PROTECT - An Easy Configurable Serious Game to Train Employees Against Social Engineering Attacks

Goeke, L.; Quintanar, A.; Beckers, K. and Pape, S.

In Computer Security - ESORICS 2019 International Workshops, IOSec, MSTEC, and FINSEC, Luxembourg City, Luxembourg, September 26-27, 2019, Revised Selected Papers, pages 156-171, Springer International Publishing, Cham, Lecture Notes in Computer Science 11981, 2019.

Abstract

Social engineering is the clever manipulation of human trust. While most security protection focuses on technical aspects, organisations remain vulnerable to social engineers. Approaches employed in social engineering do not differ significantly from the ones used in common fraud. This implies defence mechanisms against the fraud are useful to prevent social engineering, as well. We tackle this problem using and enhancing an existing online serious game to train employees to use defence mechanisms of social psychology. The game has shown promising tendencies towards raising awareness for social engineering in an entertaining way. Training is highly effective when it is adapted to the players context. Our contribution focuses on enhancing the game with highly configurable game settings and content to allow the adaption to the player's context as well as the integration into training platforms. We discuss the resulting game with practitioners in the field of security awareness to gather some qualitative feedback.

PDFDOILinkLinkBibtexsecurityserious gamesocial engineeringthreat-arrest

Bibtex

@InProceedings{GQBP19mstec,
  author    = {Ludger Goeke and Alejandro Quintanar and Kristian Beckers and Sebastian Pape},
  title     = {{PROTECT} - An Easy Configurable Serious Game to Train Employees Against Social Engineering Attacks},
  booktitle = {Computer Security - {ESORICS} 2019 International Workshops, IOSec, MSTEC, and FINSEC, Luxembourg City, Luxembourg, September 26-27, 2019, Revised Selected Papers},
  year      = {2019},
  editor    = {Fournaris, Apostolos P. and Athanatos, Manos and Lampropoulos, Konstantinos and Ioannidis, Sotiris and Hatzivasilis, George and Damiani, Ernesto and Abie, Habtamu and Ranise, Silvio and Verderame, Luca and Siena, Alberto and Garcia-Alfaro, Joaquin},
  volume    = {11981},
  series    = {Lecture Notes in Computer Science},
  pages     = {156--171},
  address   = {Cham},
  publisher = {Springer International Publishing},
  doi       = {10.1007/978-3-030-42051-2\_11},
  isbn      = {978-3-030-42051-2},
  keywords  = {security, social engineering, threat-arrest, serious game},
  url       = {https://link.springer.com/chapter/10.1007/978-3-030-42051-2_11},
}

PDF