TSYS School Professor and Student Team Up to Develop Cybersecurity Training Game

The lack of cybersecurity awareness among everyday users is a significant issue that can have detrimental effects on individuals and organizations alike. Traditional training methods such as slideshows and presentations have proven to be ineffective and can cause trainees to feel overwhelmed, overloaded, confused, or bored. To address this issue, TSYS School professor Rania Hodhod and TSYS School computer science student Harlie Hardage teamed with Safia Abbas of Ain Shams University and Eman Abdullah Aldakheel of Princess Nourah Bint Abdulrahman University to develop an adaptive serious game that teaches cybersecurity in an effective, engaging, and personalized manner is proposed. As Hodhod explained, "Serious games provide an immersive and simulated experience that can help users determine how they might act in real-life scenarios. However, existing cybersecurity serious games often measure effectiveness outside of the game using surveys, tests, and interviews, which can lessen immersion and the simulated experience. Therefore, measuring improvement within the game itself can provide more meaningful data and derive truer conclusions about the usefulness of serious games in teaching cybersecurity." 

     The goal of the research study, which appears in the current issue of Electronics, was to develop such a game and measure its effectiveness in a way that can inform future cybersecurity training programs in a way that improves cybersecurity awareness and reduce the risk of cyber threats. The game they developed is called CyberHero, and it is a narrative manager that drives the development of the overall story using an interactive branching storyline to educate users about cybersecurity by allowing the users to experience the consequences of their actions in the digital world. The framework followed to create the game narrative ensures that the scenarios are interesting, influential, and hold relevant but intriguing meanings to the players. The game identifies nine competencies. These are password security, system updates, network security, antivirus protection, phishing awareness, device security, physical security, browser security, and secure file and information sharing. Each of these competencies requires the inclusion of specific tasks that users must complete. This necessitated the creation of at least nine tasks, with two variants available for each task—one for the initial trial and another for retesting if the user needed it. The second task was not an exact repetition but rather a similar task addressing the same competency.  Users reported that the game is helpful, with 79% of the participants admitting that they learned new things by playing the game, 84% saying that they were engaged by the background story, 68% agreeing that they had fun while playing the game, and 84% recommending the game to others.