Abstract:

Cybersecurity is no longer just the concern of technicians working in IT departments. Everyone from school children to CEO's need to be aware of the threats and how to combat them. The first step in this process is to familiarize people with the terminology and expose them to the basic concepts in the field. The teaching of these concepts has traditionally been attempted via traditional classroom methods like tell and test. Unfortunately, this has led many people to complain about the disengagement of students with the material. To address this shortfall, game based learning approaches have been adopted to leverage the intrinsic engagement that games provide. Many different types of games have been used including, Capture the flag exercises, table top exercises as well a a wide range of cyber range activities that have been adopted by corporations, academic institutions and governments. In contrast, primary and secondary schools have focused more on point and click adventures, board games and simplified roleplaying. However, many of the games that are designed are too large and unwieldy to be used in a classroom setting. They are either too technical, requiring large amounts of pre-existing knowledge and training, making them less useful for a naive student group or; they are so complex that they end up requiring a large amount of class time to play. There is an obvious need for a game that is quick to learn and play yet still introduces the appropriate concepts and relationships.

This paper describes "Cyber-Rats": a two player card game developed by the author and which is used to introduce key terms in cybersecurity. The game's learning content is validated by using two separate and complimentary approaches. First it used the Super Cyber Kids Skills framework which was developed as part of an EU funded project to better educate children (8-13) on cybersecurity issues. Second, interviews were conducted with experts in the field of cybersecurity after they had played the game. A semi structured interview was conducted and thematic analysis was used to extract key themes, which are presented in the findings of the paper. The interviews focused on the ease of use of the game, as well as the utility of it in the introduction of key concepts found in cybersecurity.

Finally, the paper gives a description of the game and how it can be used in a classroom setting. It gives a brief discussion of the design decisions made to ensure that "Cyber-rats" can be taught to students in less than ten minutes and still be engaging for the students. This work highlights the need for more smaller scale games in an educational context and the need to validate these games' learning value.

Keywords:

Game based Learning, Cybersecurity, Serious Games, Education, Technology.