A pedagogical design model to create serious games for cyber security

Cyber attacks have been increasing, and there have been many media reports of attacks against large and small organisations, causing financial loss and reputational damage. Organisations invest in professional training courses for their employees to raise awareness of cyber attacks and related defences. However, traditional approaches have failed to effectively educate employees, as testified by the increasing number of successful cyber attacks exploiting human factors. Serious games are an effective alternative tool to educate and train people on cyber security concepts. There is consensus on the benefits and potential of creating serious games and gamification techniques, which applies game mechanics to non-gaming activities, such as training to make the exercise more engaging. Many serious games have been created without a transparent and formal design process. There are currently several pedagogical models, frameworks, and methodologies for designing and analysing serious games that provide valuable interpretations. None of the models is designed specifically for serious cyber games, and these models focus primarily on high-level aspects and requirements. Many design models fail to address higher-order thinking skills and do not consider the target players’ different needs. They do not help understand how such high-level requirements can be concretely satisfied and not a detailed explanation of how to design a serious game in a step-by-step process. This thesis proposes a new pedagogical model called MOTENS to design serious cyber games for awareness and education. The MOTENS model was developed from the experience of creating Riskio, a multiplayer tabletop game to increase cyber security awareness for people with a technical and non-technical background working in organisations and university students. A new serious game called CIST: A serious single-player online game for hardware security supply chain was designed using the MOTENS model. The CIST game was then tested to verify that the game mechanics design selected using the MOTENS model achieved the desired learning outcomes. The CIST game was played and evaluated in a workshop on hardware security threats and defences for MSc/PhD students. Some issues reported by the students were identified as failure of the CIST game design and not the MOTENS model. As with the Riskio game, the CIST game proved popular with the target players and increased players participation in learning. Further research is required to develop the MOTENS model by creating and designing/evaluating different types of serious cyber games