Design and evaluation of a cybersecurity education game

Paul Gestwicki and Kaleb Stumbaugh

Abstract

We present the background, design, and evaluation of Social Startup Game--an original cybersecurity education game for ages 10-16. The game is designed with two primary goals: first, to teach the player fundamentals of cybersecurity, and second, to show them possible careers and educational paths to careers in cybersecurity. Social Startup Game is a single-player strategy game in which the player takes the role of a security consultant at a fictional social media software development company, Social Jam. The player balances the tasks of their employees to maximize user acquisition while reducing security vulnerabilities; during the simulation, the player has to make several narrative-based decisions that are designed to foreground our design goals. We evaluated the game using a qualitative research methodology involving semi-structured interviews and recorded gameplay with thirteen minors in our target demographic. This led to four primary findings: the players have mixed views about the role of education and degree toward career goals; there are diverse opinions about professional developers' appearances and interests; players' background knowledge had a significant impact on their ability to learn from playing the game; and there were two distinct modes of character-based decision making, which we distinguish as pragmatic or empathic. Among our conclusions are the need for continued study of the role of characters, narrative, and player background in educational simulation games, especially with respect to classical theories of constructivist learning and more contemporary theories of situated learning.