Gamification and Security Talk

© Wombat Security Technologies, Inc. All rights reserved. Wombat Security Technologies name, logo, PhishPatrol® and PhishGuru® are all trademarks of Wombat Security Technologies, Inc.© Wombat Security Technologies, Inc. All rights reserved. Wombat Security Technologies name, logo, PhishPatrol® and PhishGuru® are all trademarks of Wombat Security Technologies, Inc.
Gamification and Security
Jason Hong, PhD
CTO and Co-Founder
Wombat Security Technologies

Today’s Topics
• Non-Security Examples of Gamification
– Give examples of diversity and range of ideas
– Step back, talk about core ideas and mechanisms
• Gamification for Security
• Effectiveness of Gamification

Lots of Examples of Gamification

Directly Turning Activity into a Game
• http://www.thefuntheory.com/

Directly Turning Activity into a Game

Indirectly Making Things into a Game

World of Warcraft Achievements

Extreme Lengths for Achievements
• Car mechanic needed to add 40 more hours to
the 50 he had already spent playing Perfect
Dark Zero to earn the last achievements

Coding Achievements in Visual Studio
• Fun achievements
– Lonely: Coding on Fri or Sat night
– Potty Mouth: use five different curse words
• Highlight “hidden” features
– Extensions Junkie: install 5 extensions
– Casual Observer: use debugging features
– Cheater: use IntelliTrace Menu 10x

Why Gamification?
• Increased stickiness
– Loyalty cards
• Opening up possibilities, setting goals
– Beer passport, Visual Studio achievements
• Make boring activities fun
– Piano stairs, FitBit, pedometer
• Increased revenues
– WoW for-pay steeds (showing off)

What Motivates People?
• Social utility
– Reciprocity
– Identification with
group
– Altruism
• External personal value
– Reinforcement
– Pay
– Privilege
– Reputation
• Intrinsic value of task
– Fun
– Curiosity
– Challenge

Motivations and Gamification
• Extrinsic
– Publicly visible forms of reputation, rank
– Prestige within a community
– Privilege (special access, early access)
• Intrinsic
– Fun (make a boring activity fun)
– Challenge (set high goals for oneself)
• Social
– Fun, chatting and socializing with others

Example: .
• Goal: Get mobility data from people,
get people to go to cafés / stores / etc
• Extrinsic
– Publicly visible achievements
– Points for going to unusual places
– Discounts if mayor (sometimes)
• Intrinsic
– Makes going to places
more fun
– Learn more places in city

Example: Visual Studio
• Goal: Get people to learn more about
and use features in Visual Studio
• Extrinsic
– Points (note that some fun ones offer 0 points,
to disincentivize stupidity)
• Intrinsic
– Funny achievements
– Joy of unexpected
achievements

Today’s Topics
• Non-Security Examples of Gamification
• Gamification for Security
• Effectiveness of Gamification

Directly Gamifying Security
• Direct
– Anti-Phishing Phil
– Security Training Platform
– CyberCIEGE
– Shostack's Elevation of Privilege Game
• Indirect
– ???

Micro-Games for Cyber Security
• Training doesn’t have to be long & boring
• Micro game format, play for short time
• Two-thirds of Americans played
a video game in past six months
• Not just young people
– Average game player 35 years old
– 25% of people over 50 play games
• Not just males
– 40% of casual gamers women

Wombat’s Security Training Platform

CyberCIEGE
• Users spend virtual
money to operate and
defend their
networks, and can watch
the consequences of
their choices, while
under attack
• Free for US gov and
educational, eval copy
for other orgs

Elevation of Privilege
• Get your developers to think more about
threat modeling
– Spoofing
– Tampering
– Repudiation
– Information Disclosure
– Denial of Service
• http://www.microsoft.com/security/sdl/adopt/eop.aspx

Indirectly Gamifying Security
• Not much work done here
– Also not clear to me what a good angle of attack is
• Turn security into a meta-game
– Ex. Achievements for completing training?
– Ex. Points for doing ongoing training (perhaps
link with ability to spend points)?
– Ex. Limit how far individuals can go (require
social or group effort, similar to Farmville)?
– Ex. Competition between groups in an org

Effects of Gamification?
• Phil, very good results with just 15 min of play
– Over 100k people playing it in first month
– Marked improvement (4517 people selected)

Effects of Gamification?
• In our studies of foursquare, major reasons for
using it (in rough order of strength)
– Badges and Fun
– Social connection
– Place discovery
– Keeping track of places
– A game you can play by yourself
• Other research found people who check-in
more correlated with more knowledge of city

Effects of Gamification
• Gamification not a panacea
– Wii Fit found to be fun but not effective for family
fitness (Scott Owens)
– “Several recent studies have found that young people
often grow bored with exergaming. Three months into
a recent six-month study of the effects of a dance
game, for instance, only 2 of the 21 children
participating were still using the game at least twice a
week.” (NYTimes)
– “But there may be another, unexpected group for
whom exergaming might be extremely beneficial:
grandparents.”

Summary
• Lots of real-world examples of gamification
– Directly turning something into a game
– Indirectly offering game-like mechanisms
• Motivations
– Intrinsic, extrinsic, social
• Gamification for security
– A few examples, still in early stages
– Not entirely clear yet what does and doesn’t work

Extras

MySecureCyberspace

Gamification and Security Talk

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie Gamification and Security Talk

Ähnlich wie Gamification and Security Talk (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Gamification and Security Talk

Hinweis der Redaktion