Using Gamification to Raise Awareness of Cyber Threats to Critical National Infrastructure

Senior executives of critical national infrastructure facilities face competing requirements for investment budgets. Whilst the impact of a cyber attack upon such utilities is potentially catastrophic, the risks to continued operations from failing to upgrade ageing infrastructure, or not meeting mandated regulatory regimes, are considered higher given the demonstrable impact of such circumstances. As cyber attacks on critical national infrastructure remain low-frequency events, there is little to motivate business leaders to increase their investment in cyber defences to comparable levels. This paper describes SCIPS, a gamified environment in which senior executives experience the impact of a cyber attack on an electric power generation plant, demonstrating how it can strategically affect shareholder value, and allows them to form their own views on the relative importance of cyber security investment.

Content

Author and article information

Contributors

Allan Cook: URI : www.dmu.ac.uk

Richard Smith: URI : www.dmu.ac.uk

Leandros Maglaras: URI : www.dmu.ac.uk

Helge Janicke: URI : www.dmu.ac.uk

Conference

Publication date: August 2016

Publication date (Print): August 2016

Pages: 84-94

Affiliations

[0001]Cyber Security Centre, De Montfort University, Leicester, LE1 9BH, UK

Article

DOI: 10.14236/ewic/ICS2016.10

SO-VID: c5b94cd3-d412-429b-b438-f2446d841a42

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: 4th International Symposium for ICS & SCADA Cyber Security Research 2016

Conference acronym: ICS-CSR

Conference number: 4

Conference location: Queen’s Belfast University, UK

Conference date: 23 - 25 August 2016

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Cyber Security Research

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/ICS2016.10

Self URI (journal page): https://ewic.bcs.org/

REFERENCES

K. Boopathi et al 2015 Learning cyber security through gamification Indian Journal of Science and Technology 8 7 642 649
B. Burke 2014 Gamify: How gamification motivates people to do extraordinary things Bibliomotion ,Inc
R. B. Cialdini 2009 Influence: Science and practice 4 Pearson Education Boston
De Montfort University 2016 April Scips user interface design
De Montfort University and CERT-UK 2015 Nov Meeting between de montfort university cert-uk
ENISA 2016 Trainings for cyber security specialists ext-link-type="uri" xlink: href="https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/operational">https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/operational Accessed 25 April 2016
G. Fink et al 2013 Gamification for measuring cyber security situational awareness Foundations of Augmented Cognition Springer 656 665
J. Hamari et al 2014 Does gamification work?— A literature review of empirical studies on gamification 2014 47th Hawaii International Conference on System Sciences 3025 3034
D. HaughtJ. Paladino 2012 Improving the reliability and resiliency of the us electric grid Metering International 1 46
E. M. Hutchins et al 2011 Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains Leading Issues in Information Warfare & Security Research 1 80
M. N. Kahn 2010 Sentiment market analysis FTPress Delivers
S. KaplanB. J. Garrick 1981 On the quantitative definition of risk Risk analysis 1 1 11 27
S. M. Kaplan 2009 Apr Electric power transmission: background and policy issues US Congressional Research Service 14 4 5
K. M. Kapp 2012 The gamification of learning and instruction: game-based methods and strategies for training and education. John Wiley & Sons
K. M. Kapp 2013 The gamification of learning and instruction fieldbook: Ideas into practice. John Wiley & Sons
M. C. Libicki 2009 Cyberdeterrence and cyberwar oRand Corporation
J. Menkes 2009 Executive intelligence. Harper Collins
M. Naedele 2007 Addressing it security for critical control systems 40th Annual Hawaii International Conference on System Sciences 115
National Research Council 2010 Review of the Department of Homeland Security’s Approach to Risk Analysis The National Academies Press
NERC 2010 High-impact, low-frequency event risk to the north american bulk power system A Jointly-Commissioned Summary Report of the North American Electric Reliability Corporation and the U.S. Department of Energys November 2009 Workshop
L. P. Rieber 1996 Seriously considering play: Designing interactive learning environments based on the blending of microworlds, simulations, and games Educational technology research and development 44 2 43 58
A. StottC. Neustaedter 2013 Analysis of gamification in education Surrey, BC, Canada, 8
K. Stouffer et al 2011 Guide to industrial control systems (ics) security NIST special Publication 800 82
E. J. VaughanT. Vaughan 2013 Fundamentals of risk and insurance, 11th John Wiley & Sons
J. Wolfe 1997 The effectiveness of business games in strategic management course work Simulation & Gaming 28 4 360 376
L. M. Wortzel 2013 The dragon extends its reach: Chinese military power goes global Potomac Books, Inc
G. ZichermannJ. Linder 2010 Game-based marketing: inspire customer loyalty through rewards, challenges, and contests John Wiley & Sons

Comments

Comment on this article

[1] K. Boopathi et al 2015 Learning cyber security through gamification Indian Journal of Science and Technology 8 7 642 649

[2] B. Burke 2014 Gamify: How gamification motivates people to do extraordinary things Bibliomotion ,Inc

[3] R. B. Cialdini 2009 Influence: Science and practice 4 Pearson Education Boston

[4] De Montfort University 2016 April Scips user interface design

[5] De Montfort University and CERT-UK 2015 Nov Meeting between de montfort university cert-uk

[6] ENISA 2016 Trainings for cyber security specialists ext-link-type="uri" xlink: href="https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/operational">https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/operational Accessed 25 April 2016

[7] G. Fink et al 2013 Gamification for measuring cyber security situational awareness Foundations of Augmented Cognition Springer 656 665

[8] J. Hamari et al 2014 Does gamification work?— A literature review of empirical studies on gamification 2014 47th Hawaii International Conference on System Sciences 3025 3034

[9] D. HaughtJ. Paladino 2012 Improving the reliability and resiliency of the us electric grid Metering International 1 46

[10] E. M. Hutchins et al 2011 Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains Leading Issues in Information Warfare & Security Research 1 80

[11] M. N. Kahn 2010 Sentiment market analysis FTPress Delivers

[12] S. KaplanB. J. Garrick 1981 On the quantitative definition of risk Risk analysis 1 1 11 27

[13] S. M. Kaplan 2009 Apr Electric power transmission: background and policy issues US Congressional Research Service 14 4 5

[14] K. M. Kapp 2012 The gamification of learning and instruction: game-based methods and strategies for training and education. John Wiley & Sons

[15] K. M. Kapp 2013 The gamification of learning and instruction fieldbook: Ideas into practice. John Wiley & Sons

[16] M. C. Libicki 2009 Cyberdeterrence and cyberwar oRand Corporation

[17] J. Menkes 2009 Executive intelligence. Harper Collins

[18] M. Naedele 2007 Addressing it security for critical control systems 40th Annual Hawaii International Conference on System Sciences 115

[19] National Research Council 2010 Review of the Department of Homeland Security’s Approach to Risk Analysis The National Academies Press

[20] NERC 2010 High-impact, low-frequency event risk to the north american bulk power system A Jointly-Commissioned Summary Report of the North American Electric Reliability Corporation and the U.S. Department of Energys November 2009 Workshop

[21] L. P. Rieber 1996 Seriously considering play: Designing interactive learning environments based on the blending of microworlds, simulations, and games Educational technology research and development 44 2 43 58

[22] A. StottC. Neustaedter 2013 Analysis of gamification in education Surrey, BC, Canada, 8

[23] K. Stouffer et al 2011 Guide to industrial control systems (ics) security NIST special Publication 800 82

[24] E. J. VaughanT. Vaughan 2013 Fundamentals of risk and insurance, 11th John Wiley & Sons

[25] J. Wolfe 1997 The effectiveness of business games in strategic management course work Simulation & Gaming 28 4 360 376

[26] L. M. Wortzel 2013 The dragon extends its reach: Chinese military power goes global Potomac Books, Inc

[27] G. ZichermannJ. Linder 2010 Game-based marketing: inspire customer loyalty through rewards, challenges, and contests John Wiley & Sons

Celebrating 65 years of The Computer Journal - free-to-read perspectives - bcs.org/tcj65