands*. *Many Homes, One Grid*. *The House Keeps a Diary*. When you play one, you say how it shows up across your whole design. ## What a card looks like Every card carries a threat, three mitigation prompts and its full taxonomy ID. Here is one from the Cameras and Doorbells suit, in full. ![Five Open House cards fanned out, including OPH-CM-Q Stranger in the Camera](https://www.ostering.com/media/posts/205/launch-card-fan.png =1600x880) > **OPH-CM-Q · Q of Cameras and Doorbells** > > **Stranger in the Camera** > > Camera accounts protected by a password alone are taken over by credential stuffing, and the attacker watches and talks to the household through the camera. > > **Mitigation prompts** > 1. Is a passkey or second factor required before the camera goes live? > 2. Are breached passwords refused and odd logins flagged? > 3. Would everyone at home know a stranger had opened live view? This isn't hypothetical. In December 2019 a family reported that a stranger had used the Ring camera in their eight-year-old daughter's bedroom to talk to her ([AP via TechXplore](https://techxplore.com/news/2019-12-family-camera-year-old-daughter-room.amp)). Notice the third prompt. It isn't about the attacker at all; it's about the people in the house, who are the ones being watched. The ID, **OPH-CM-Q**, is the game (OPH), the suit (CM) and the value (Q). It's the same on the card and in the taxonomy, so whatever you write down during the game leads straight to the entry, with its mitigation principle, its design measures and its STRIDE, CAPEC and CWE mappings. ## How a session runs A session takes 60 to 90 minutes with three to six players. You don't need to be a security specialist. The cards carry the security knowledge; the people at the table carry the knowledge of the design. Open House needs both. 1. **Draw the house.** On the A3 floor plan, draw the design you are reviewing: the devices in each room, the hub, the radios, the home network, the vendor cloud, the phone and computer that control it from outside, and the people who live there. Draw arrows for what talks to what. Ten minutes is enough. If you can't draw a part of it, that's your first finding. 2. **Choose a deck and two or three suits**, plus the ten Trumps. Reviewing a camera? CM, NW and CL. A smart lock? AL, RF and RC. Three suits and the Trumps make 49 cards, which is about an hour. 3. **Name a Scribe.** The Scribe plays as normal and also keeps the findings log: for every threat that applies, the card ID, the part of the drawing, what could happen and what the table decided. 4. **Optionally, name a Householder.** More on this role below. 5. **Shuffle and deal every card.** ### Trick play Open House is a trick-taking game, like whist or bridge. The player to the dealer's left leads. Everyone follows suit if they can. The highest card of the suit led wins the trick, unless someone played a Trump, in which case the highest Trump wins. If a Trump is led, the others follow with a Trump if they can. Within a suit, cards rank by severity, from the Ace (the most severe threat in its suit) down to the 2. Trumps rank from T10 down to T1. Every card is a claim. When you play it, you read the title and threat aloud and say how it could happen in your design: which device, which link, which person. Then the table works through the three prompts. A card that can't apply still has to be played, and you say why. "We checked, and it doesn't apply" is a finding too. ### Scoring - **1 point** when your card's threat applies to the design and the table agrees. - **1 point** for winning the trick. Agreement doesn't need a vote: if nobody can say why the threat couldn't happen here, it applies. The player with the most points wins, but in practice the findings log is the prize, and it belongs to everyone at the table. ### The Householder Smart home products are bought by one person and lived with by many: a partner, the children, a lodger, a cleaner, the next owner, the people next door. Their interests are rarely represented in a design review. The **Householder** is an optional role that fixes that. They play their hand as normal and also speak for those people. Once per trick, the Householder can challenge a player who says a threat doesn't apply: "What about the person who…?" If the table agrees that the threat does apply to someone in or near the house, it goes in the log and the Householder scores a point. The role earns its keep with the Household and Lifecycle suits, and with Trumps like *Many Hands on the Keys* and *Houses Change Hands*. ### After the game Within a day, go through the findings log with the people who own the design. Look each finding up in the taxonomy by its ID, decide to fix, accept or find out more, and put the card ID in the ticket. That keeps the trail from the game to the change. One rule I'd ask every team to keep: a threat marked **†** has a physical-safety consequence (fire, flood, cold, injury or a door open to the street). Don't accept one of those without the person who owns product safety in the room. ### Other ways to play - **Quick game:** one suit and the Trumps, 23 cards, about 20 minutes. Good for a single feature in a sprint review. - **Full house:** both decks together, over two or three sessions, for a whole product line. - **Walkthrough:** one or two people go through a suit from Ace to 2 against the drawing. - **Remote:** share the drawing on a whiteboard and play by pasting card IDs into the chat. - **Teaching:** start with the two booklets in the box. **Fernhill** is a worked example, a game played from the drawing to the findings log. **Thistle Lane** is a house to threat model on your own, and then compare your log with someone else's. ## The game came first I want to be clear about the order of things, because it matters for how you use them. **Open House came first, and the Smart Home Threat Taxonomy is its reference.** The taxonomy grew out of the card game: every card in both decks has an entry under the same ID, and the taxonomy adds what doesn't fit on a card, such as the mitigation principle, the design measures, the mappings and the public cases. The taxonomy has 169 threats in 13 suits plus the 10 structural hazards, 179 entries in all. I've written about it in [Every Connected Home Fails Open Somewhere](https://ostering.com/every-connected-home-fails-open-somewhere/), and about how it maps to STRIDE, CAPEC and CWE in [Mapping the Smart Home Threat Taxonomy](https://ostering.com/mapping-the-smart-home-threat-taxonomy/). The taxonomy itself lives at [ostering.com/taxonomies/smart-home](https://ostering.com/taxonomies/smart-home/), which is also where the QR code on each deck's taxonomy card takes you. ## Credits The trick-taking format comes from **Elevation of Privilege** by Adam Shostack, released by Microsoft under the Creative Commons Attribution 3.0 licence. Open House reuses none of its card text or artwork. If you're new to that format, my book *Threat Modeling Gameplay with EoP* (Packt, 2024) covers it in depth. The threats are drawn from public research, vendor advisories, regulators' actions and the way these systems are built. Where a threat has happened in public, the taxonomy cites the case: the Ring takeovers above, the Wyze camera fault that showed some owners other people's homes ([Engadget](https://www.engadget.com/wyze-camera-security-issue-showed-13000-users-other-owners-homes-140059551.html)), and the Mirai botnet, built from internet-exposed cameras and recorders ([KrebsOnSecurity](https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/)). In all, 38 entries cite a public case. Coming soon. If you’d like the decks when they're published, send me a message on LinkedIn. Knowing there’s demand helps a publisher decide which games to prioritise. ## Note to product teams If you build anything that ends up on the wall of someone's home, here is what I'd ask: - **Play the suit you're least comfortable with.** Device teams should play Household and Lifecycle at least once. Cloud teams should play Domotics and Alarms and Locks. The threats that hurt people sit at the boundary between the two halves of the house. - **Bring the safety owner.** If your product can heat, cool, flood, lock or unlock, someone who owns product safety belongs at the table when the † cards come up. - **Play the Householder.** Your customer is not one person. Somebody at the table should speak for the partner, the lodger, the children and the next owner. - **Keep the ID.** Put the card ID in every ticket. In a year you'll be able to count which threats keep coming back in your products, and that is worth more than any single session. ## Final thoughts Open House is the fourth game in the family, after Elevation of Email Flow, Software Factory and Elevation of Care, and it covers the biggest space of the four. Smart home threat models tend to model the device, or the cloud, or the app, but not the house. The house is where the consequences land, and that is what this game puts on the table. The game is new, and I expect the wording on the cards to improve as teams play it. The IDs won't change: the ranks are fixed from v1.0, so what you log today will still point at the right entry tomorrow. Draw your house, deal the cards and find out where it fails open. Stay tuned! ## Related links - [Smart Home Threat Taxonomy](https://ostering.com/taxonomies/smart-home/) - [Every Connected Home Fails Open Somewhere: A Threat Taxonomy for the Smart Home](https://ostering.com/every-connected-home-fails-open-somewhere/) - [Mapping the Smart Home Threat Taxonomy](https://ostering.com/mapping-the-smart-home-threat-taxonomy/) - [Structural hazards: the ten Trumps](https://ostering.com/taxonomies/smart-home/oph-structural-hazards/) - [Care Assistant Threat Taxonomy](https://ostering.com/taxonomies/care-assistant/) - [Software Factory Threat Taxonomy](https://ostering.com/taxonomies/software-factory/) - [Email Infrastructure Threat Taxonomy](https://ostering.com/taxonomies/email-infrastructure/)