When used correctly, gamification can be one of the most effective tools for changing behavior on a large scale, but it requires more than just designing a few digital merit badges for doing security training. In this talk Kati Rodzon will discuss how games like Portal and Candy Crush were able to make millions and how those same techniques can be used to change security as we know it.
28. STARTING A GAME
Creating a Foundation of Skills
High Reward Schedule
29. STARTING A GAME
Creating a Foundation of Skills
High Reward Schedule
Make sure players are placed within their skills level
30. STARTING A GAME
Creating a Foundation of Skills
High Reward Schedule
Make sure players are placed within their skills level
IT”S TOO HARD!
I’m BORED!
31.
32. MAKING A TASK ‘SEEM’ EASIER
Break Down Into Subtasks
IT”S TOO HARD!
33. MAKING A TASK ‘SEEM’ EASIER
Break Down Into Subtasks
IT”S TOO HARD!
34. MAKING A TASK ‘SEEM’ EASIER
Break Down Into Subtasks
Reward more frequently
35. MAKING A TASK ‘SEEM’ EASIER
Break Down Into Subtasks
Reward more frequently
36. MAKING A TASK EASIER (OR SEEM THAT WAY)
Break Down Into Subtasks
Reward more frequently
Provide outside tools for ‘practice’
42. MAKING TASKS MORE DIFFICULT
Add sub-skills onto current skills
Add things to the environment/level
43. MAKING TASKS MORE DIFFICULT
Add sub-skills onto current skills
Add things to the environment/level (Portal goop)
Add elements for complexity (e.g., tools, weapons, skills)
44. BEYOND THE BADGE!
Keep your target audience away from the ends of the curve
Know the behavior your way (linear? Repeated interaction?)
80% of training needs to be either ‘time filler’ or ‘grey area’ in design
Onboarding is KEY to getting and keeping users (foundational information)
Create roadmaps the add sub skills onto current skills (e.g., network
pentesting >>> application pen testing >>> reverse engineering)
Switch team members to encourage learning and engagement
Team play keeps employees/users/crowds/humans repeatedly engaged
Provide outside resources for users to practice their skills
PRO TIP: Do not confound extrinsic and intrinsic rewards!
The Learning Curve
Types of Games
Intellectual Complexity
Manipulating the Curve
A video game is all about manipulating the learning curve.
What happens when the skill has a steep learning curve? – break it up into more discrete behaviors
A video game is all about manipulating the learning curve.
What happens when the skill has a steep learning curve? – break it up into more discrete behaviors
A video game is all about manipulating the learning curve.
What happens when the skill has a steep learning curve? – break it up into more discrete behaviors
Single play- you usually go from level to level, there is a clear linear model of the game
Learning curve is in relation to the level…if you go back in level, you will be higher in proficiency
Security- very similar to when you want someone to start and finish a behavior
Single play- you usually go from level to level, there is a clear linear model of the game
Learning curve is in relation to the level…if you go back in level, you will be higher in proficiency
Security- very similar to when you want someone to start and finish a behavior
Repeated Play
Doda
WoW
Diablo
Eve
Repeated play- the same level, room, event can be played/is designed to be played repeatedly.
Learning curve is in relation to the players. Your team or the others you are playing create difficulty
Security: Similar when you want them to repeatedly engage with a component of your program
Repeated Play
Doda
WoW
Diablo
Eve
Repeated play- the same level, room, event can be played/is designed to be played repeatedly.
Learning curve is in relation to the players. Your team or the others you are playing create difficulty
Security: Similar when you want them to repeatedly engage with a component of your program
Note that a steep learning curve means that the task can be learned in a shorter period of time, but it usually is preceded by little skill acquisition
http://www.pcworld.com/article/2061971/10-great-pc-games-with-incredibly-steep-learning-curves.html#slide6
http://www.makeuseof.com/tag/x-games-with-steep-learning-curves-that-are-worth-the-effort/
Note that a steep learning curve means that the task can be learned in a shorter period of time, but it usually is preceded by little skill acquisition
http://www.pcworld.com/article/2061971/10-great-pc-games-with-incredibly-steep-learning-curves.html#slide6
http://www.makeuseof.com/tag/x-games-with-steep-learning-curves-that-are-worth-the-effort/
‘Time Fillers’
Candy Crush, Trivia Crack, Angry Birds, Cut the rope, Doodle Jump – less time is needed for each level. Not a significantly amount of cognitive focus
The ‘Grey Area’
League of Legends, Portal, Portal 2, Braid
While requiring focus, they can be stopped in the middle of a level or with relative ease.
Complete Immersion
Doda 2, Eve Online- require full attention to the game and more intellectual strain/strategy.
Complete immersion acquires more intrisic motivation that the other two.
The motivator to keep playing for ‘time fillers’ like candy crush is the concept of limited commodity. (only so many lives…or pay for more)
What side of the curve for games?
What could be put on both sides for security/behavior change?
Security: Think of training that’s made like time fillers but is expected to be complete immesion (role based training)…how does it feel? Must Know Your Audience!
‘Time Fillers’
Candy Crush, Trivia Crack, Angry Birds, Cut the rope, Doodle Jump – less time is needed for each level. Not a significantly amount of cognitive focus
The ‘Grey Area’
League of Legends, Portal, Portal 2, Braid
While requiring focus, they can be stopped in the middle of a level or with relative ease.
Complete Immersion
Doda 2, Eve Online- require full attention to the game and more intellectual strain/strategy.
Complete immersion acquires more intrisic motivation that the other two.
The motivator to keep playing for ‘time fillers’ like candy crush is the concept of limited commodity. (only so many lives…or pay for more)
What side of the curve for games?
What could be put on both sides for security/behavior change?
Security: Think of training that’s made like time fillers but is expected to be complete immesion (role based training)…how does it feel? Must Know Your Audience!
Security: Simple awareness of the behaviors that need to happen
Security: Simple awareness of the behaviors that need to happen
Security: Simple awareness of the behaviors that need to happen
Security: Simple awareness of the behaviors that need to happen
Security: Simple awareness of the behaviors that need to happen
Security: Simple awareness of the behaviors that need to happen
Security: Autoresponder for phishing emails forwarded
Security: “Top 5 ways to secure yourself on social media”
Security: “Top 5 ways to secure yourself on social media”
Security: “Top 5 ways to secure yourself on social media”
Security: “Top 5 ways to secure yourself on social media”
Security: “Top 5 ways to secure yourself on social media”
Security: “Top 5 ways to secure yourself on social media”
Security: Providing tools for users to do the behavior. Providing training for crowds
Security: Currently security is very much seen as a ‘individual task’ with very few complex tasks created.
Security: ‘Team competitions: giving more resources for training to learn new pertinent skills’
Security: Currently security is very much seen as a ‘individual task’ with very few complex tasks created.
Security: ‘Team competitions: giving more resources for training to learn new pertinent skills’
Security: Currently security is very much seen as a ‘individual task’ with very few complex tasks created.
Security: ‘Team competitions: giving more resources for training to learn new pertinent skills’
Security: Currently security is very much seen as a ‘individual task’ with very few complex tasks created.
Security: ‘Team competitions: giving more resources for training to learn new pertinent skills’
Security: Currently security is very much seen as a ‘individual task’ with very few complex tasks created.
Security: ‘Team competitions: giving more resources for training to learn new pertinent skills’