Case study 1 – IT security games

The client:
IT Security team within the University of Adelaide’s Information Technology & Digital Services (ITDS) department

The task:
Reduce the number of incidents related to breaches of security within the university by:

•  increasing people’s awareness of good practice in cybersecurity
•  encouraging them to adopt cybersecurity practices in their day-to-day work

Background:
Myself and a colleague within the University of Adelaide’s IT Training team were approached by the IT Security team to create some learning material around cybersecurity, as part of a push to get members of the University community to adopt
better cybersecurity practices. This material would be part of a compulsory online course for all staff but would also be available on the University’s website.

The process:
We began by working with the security team, as subject matter experts, to identify the issues. Using action mapping techniques, we brainstormed the key behaviours that we wanted to change, which included:

• Creating better and stronger passwords
• Recognising phishing emails and reporting them
• Not downloading potentially compromised files or apps
• Categorising data according to their security levels and storing them appropriately

The outcome of our design process was a series of games designed to test people’s security practices and give them the opportunity to learn and improve these practices within a safe environment. We chose a gamefication approach to maximise engagement with the material and provide instant feedback. We used Articulate Storyline 2 to create the games as this meant that we could take advantage of features such as variables to create a more authentic experience and better scoring mechanisms. We wrote several games as “choose your own adventure” scenarios that allowed learners to make decisions about cybersecurity (both good and bad) and explore the consequences.

We received positive feedback from the learners and from our clients, who felt that our work had contributed to a drop in security-related incidents.

View the entire range of games on the University’s website. (Note: these games were created in Articulate Storyline 2 and require Flash to view). There is an html5 version of this game on the Interactives: Real? or No Deal!  page on this website.