Forty percent of our daily activities are automated routines or habits which are not under conscious control. Gamification for security awareness has been tried but almost no work has happened in the context of “Habit Cycle.” What is the science behind the formation of habits in our brain? How can you use gamification in your enterprise or for young kids to help form lasting and sticky security habits?

1. SESSION ID:SESSION ID:
#RSAC
Bikash Barai
Gamification Using “Science of Habit
Cycle” to Transform User Behavior
HUM-R10F
Co-founder, FireCompass
Twitter: @bikashbarai1

2. #RSAC
The Problem With Awareness Program…
Graph: Continued security training beyond the baseline are unlikely to
be effective - “Modifying Smartphone User Locking Behavior” – by Dirk et
al (ACM – 2013)
Awareness
Change in Behavior
Credit: Abd Allah Foteih

3. #RSAC
Before Gamification… Games &
Reality

4. #RSAC
When Michael Phelps Got
Blinded at Olympics

5. #RSAC
Tetris Effect ….& Auditor’s
Misery
Tetris Effect …. And
Auditor’s Misery

6. #RSAC
So, How Can We Train Our
Neural Spam Filter?

7. #RSAC
Now… Let’s Talk About Gamification
7
Application of game-like mechanics to non-
game entities to encourage a specific behavior.
What it is not?
It is not a game

8. #RSAC
Foldit: 15 Years Vs 10 Days !
Image: Wikimedia

9. #RSAC
Pain Squad

10. #RSAC
Loyalty Rewards Program
Image: Wiki

11. #RSAC
Building Blocks for Gamification

12. #RSAC
Image: Pixabay/Wikipedia
No.. That’s Not
Enough
Points, Badges and Leader boards…

13. #RSAC
Good Gamification starts with Human Desires

14. #RSAC
What Happened When People Were Paid To
Donate Blood?
Image: Pixabay

15. #RSAC
Human Motivation and Gaming
Gamification Motivators
Autonomy
Mastery
Purpose/Meaning
Rewards
Status
Relationships
Peer Pressure
Avoidance/Loss
Scarcity
Martin Seligman/PERMA (Positive
Psychology)
Positive Emotion
Engagement
Relationships
Meaning
Accomplishment
Daniel Pink
Autonomy
Mastery
Purpose

16. #RSAC
Understanding Flow
Image: Wikimedia

17. #RSAC
Using Gamification in Security
17
Gamification is relatively new and is being recently tried out in
security
Basic process
Identify Goals
Define Rules
Define Rewards
It works better than the poster on your office wall..for sure

18. #RSAC
You Can Do Better…
What if I Told…
https://www.flickr.com/photos/snaps_at_aquastuff/3777104375

19. #RSAC
The Mystery of Eugene Pauly’s Brain ..
19
Dr. Lary R. Squire
University of California, San Diego
Image Source: http://whoville.ucsd.edu/about.html

20. #RSAC
Goal Directed System (Pre-Frontal
Cortex)
Responsible for new or infrequent behaviors
Guided by attitudes, goals, values,
knowledge
Conscious and deliberate
Slow
Habit System (Basal Ganglia)
Very fast. Does not require thought or
attention
Less conscious. More automatic
Goal Directed and Habit System
20
Credit: Neal et al – The Science of Habit…

21. #RSAC
How To Build A New Habit?

22. #RSAC
The Story Of..

23. #RSAC
Habit Cycle: Trigger – Routine – Reward
23
Trigger:
Feel Tooth Film with
tongue
Routine:
Brushing Teeth
Reward:
Great Smile
Crave for
Tingling
Image Credit: Seth LemmonsImage Credit: Wikipediahttps://i.ytimg.com/vi/rf1Bs2XpwFI/maxresdefault.jpg

24. #RSAC
How To Change A Habit?

25. #RSAC
25
Old Habits
Never Die

26. #RSAC
Example – Changing A Habit
26
Trigger:
Boredom
Routine:
Have a Whisky
Reward:
Feel Happy
Image Credit: Wiki

27. #RSAC
Example – Changing A Habit
27
Trigger:
Boredom
Routine:
Have a Whisky
Reward:
Feel Happy
Image Credit: Wiki

28. #RSAC
Changing the Habit of Writing Down Password in
Open Areas
Goal: Stop the habit of writing down password areas
Trigger – New password setting request
Old Routine – write down the password
New Routine – “write down the clue” or “Use a Scheme to generate new
passwords”
Reward – Feeling of security
Rehearse or Repeat

29. #RSAC
Introducing Habit-Centric
Gamification

30. #RSAC
4 Principles Of Habit-Centric Gamification
Focus on Building
Habit Cycle
Reward Actions
Tied To Triggers
& Not All Positive
Action
Reward
Successive
Positive Actions
Penalize if Chain
Of Positive
Actions Is Broken

31. #RSAC
Example: Normal Vs Habit-Centric Gamification
Normal Gamification
Reward every time one goes jogging/attends a security lesson
Habit-Centric Gamification
Reward every time one jogs right after waking up/attends a
weekly security lesson
Penalize if chain of positive behavior is broken OR Non-linear
benefit for building longer chain of success
31

32. #RSAC
Changing coding habits
32
Trigger:
Need to type a
function
Routine:
Type insecure function
Reward:
Sense of task
completion
Image Credit: Wiki

33. #RSAC
Changing coding habits
33
Trigger:
Need to type a
function
Routine:
Type secure function
(Use intervention)
Reward:
Sense of task
completion
Image Credit: Wiki

34. #RSAC
Gamify Secure Coding
Game mechanism for training
Weekly fixed day secure coding training – 10 points
Each successful streak of 5 weeks – Additional 100 points
Every miss – Chain breaks
Game mechanism for secure coding
Realtime feedback using automated tools
Every success: 1 point
Every streak of 20 success: Additional 100 points
Every miss – Chain breaks

35. #RSAC
Gamify Secure Coding
Motivation/Rewards
Purpose/meaning
Intrinsic Rewards:
— Mastery, Self development, Progress
Points/Badges/Leaderboard
Extrinsic Rewards: Tshirts, Coupons etc for top performers

36. #RSAC
Gamify Phishing Awareness
Let’s do it together !
Habit Loop
Trigger – Routine – Reward
Game Mechanics

37. #RSAC
Apply What You Learned

38. #RSAC
Apply What You Learned
Try it out on yourself
Choose 1 habit that you want to change or build
Gamify it with HCG principles
Next Week

39. #RSAC
Apply What You Learned (Contd..)
First 3 months
Work on 1 -2 habits with a small group of volunteers
Gamify. Utilize drills (20 to 30 repetitions for each habit). Create other
monitoring mechanisms outside of drills
Give Rewards. Measure the success of the program
After 6 months
Find the most important habits to change in your organization
Create an organization wide plan for gamification
39

40. #RSAC
1. Awareness Is Not Enough
40
2. Leverage Habit-Cycle
3. Gamify Building Secure Habit-Cycle

41. #RSAC
One Last Story.. The Cobra Effect

42. #RSAC
Want To Engineer A Habit?
42
Let’s Meet At The Bar ..

43. #RSAC
Questions please..
Bikash.Barai@FireCompass.com
@bikashbarai1
43
Bikash Barai