To main content

Gamification of Information Security Awareness and Training

Abstract

Security Awareness and Training (SAT) programs are commonly put in place to reduce risk related to insecure behaviour among employees. There are however studies questioning how effective SAT programs are in terms of improving end-user behaviours. In this context, we have explored the potential of applying the concept of gamification – i.e. using game mechanics – to increase motivation and learning outcomes. An interactive SAT prototype application was developed, based on interviews with security experts and a workshop with regular employees at two companies. The prototype was tested by employees in a second workshop. Our results indicate that gamification has potential for use in SAT programs, in terms of potential strengths in areas where current SAT efforts are believed to fail. There are however significant pitfalls one must avoid when designing such applications, and more research is needed on long-term effects of a gamified SAT application.

Category

Academic chapter

Language

English

Author(s)

  • Eyvind Gaarder Bull Gjertsen
  • Erlend Andreas Gjære
  • Maria Bartnes
  • Waldo Rocha Flores

Affiliation

  • SINTEF Group Head Office
  • SINTEF Digital / Software Engineering, Safety and Security
  • Norwegian University of Science and Technology
  • Ernst & Young

Year

2017

Publisher

SciTePress

Book

Proceedings of the 3rd International Conference on Information Systems Security and Privacy, Porto, Portugal, 19 - 21 February, 2017

ISBN

9789897582097

Page(s)

59 - 70

View this publication at Norwegian Research Information Repository