[go: up one dir, main page]
More Web Proxy on the site http://driver.im/ skip to main content
research-article

A Systematic Review of Multimedia Tools for Cybersecurity Awareness and Education

Published: 02 January 2021 Publication History

Abstract

We conduct a comprehensive review covering academic publications and industry products relating to tools for cybersecurity awareness and education aimed at non-expert end-users developed in the past 20 years. Through our search criteria, we identified 119 tools that we cataloged into five broad media categories. We explore current trends, assess their use of relevant instructional design principles, and review empirical evidence of the tools’ effectiveness. From our review, we provide an evaluation checklist and suggest that a more systematic approach to the design and evaluation of cybersecurity educational tools would be beneficial.

Supplementary Material

a12-kennedy-supp.pdf (zhang-kennedy.zip)
Supplemental movie, appendix, image and software files for, A Systematic Review of Multimedia Tools for Cybersecurity Awareness and Education

References

[1]
ABCya. 2016. Cyber-Five Internet Safety. Retrieved from http://www.abcya.com/cyber_five_internet_safety.htm.
[2]
Vincent Aleven and Kenneth R. Koedinger. 2002. An effective metacognitive strategy: Learning by doing and explaining with a computer-based cognitive tutor. Cogn. Sci. 26, 2 (2002), 147--179.
[3]
Faisal Alotaibi, Steven Furnell, Ingo Stengel, and Maria Papadaki. 2016. A review of using gaming technology for cyber-security awareness. Int. J. Info. Secur. Res. 6, 2 (2016), 660--666.
[4]
AMAZE. 2017. Personal Safety. Retrieved from https://amaze.org/?topic=personal-safety.
[5]
John R. Anderson, Albert T. Corbett, Kenneth R. Koedinger, and Ray Pelletier. 1995. Cognitive tutors: Lessons learned. J. Learn. Sci. 4, 2 (1995), 167--207.
[6]
Anti-Phishing Working Group. 2008. APWG CMU-Cylab phishing education landing page program. Retrieved from https://education.apwg.org/education-redirect-program.
[7]
Nalin Asanka Gamagedara Arachchilage and Steve Love. 2013. A game design framework for avoiding phishing attacks. Comput. Hum. Behav. 29, 3 (2013), 706--714.
[8]
Farzaneh Asgharpour, Debin Liu, and L. Camp. 2007. Mental models of security risks. In Financial Cryptography and Data Security, Vol. 4886. Springer, 367--377.
[9]
Erinn Atwater and Cecylia Bocovich. 2017. CS4G Netsim. Retrieved from https://netsim.erinn.io.
[10]
Erinn Atwater, Cecylia Bocovich, Urs Hengartner, and Ian Goldberg. 2017. Live lesson: Netsim: Network simulation and hacking for high schoolers. In Proceedings of the Workshop on Advances in Security Education (ASE’17). USENIX Association.
[11]
Australian Communications and Media Authority (ACMA). 2012. Zippep’s Astro Circus. Retrieved from https://www.esafety.gov.au/access/.
[12]
David Barnard-Wills and Debi Ashenden. 2015. Playing with privacy: Games for education and communication in the politics of online privacy. Political Studies 63, 1 (2015), 142--160.
[13]
Geraldo Barros. 2017. Privacy Board Game: The game for privacy. Retrieved from https://privacyboardgame.itidigital.org.
[14]
Malak Baslyman and Sonia Chiasson. 2016. “Smells Phishy?”: An educational game about online phishing scams. In Proceedings of the APWG eCrime Summit. IEEE, 1--11.
[15]
Paulo Battistella and C. Gresse von Wangenheim. 2016. Games for teaching computing in higher education–a systematic review. IEEE Technol. Eng. Edu. J. 9, 1 (2016), 8--30.
[16]
Kristian Beckers and Sebastian Pape. 2016. A serious game for eliciting social engineering security requirements. In Proceedings of the Requirements Engineering Conference (RE’16). IEEE, 16--25.
[17]
Jorge Blasco and Elizabeth A. Quaglia. 2018. InfoSec cinema: Using films for information security teaching. In Proceedings of the Workshop on Advances in Security Education (ASE’18). USENIX Association.
[18]
Blindflug Studios. 2017. Enter–IT Security Game. Retrieved from https://entergame.ch/en/.
[19]
Ian Bogost. 2007. Persuasive Games: The Expressive Power of Videogames. MIT Press.
[20]
Cristian Bravo-Lillo, Saranga Komanduri, Lorrie Faith Cranor, Robert W. Reeder, Manya Sleeper, Julie Downs, and Stuart Schechter. 2013. Your attention please: Designing security-decision UIs to make genuine risks harder to ignore. In Proceedings of the Symposium on Usable Privacy and Security (SOUPS’13). ACM, 6.
[21]
Carnegie Mellon University. 2007. Carnegie Cyber Academy. Retrieved from http://www.carnegiecyberacademy.com.
[22]
Carnegie Mellon University. 2019. PicoCTF. Retrieved from https://picoctf.com.
[23]
Center for Infrastructure Assurance and Security. 2016. Cyber Threat Defender (CTD) collectible card game. Retrieved from http://cias.utsa.edu/ctd_cards.php.
[24]
Center for Infrastructure Assurance and Security. 2018. Cyber Threat Defender (CTD)—PC. Retrieved from https://cias.utsa.edu/ctd.php.
[25]
Alexandra Cetto, Michael Netter, Günther Pernul, Christian Richthammer, Moritz Riesner, Christian Roth, and Johannes Sänger. 2014. Friend Inspector: A serious game to enhance privacy awareness in social networks. Retrieved from https://arXiv:1402.5878.
[26]
Stephane Chaudron, Rosanna Di Gioia, Monica Gemo, and Kaat Lagae. 2015. Happy onlife: A video game to support mediation on internet risks and opportunities. Commun. Papers 4, 6 (2015), 47--62.
[27]
Sonia Chiasson, Manas Modi, and Robert Biddle. 2011. Auction hero: The design of a game to learn and teach about computer security. In Proceedings of the E-Learn: World Conference on E-Learning in Corporate, Government, Healthcare, and Higher Education. Association for the Advancement of Computing in Education (AACE), 2201--2206.
[28]
Child Exploitation Online Protection Centre (CEOP). 2011. Lee and Kim. Retrieved from https://www.thinkuknow.co.uk/professionals/resources/lee-and-kim/.
[29]
Child Exploitation Online Protection Centre (CEOP). 2017. Play Like Share films. Retrieved from https://www.thinkuknow.co.uk/8_10/watch/.
[30]
Child Exploitation Online Protection Centre (CEOP). 2018. Band Runner. Retrieved from https://www.thinkuknow.co.uk/8_10/.
[31]
Childnet International. 2005. Jenny’s Story. Retrieved from https://www.childnet.com/resources/jennys-story.
[32]
Childnet International. 2008. Evaluation of “Let’s Fight it Together,” a film from Childnet International. Retrieved from https://www.childnet.com/ufiles/LFIT-Goldsmiths-Evalutaion-Poster.pdf.
[33]
Children’s Advocacy Center. 2014. B4UClick. Retrieved from https://b4uclick.org/videos/.
[34]
Devon Clark. 2015. Ada The Cyber Security Education Robot. Retrieved from https://www.unhcfreg.com/single-post/2015/10/13/Ada-The-Cyber-Security-Education-Robot.
[35]
James M. Clark and Allan Paivio. 1991. Dual coding theory and education. Edu. Psychol. Rev. 3, 3 (1991), 149--210.
[36]
Ruth Clark and Richard Mayer. 2011. E-learning and the Science of Instruction: Proven Guidelines for Consumers and Designers of Multimedia Learning. John Wiley 8 Sons.
[37]
Ruth C. Clark. 2011. Developing Technical Training: A Structured Approach for Developing Classroom and Computer-based Instructional Materials. John Wiley 8 Sons.
[38]
Common Sense. 2013. Digital Passport. Retrieved from https://www.digitalpassport.org.
[39]
Common Sense Media. 2013. Digital Citizenship Lessons. Retrieved from https://www.commonsense.org/education/lesson/follow-the-digital-trail-k-2.
[40]
Common Sense Media. 2015. Digital Compass. Retrieved from https://www.digitalcompass.org/game/index.html.
[41]
Wikimedia Commons. 2019. ADDIE model of design. Retrieved from https://en.wikipedia.org/wiki/ADDIE_Model.
[42]
Benjamin D. Cone, Cynthia E. Irvine, Michael F. Thompson, and Thuy D. Nguyen. 2007. A video game for cyber security training and awareness. Comput. Secur. 26, 1 (2007), 63--72.
[43]
Thomas M. Connolly, Elizabeth A. Boyle, Ewan MacArthur, Thomas Hainey, and James M. Boyle. 2012. A systematic literature review of empirical evidence on computer games and serious games. Comput. Edu. 59, 2 (2012), 661--686.
[44]
EMC Corporation. 2012. EMC and NCSA Offer Free Online Identity Risk Calculator. Retrieved from https://www.prnewswire.com/news-releases/emc-and-ncsa-offer-free-online-identity-risk-calculator-172449331.html.
[45]
Creative Conspiracy. 2012. Child Focus “E-safety.” Retrieved from https://www.youtube.com/watch?v=d5kW4pI_VQw.
[46]
Ian Cullinane, Catherine Huang, Thomas Sharkey, and Shamsi Moussavi. 2015. Cyber security education through gaming cybersecurity games can be interactive, fun, educational and engaging. J. Comput. Sci. Colleges 30, 6 (2015), 75--81.
[47]
Ciro D’Apice, Claudia Grieco, Luca Liscio, and Rossella Piscopo. 2015. Design of an educational adventure game to teach computer security in the working environment. In Proceedings of the 21st International Conference on Distributed Multimedia Systems (DMS’15). 179--185.
[48]
Tamara Denning, Batya Friedman, and Tadayoshi Kohno. 2017. The Security Cards: A Security Threat Brainstorming Toolkit. Retrieved from https://securitycards.cs.washington.edu.
[49]
Tamara Denning, Tadayoshi Kohno, and Adam Shostack. 2013. Control-Alt-Hack: A card game for computer security outreach and education. In Proceedings of the Technical Symposium on Computer Science Education. ACM, 729--729.
[50]
John Dewey. 1986. Experience and education. In The Educational Forum, Vol. 50. Taylor 8 Francis, 241--252.
[51]
Digizen.org. 2017. Digizen Game. Retrieved from https://www.digizen.org/resources/digizen-game.aspx.
[52]
Allison Druin, Benjamin B. Bederson, Juan Pablo Hourcade, Lisa Sherman, Glenda Revelle, Michele Platner, and Stacy Weng. 2001. Designing a digital library for young children. In Proceedings of the ACM/IEEE-CS Joint Conference on Digital Libraries. ACM, 398--405.
[53]
Serge Egelman, Julia Bernd, Gerald Friedland, and Dan Garcia. 2016. The teaching privacy curriculum. In Proceedings of the Technical Symposium on Computing Science Education. ACM, 591--596.
[54]
Serge Egelman and Eyal Peer. 2015. Predicting privacy and security attitudes. SIGCAS Comput. Soc. 45, 1 (2015), 22--28.
[55]
Hugo Enriquez, Youki Kadobayashi, and Doudou Fall. 2018. Project config.Play: A turn-based strategy security board game. In Proceedings of the European Conference on Game-Based Learning (ECGBL). Academic Conferences and Publishing Limited, 72.
[56]
Roya Ensafi, Mike Jacobi, and Jedidiah R. Crandall. 2012. Students who don’t understand information flow should be eaten: An experience paper. In Proceedings of the Conference on Cyber Security Experimentation and Test (CSET’12).
[57]
European Commission Joint Research Centre (JRC). 2018. Understanding GDPR: New game from the JRC. Retrieved from https://ec.europa.eu/jrc/en/news/understanding-gdpr-new-game-jrc.
[58]
Exosyphn Studios. [n.d.]. Hacker Evolution. Retrieved from http://www.exosyphen.com/page_hackerevolution.html.
[59]
Laura Faulkner. 2003. Beyond the five-user assumption: Benefits of increased sample sizes in usability testing. Behavior Res. Methods Instrum. Comput. 35, 3 (2003), 379--383.
[60]
Federal Bureau of Investigation (FBI). 2017. Safe Online Surfing (SOS) Internet Challenge. Retrieved from https://www.fbi.gov/news/stories/new-safe-online-surfing-internet-challenge.
[61]
Federal Trade Commission (FTC). 2006. OnGuard Online Games. Retrieved from https://www.consumer.ftc.gov/features/feature-0038-onguardonline.
[62]
Federal Trade Commission (FTC). 2017. OnGuard Online Videos. Retrieved from https://www.consumer.ftc.gov/features/feature-0038-onguardonline.
[63]
Chun Che Fung, Varin Khera, Arnold Depickere, Panjai Tantatsanawong, and Poonpong Boonbrahm. 2008. Raising information security awareness in digital ecosystem with games-a pilot study in Thailand. In Digital Ecosystems and Technologies. IEEE, 375--380.
[64]
Funmoods. 2011. Safemoods Adventures from Mood-Town. Retrieved from http://www.safemoods.com.
[65]
R. M. Gagne, W. W. Wager, K. C. Golas, J. M. Keller, and J. D. Russell. 2005. Principles of Instructional Design. Wiley Online Library.
[66]
Vaibhav Garg, L. Jean Camp, Katherine Connelly, and Lesa Lorenzen-Huber. 2012. Risk communication design: Video vs. text. In Proceedings of the Symposium on Privacy Enhancing Technologies. Springer, 279--298.
[67]
Mark Gondree and Zachary N. J. Peterson. 2013. Valuing security by getting [d0x3d!]. In Proceedings of the Workshop on Cyber Security Experimentation and Test.
[68]
Mark Gondree, Zachary N. J. Peterson, and Tamara Denning. 2013. Security through play. IEEE Secur. Privacy 3 (2013), 64--67.
[69]
Google. 2017. Interland—Be Internet Awesome. Retrieved from https://beinternetawesome.withgoogle.com/en/interland.
[70]
Google for Education. 2017. Digital Citizenship and Safety Course. Retrieved from https://teachercenter.withgoogle.com/digital_citizenship/course.
[71]
Rebecca E. Grinter, W. Keith Edwards, Mark W. Newman, and Nicolas Ducheneaut. 2005. The work to make a home network work. In Computer Supported Cooperative Work. Springer, 469--488.
[72]
Gronstedt Group. 2017. The “Cloud Defense” game. Retrieved from http://gronstedtgroup.com/project/intuit-cyber-security/.
[73]
John Hattie and Helen Timperley. 2007. The power of feedback. Rev. Edu. Res. 77, 1 (2007), 81--112.
[74]
HealthIT.gov. 2012. Cybersecure: Your Medical Practice. Retrieved from https://www.healthit.gov/sites/default/files/cybersecure/cybersecure.html.
[75]
Maurice Hendrix, Ali Al-Sherbaz, and Bloom Victoria. 2016. Game based cyber security training: Are serious games suitable for cyber security training? Int. J. Serious Games 3, 1 (2016), 53--61.
[76]
Cormac Herley. 2009. So long, and no thanks for the externalities: The rational rejection of security advice by users. In Proceedings of the Workshop on New Security Paradigms Workshop (NSPW’09). ACM, 133--144.
[77]
Christopher Herr and Dennis Allen. 2015. Video games as a training tool to prepare the next generation of cyber warriors. In Proceedings of the ACM SIGMIS Conference on Computers and People Research. ACM, 23--29.
[78]
Fabio Hofer, Felix Lenz, Johanna Pichlbauer, and Kati Shipilenko. 2018. King GAFA And The Magical 0-1 Crop—A fairytale about privacy. Retrieved from https://www.kinggafa.com.
[79]
iKeepSafe. 2016. Data Privacy in Education: An iKeepSafe Educator Training course. Retrieved from https://ikeepsafe.org/wp-content/uploads/2017/09/Data-Privacy-in-Education-Full-Curriculum-2017.pdf.
[80]
Indiana University of Pennsylvania. 2010. Internet Safety for Kids K-3. Retrieved from https://www.youtube.com/watch?v=89eCHtFs0XM.
[81]
MAVI Interactive LLC. 2012. Agent Surefire: Breach Buster. Retrieved from https://agentsurefire.com/breachbuster.
[82]
Introversion Software. [n.d.]. Uplink. Retrieved from http://www.introversion.co.uk/uplink/index.html.
[83]
C. Irvine, M. Thompson, and K. Allen. 2011. Active learning with the CyberCIEGE video game. In Proceedings of the Conference on Cyber Security Experimentation and Test (CSET’11). 10--10.
[84]
IS Decisions. 2015. The Weakest Link. Retrieved from https://www.isdecisions.com/user-security-awareness-game/.
[85]
Camp Jean. 2009. Mental models of privacy and security. IEEE Tech. Soc. 28, 3 (2009).
[86]
Camp Jean. 2012. Security Awareness 8 Risk Communication Videos. Retrieved from http://ljean.com/awareness/awareness.php.
[87]
Jonathan Jones, Xiaohong Yuan, Edward Carr, and Huiming Yu. 2010. A comparative study of CyberCIEGE game and Department of Defense Information Assurance Awareness video. In Proceedings of the IEEE Region 3’s Annual Conference (SoutheastCon’10). IEEE, 176--180.
[88]
Craig Jordan, Matt Knapp, Dan Mitchell, Mark Claypool, and Kathi Fisler. 2011. CounterMeasures: A game for teaching computer security. In Proceedings of the Conference on Network and Systems Support for Games (NetGames’11). IEEE, 1--6.
[89]
Jesper Juul. 2003. The game, the player, the world: Looking for a heart of gameness. In Proceedings of the Level Up: Digital Games Research Conference. Utrecht University, 30--45.
[90]
Fares Kayali, Günter Wallner, Simone Kriglstein, Gerhild Bauer, Daniel Martinek, Helmut Hlavacs, Peter Purgathofer, and Rebbeca Wölfle. 2014. A case study of a learning game about the Internet. In Proceedings of the International Conference on Serious Games. Springer, 47--58.
[91]
Patrick Gage Kelley, Joanna Bresee, Lorrie Faith Cranor, and Robert W. Reeder. 2009. A “nutrition label” for privacy. In Proceedings of the Symposium on Usable Privacy and Security (SOUPS). ACM, Article 4, 12 pages.
[92]
Patrick Gage Kelley, Lucian Cesca, Joanna Bresee, and Lorrie Faith Cranor. 2010. Standardizing privacy notices: An online study of the nutrition label approach. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI’10). ACM, New York, NY, 1573--1582.
[93]
Bart Knijnenburg and David Cherry. 2016. Comics as a medium for privacy notices. In Proceedings of the Symposium on Usable Privacy and Security (SOUPS’16). USENIX Association, Denver, CO. Retrieved from https://www.usenix.org/conference/soups2016/workshop-program/wfpn/presentation/knijnenburg.
[94]
KQED Education. 2017. How to Protect Your Online Privacy. Retrieved from https://ww2.kqed.org/education/2018/02/28/how-can-you-protect-your-privacy-online/.
[95]
Priya Kumar, Jessica Vitak, Marshini Chetty, Tamara L. Clegg, Jonathan Yang, Brenna McNally, and Elizabeth Bonsignore. 2018. Co-designing online privacy-related games and stories with children. In Proceedings of the Conference on Interaction Design and Children (IDC’18). ACM, 67--79.
[96]
Ponnurangam Kumaraguru, Yong Rhee, Steve Sheng, Sharique Hasan, Alessandro Acquisti, Lorrie Cranor, and Jason Hong. 2007. Getting users to pay attention to anti-phishing education: Evaluation of retention and transfer. In APWG eCrime Summit, Vol. 269. ACM, 70--81.
[97]
Ponnurangam Kumaraguru, Steve Sheng, Alessandro Acquisti, Lorrie Faith Cranor, and Jason Hong. 2010. Teaching Johnny not to fall for phish. ACM Trans. Internet Technol. 10, 2 (2010), 7.
[98]
W. A. Labuschagne, I. Burke, N. Veerasamy, and M. M. Eloff. 2011. Design of cyber security awareness game utilizing a social media framework. In Proceedings of the Conference on Information Security for South Africa. IEEE, 1--9.
[99]
Jonathan Lazar, Jinjuan Heidi Feng, and Harry Hochheiser. 2010. Research Methods in Human-computer Interaction. John Wiley 8 Sons.
[100]
Alexis Le Compte, David Elizondo, and Tim Watson. 2015. A renewed approach to serious games for cyber security. In Proceedings of the Conferecne on Cyber Conflict: Architectures in Cyberspace (CyCon’15). IEEE, 203--216.
[101]
Conor Linehan, Ben Kirman, Shaun Lawson, and Gail Chan. 2011. Practical, appropriate, empirically validated guidelines for designing educational games. In Proceedings of the Conference on Human Factors in Computing Systems (CHI’11). ACM, 1979--1988.
[102]
Living in Community. 2013. SAFE in Collingwood: SAFEyouth project and video series. Retrieved from http://safeincollingwood.ca/resources-for-youth/safe-youth/.
[103]
Dan Lockton, David Harrison, and Neville A. Stanton. 2010. The design with intent method: A design tool for influencing user behaviour. Appl. Ergonom. 41, 3 (2010), 382--392.
[104]
W. Victor Maconachy, Corey D. Schou, Daniel Ragsdale, and Don Welch. 2001. A model for information assurance: An integrated approach. In IEEE Workshop on Information Assurance and Security, Vol. 310. IEEE.
[105]
Mabroka Maeref and Fatma Algali. 2015. An empirical evaluation of Cryptool in teaching computer security. In Proceedings of the International Conference on Computer Science, Engineering and Applications. 93--100.
[106]
Sana Maqsood, Christine Mekhail, and Sonia Chiasson. 2018. A Day in the Life of Jos: A web-based game to increase children’s digital literacy. In Proceedings of the Conference on Interaction Design and Children (IDC’18). ACM, 241--252.
[107]
Richard E. Mayer. 2002. Multimedia learning. Psychol. Learn. Motivat. 41 (2002), 85--139.
[108]
Richard E. Mayer and Richard B. Anderson. 1992. The instructive animation: Helping students build connections between words and pictures in multimedia learning. J. Edu. Psychol. 84, 4 (1992), 444.
[109]
Richard E. Mayer, Gayle T. Dow, and Sarah Mayer. 2003. Multimedia learning in an interactive self-explaining environment: What works in the design of agent-based microworlds? J. Edu. Psychol. 95, 4 (2003), 806.
[110]
Richard E. Mayer and Roxana Moreno. 2002. Animation as an aid to multimedia learning. Edu. Psychol. Rev. 14, 1 (2002), 87--99.
[111]
McAfee. 2017. World Password Day Game. Retrieved from https://game.truekey.com/EN/.
[112]
Scott W. Mcquiggan, Jonathan P. Rowe, Sunyoung Lee, and James C. Lester. 2008. Story-based learning: The impact of narrative on learning experiences and outcomes. In Proceedings of the Conference on Intelligent Tutoring Systems. Springer, 530--539.
[113]
MediaSmarts. 2000. Jo Cool or Jo Fool. Retrieved from http://mediasmarts.ca/game/jo-cool-or-jo-fool-grades-6-8.
[114]
MediaSmarts. 2005. Allies and Aliens: A Mission in Critical Thinking. Retrieved from http://mediasmarts.ca/game/allies-and-aliens-mission-critical-thinking.
[115]
MediaSmarts. 2005. Privacy Playground: The First Adventure of the Three CyberPigs. Retrieved from http://mediasmarts.ca/game/privacy-playground-first-adventure-three-cyberpigs.
[116]
MediaSmarts. 2005. Top Secret!Retrieved from http://mediasmarts.ca/game/top-secret-grades-6-8.
[117]
MediaSmarts. 2011. Privacy Pirates: An interactive unit on online privacy. Retrieved from http://mediasmarts.ca/game/privacy-pirates-interactive-unit-online-privacy-ages-7-9.
[118]
MediaSmarts. 2013. Co-Co’s AdverSmarts: An interactive unit on food marketing on the web. Retrieved from http://mediasmarts.ca/game/co-cos-adversmarts-interactive-unit-food-marketing-web.
[119]
MediaSmarts. 2015. How Cyber-Savvy Are You? Retrieved from http://mediasmarts.ca/sites/mediasmarts/files/games/cyber-security-quiz/index_en.html.
[120]
MediaSmarts. 2016. Click If You Agree. Retrieved from http://mediasmarts.ca/digital-media-literacy/educational-games/click-if-you-agree-grades-7-9.
[121]
MediaSmarts. 2018. Data Defenders. Retrieved from http://mediasmarts.ca/sites/mediasmarts/files/games/data-defenders/.
[122]
Christine Mekhail, Leah Zhang-Kennedy, and Sonia Chiasson. 2014. Visualizations to teach about mobile online privacy. In Persuasive Technology. 43--47.
[123]
M. David Merrill, Leston Drake, Mark J. Lacy, and Jean Pratt. 1996. Reclaiming instructional design. Edu. Technol. 36, 5 (1996), 5--7.
[124]
Miriam J. Metzger and Andrew J. Flanagin. 2008. Digital Media, Youth, and Credibility. MIT Press.
[125]
Microsoft Cyber Defense Operations Center. 2017. Tips for securing your identity against cybersecurity threats. Retrieved from https://www.youtube.com/watch?v=BeX-imdxlxk.
[126]
Thomas Monk, Johan Van Niekerk, and Rossouw von Solms. 2010. Sweetening the medicine: Educating users about information security by means of game play. In Proceedings of the Conference of the South African Institute of Computer Scientists and Information Technologists. ACM, 193--200.
[127]
John R. Morelock and Zachary Peterson. 2018. Authenticity, ethicality, and motivation: A formal evaluation of a 10-week computer security alternate reality game for CS undergraduates. In Proceedings of the Workshop on Advances in Security Education (ASE’18). USENIX Association.
[128]
Roxana Moreno and Richard E. Mayer. 1999. Cognitive principles of multimedia learning: The role of modality and contiguity. J. Edu. Psychol. 91, 2 (1999), 358.
[129]
Ajay Nagarajan, Jan M. Allbeck, Arun Sood, and Terry L. Janssen. 2012. Exploring game design for cybersecurity training. In Proceedings of the Cyber Technology in Automation, Control, and Intelligent Systems (CYBER’12). IEEE, 256--262.
[130]
National Crime Agency of the United Kingdom. 2019. Jessie 8 Friends. Retrieved from https://www.thinkuknow.co.uk/parents/jessie-and-friends/.
[131]
Øyvind Nerbråten and Lillian Røstad. 2009. HACMEgame: A tool for teaching software security. In Availability, Reliability and Security (ARES’09). IEEE, 811--816.
[132]
NetSafe Utah. 2011. NetSafe Utah Project. Retrieved from http://www.netsafeutah.org.
[133]
NetSmartz. 2005. NetSmartz Videos. Retrieved from https://www.missingkids.org/netsmartz/videos.
[134]
NetSmartz. 2006. NSTeens Videos. Retrieved from https://www.nsteens.org/Videos.
[135]
NetSmartz. 2012. NSTeens Games. Retrieved from https://www.nsteens.org/Games.
[136]
NetSmartz. 2014. NSTeens Comics. Retrieved from https://www.nsteens.org/Comics.
[137]
Netzbewegung. 2009. Wild Web Woods. Retrieved from http://www.wildwebwoods.org.
[138]
Jakob Nielsen. 1994. Usability Engineering. Elsevier.
[139]
Office of the eSafety Commissioner. 2003. Hector’s World. Retrieved from http://www.hectorsworld.com.
[140]
Office of the eSafety Commissioner. 2014. Be Deadly Online. Retrieved from https://www.esafety.gov.au/education-resources/classroom-resources/be-deadly-online.
[141]
Office of the eSafety Commissioner. 2014. #GAMEON. Retrieved from https://www.esafety.gov.au/education-resources/classroom-resources/gameon.
[142]
Office of the eSafety Commissioner. 2016. Comic Book Capers. Retrieved from https://www.esafety.gov.au/comic-book-capers.
[143]
Office of the eSafety Commissioner. 2016. Cybersmart Challenge. Retrieved from https://www.esafety.gov.au/education-resources/classroom-resources/challenge.
[144]
Office of the eSafety Commissioner. 2016. How Cybersmart Are You? Retrieved from https://www.esafety.gov.au/kids-quiz.
[145]
Office of the eSafety Commissioner. 2018. Act eSafe. Retrieved from https://www.esafety.gov.au/education-resources/classroom-resources/act-esafe.
[146]
Office of the eSafety Commissioner. 2018. The Lost Summer. Retrieved from https://www.esafety.gov.au/education-resources/classroom-resources/lost-summer.
[147]
Office of the Privacy Commissioner of Canada. 2012. Social Smarts: Privacy, the Internet and you. Retrieved from https://www.priv.gc.ca/en/about-the-opc/what-we-do/awareness-campaigns-and-events/privacy-education-for-kids/social-smarts-privacy-the-internet-and-you.
[148]
Office of the Privacy Commissioner of Canada. 2012. What can YOU do to protect your online rep? Retrieved from https://www.priv.gc.ca/en/about-the-opc/what-we-do/awareness-campaigns-and-events/privacy-education-for-kids/t-v/videos/rep/.
[149]
Marc Olano, Alan Sherman, Linda Oliva, Ryan Cox, Deborah Firestone, Oliver Kubik, Milind Patil, John Seymour, Isaac Sohn, and Donna Thomas. 2014. SecurityEmpire: Development and evaluation of a digital game to promote cybersecurity education. In Proceedings of the USENIX Summit on Gaming, Games, and Gamification in Security Education (3GSE’14). USENIX Association.
[150]
Open Web Application Security Project. 2014. OWASP Security Shepherd. Retrieved from https://www.owasp.org/index.php/OWASP_Security_Shepherd.
[151]
OWASP. 2019. Cornucopia. Retrieved from https://www.owasp.org/index.php/OWASP_Cornucopia.
[152]
Parliamentary Digital Service. 2017. Cyber Security Awareness Campaign. Retrieved from https://www.youtube.com/watch?v=G8Uji_wwU7o.
[153]
Vicente Pastor, Gabriel Díaz, and Manuel Castro. 2010. State-of-the-art simulation systems for information security education, training and awareness. In Proceedings of the Education Engineering Conference (EDUCON’10). IEEE, 1907--1916.
[154]
PBS Learning Media. 2014. NOVA Cybersecurity Lab Game. Retrieved from https://www.pbslearningmedia.org/resource/nvcy-sci-cyberlab/nova-cybersecurity-lab.
[155]
PBS Learning Media. 2014. NOVA Cybersecurity Lab Videos. Retrieved from http://www.pbs.org/wgbh/nova/labs/videos.
[156]
J. W. Pellegrino, J. D. Bransford, and M. S. Donovan. 1999. How People Learn: Bridging Research and Practice. National Academies Press.
[157]
Jean Piaget. 1957. Logic and Psychology. Basic books, Oxford, England.
[158]
Jean Piaget. 2002. Judgement and Reasoning in the Child. Routledge.
[159]
Playgen. 2010. Data Security. Retrieved from http://playgen.com/play/data-security/.
[160]
Jenny Preece, Helen Sharp, and Yvonne Rogers. 2015. Interaction Design: Beyond Human-Computer Interaction. John Wiley 8 Sons.
[161]
Ashwini K. Rao and Albert Einstein. 2006. Cognition and motor skills. In Hand Function in the Child: Foundations for Remediation. Elsevier, 101--113.
[162]
Kate Raynes-Goldie and Matthew Allen. 2014. Gaming privacy: A Canadian case study of a co-created privacy literacy game for children. Surveil. Soc. 12, 3 (2014), 414.
[163]
Janet C. Read and Stuart MacFarlane. 2006. Using the fun toolkit and other survey methods to gather opinions in child computer interaction. In Proceedings of the Conference on Interaction Design and Children (IDC’06). ACM, 81--88.
[164]
Andreas Rieb and Ulrike Lechner. 2016. Operation Digital Chameleon: Towards an open cybersecurity method. In Proceedings of the International Symposium on Open Collaboration. ACM, 7.
[165]
B. Rittle-Johnson and M. W. Alibali. 1999. Conceptual and procedural knowledge of mathematics: Does one lead to the other? J. Edu. Psychol. 91, 1 (1999), 175.
[166]
Tiphaine Romand-Latapie. 2016. The NeoSens training method: Computer security awareness for a neophyte audience. In Proceedings of the Black Hat USA Conference.
[167]
Royal Bank of Canada. 2017. RBC Be Cyber Smart. Retrieved from https://www.rbc.com/privacysecurity/ca/cyber-security-awareness.html.
[168]
Jorge G. Ruiz, Michael J. Mintzer, and Rosanne M. Leipzig. 2006. The impact of e-learning in medical education. Academic Med. 81, 3 (2006), 207--212.
[169]
Jungwoo Ryoo, Angsana Techatassanasoontorn, Dongwon Lee, and Jeremy Lothian. 2011. Game-based infoSec education using OpenSim. In Proceedings of the Colloquium for Information Systems Security Education. 101--106.
[170]
Richard A. Schmidt and Robert A. Bjork. 1992. New conceptualizations of practice: Common principles in three paradigms suggest new concepts for training. Psychol. Sci. 3, 4 (1992), 207--218.
[171]
Dino Schweitzer, Leemon Baird, Michael Collins, Wayne Brown, and Michael Sherman. 2006. GRASP: A visualization tool for teaching security protocols. In Proceedings of the Colloquium for Information Systems Security Education.
[172]
Dino Schweitzer and Wayne Brown. 2009. Using visualization to teach security. J. Comput. Sci. Colleges 24, 5 (2009), 143--150.
[173]
Sibylle Sehl and Kami Vaniea. 2018. Permission impossible: Teaching firewall configuration in a game environment. In Proceedings of the European Workshop on Usable Security.
[174]
Martin Seligman. 2012. Flourish: A Visionary New Understanding of Happiness and Well-being. Simon and Schuster.
[175]
Steve Sheng, Bryant Magnien, Ponnurangam Kumaraguru, Alessandro Acquisti, Lorrie Faith Cranor, Jason Hong, and Elizabeth Nunge. 2007. Anti-Phishing Phil: The design and evaluation of a game that teaches people not to fall for phish. In Proceedings of the 3rd Symposium on Usable Privacy and Security (SOUPS’07). ACM, 88--99.
[176]
Adam Shostack. 2014. Elevation of privilege: Drawing developers into threat modeling. In Proceedings of the USENIX Summit on Gaming, Games, and Gamification in Security Education (3GSE’14). USENIX Association.
[177]
Adam Shostack. 2018. Security Games 8 Resources. Retrieved from https://adam.shostack.org/games.html.
[178]
Six to Start. 2010. Smokescreen. Retrieved from http://www.sixtostart.com/smokescreen/.
[179]
Daniel J. Solove. [n.d.]. Teach Privacy. Retrieved from https://teachprivacy.com.
[180]
Sponge UK. 2015. Lock Down: Information Security Game. Retrieved from http://spongeukweb.azurewebsites.net/storyline2/.
[181]
Sukamol Srikwan and Markus Jakobsson. 2008. Using cartoons to teach internet security. Cryptologia 32, 2 (2008), 137--154.
[182]
StaySafeOnline. 2016. Lock Down Your Login Campaign: How to Keep Your Logins Safe. Retrieved from https://www.youtube.com/watch?v=ZX0wQQo8Zb4.
[183]
Madiha Tabassum, Abdulmajeed Alqhatani, Marran Aldossari, and Heather Richter Lipford. 2018. Increasing user attention with a comic-based policy. In Proceedings of the Conference on Human Factors in Computing Systems (CHI’18). ACM, 200.
[184]
Texas A8M University. 2009. Cybersecurity Games. Retrieved from https://it.tamu.edu/security/cybersecurity-games/index.php.
[185]
The European Commission’s science and knowledge service (JRC). 2018. Cyber Chronix. Retrieved from https://ec.europa.eu/jrc/en/news/understanding-gdpr-new-game-jrc.
[186]
The Open University. 2012. Privacy Game. Retrieved from http://www2.open.ac.uk/openlearn/privacy/game/.
[187]
The Open University. 2012. Sharing safely: A public information film from the Ministry of Sharing. Retrieved from http://www2.open.ac.uk/openlearn/ministry-of-sharing/.
[188]
The University of Adelaide. 2016. Security Awareness Games. Retrieved from https://www.adelaide.edu.au/technology/secure-it/cybersecurity-training.
[189]
ThinkUKnow. 2015. Cyber Café. Retrieved from https://www.thinkuknow.co.uk/8_10/cybercafe/cyber-cafe-base/.
[190]
Michael Thompson and Cynthia Irvine. 2011. Active learning with the CyberCIEGE video game. In Proceedings of the Conference on Cyber Security Experimentation and Test (CSET'11). 1--10.
[191]
Tralalere. 2000. 2025 Exmachina. Retrieved from http://www.2025exmachina.net.
[192]
Trend Micro. 2015. Targeted Attacks: The Game. Retrieved from http://targetedattacks.trendmicro.com/cyoa/en/.
[193]
Trend Micro. 2017. Data Center Attacks. Retrieved from http://datacenterattacks.trendmicro.com.
[194]
Harshal Tupsamudre, Rahul Wasnik, Shubhankar Biswas, Sankalp Pandit, Sukanya Vaddepalli, Aishwarya Shinde, CJ Gokul, Vijayanand Banahatti, and Sachin Lodha. 2018. GAP: A game for improving awareness about passwords. In Proceedings of the Joint International Conference on Serious Games. Springer, 66--78.
[195]
Barbara Tversky, Julie Bauer Morrison, and Mireille Betrancourt. 2002. Animation: Can it facilitate? Int. J. Hum.-Comput. Studies 57, 4 (2002), 247--262.
[196]
Ubisoft. [n.d.]. Watch Dogs. Retrieved from https://www.ubisoft.com/en-us/game/watch-dogs/.
[197]
Robert A. Virzi. 1992. Refining the test phase of usability evaluation: How many subjects is enough? Hum. Fact. 34, 4 (1992), 457--468.
[198]
Chad Walker. [n.d.]. Cryptomancer RPG. Retrieved from http://cryptorpg.com.
[199]
Rick Wash. 2010. Folk models of home computer security. In Proceedings of the Symposium on Usable Privacy and Security (SOUPS’10). ACM.
[200]
Rick Wash and Emilee Rader. 2015. Too much knowledge? Security beliefs and protective behaviors among united states Internet users. In Proceedings of the Symposium on Usable Privacy and Security (SOUPS’15). 309--325.
[201]
Webwise. 2015. Webwise Ireland. Retrieved from https://www.webwise.ie/category/videos/classroom-videos/.
[202]
Charles Weir. 2017. Using Games to Learn about Secure Development. Retrieved from https://www.securedevelopment.org/2017/10/12/games-to-help-learn-about-secure-development.
[203]
Zikai Alex Wen, Yiming Li, Reid Wade, Jeffrey Huang, and Amy Wang. 2017. What.Hack: Learn phishing email defence the fun way. In Proceedings of the CHI Conference Extended Abstracts on Human Factors in Computing Systems. ACM, 234--237.
[204]
Alma Whitten and J. Doug Tygar. 1999. Why Johnny can’t encrypt: A usability evaluation of PGP 5.0. In Proceedings of the USENIX Security Symposium, Vol. 348. 169--184.
[205]
Laurie Williams, Andrew Meneely, and Grant Shipley. 2010. Protection Poker: The new software security game. IEEE Secur. Privacy 8, 3 (2010), 14--20.
[206]
John Woollard, Cathy Wickens, Ken Powell, and Terry Russell. 2009. Evaluation of e-safety materials for initial teacher training: Can “Jenny’s Story” make a difference? Technol. Pedagogy Edu. 18, 2 (2009), 187--200.
[207]
Gene Yang. 2016. Comics in Education. Retrieved from http://www.humblecomics.com/comicsedu/index.html.
[208]
Justin Yang, Oana-Georgiana Niculaescu, and Gabriel Ghinita. 2017. A game-oriented educational tool for location privacy topics. In Proceedings of the SIGSPATIAL International Conference on Advances in Geographic Information Systems. ACM, 93.
[209]
Leah Zhang-Kennedy, Yomna Abdelaziz, and Sonia Chiasson. 2017. Cyberheroes: The design and evaluation of an interactive ebook to educate children about online privacy. Int. J. Child-Comput. Interact. (IJCCI’17) 13 (2017), 10--18.
[210]
Leah Zhang-Kennedy, Khadija Baig, and Sonia Chiasson. 2017. Engaging children about online privacy through storytelling in an interactive comic. In Proceedings of the British Computer Society Human Computer Interaction Conference (British HCI’17). BCS Learning 8 Development Ltd., 45.
[211]
Leah Zhang-Kennedy, Sonia Chiasson, and Robert Biddle. 2013. Password advice shouldn’t be boring: Visualizing password guessing attacks. In Proceedings of the APWG eCrime Summit. IEEE, 1--11.
[212]
Leah Zhang-Kennedy, Sonia Chiasson, and Robert Biddle. 2014. Stop clicking on “update later”: Persuading users they need up-to-date antivirus protection. In Persuasive Technology. Springer LNCS, 302--322.
[213]
Leah Zhang-Kennedy, Sonia Chiasson, and Robert Biddle. 2016. The role of instructional design in persuasion: A comics approach for improving cybersecurity. Int. J. Hum.-Comput. Interact. 32, 3 (2016), 215--257.
[214]
Leah Zhang-Kennedy, Elias Fares, Sonia Chiasson, and Robert Biddle. 2016. Geo-Phisher: The design and evaluation of information visualizations about internet phishing trends. In Proceedings of the APWG eCrime Summit. IEEE, 1--12.

Cited By

View all
  • (2025)Co-designing cybersecurity-related stories with children: Perceptions on cybersecurity risks and parental involvementEntertainment Computing10.1016/j.entcom.2024.10075352(100753)Online publication date: Jan-2025
  • (2024)Strategies to Combat CyberattacksRisk Assessment and Countermeasures for Cybersecurity10.4018/979-8-3693-2691-6.ch003(39-61)Online publication date: 31-May-2024
  • (2024)Empowering Students for Cybersecurity Awareness Management in the Emerging Digital Era: The Role of Cybersecurity Attitude in the 4.0 Industrial Revolution EraSage Open10.1177/2158244024122892014:1Online publication date: 16-Feb-2024
  • Show More Cited By

Index Terms

  1. A Systematic Review of Multimedia Tools for Cybersecurity Awareness and Education

      Recommendations

      Comments

      Please enable JavaScript to view thecomments powered by Disqus.

      Information & Contributors

      Information

      Published In

      cover image ACM Computing Surveys
      ACM Computing Surveys  Volume 54, Issue 1
      January 2022
      844 pages
      ISSN:0360-0300
      EISSN:1557-7341
      DOI:10.1145/3446641
      Issue’s Table of Contents
      Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      Published: 02 January 2021
      Accepted: 01 September 2020
      Revised: 01 July 2020
      Received: 01 March 2020
      Published in CSUR Volume 54, Issue 1

      Permissions

      Request permissions for this article.

      Check for updates

      Author Tags

      1. Cybersecurity educational tools
      2. cybersecurity awareness and education

      Qualifiers

      • Research-article
      • Research
      • Refereed

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • Downloads (Last 12 months)480
      • Downloads (Last 6 weeks)86
      Reflects downloads up to 01 Jan 2025

      Other Metrics

      Citations

      Cited By

      View all
      • (2025)Co-designing cybersecurity-related stories with children: Perceptions on cybersecurity risks and parental involvementEntertainment Computing10.1016/j.entcom.2024.10075352(100753)Online publication date: Jan-2025
      • (2024)Strategies to Combat CyberattacksRisk Assessment and Countermeasures for Cybersecurity10.4018/979-8-3693-2691-6.ch003(39-61)Online publication date: 31-May-2024
      • (2024)Empowering Students for Cybersecurity Awareness Management in the Emerging Digital Era: The Role of Cybersecurity Attitude in the 4.0 Industrial Revolution EraSage Open10.1177/2158244024122892014:1Online publication date: 16-Feb-2024
      • (2024)Exploring Determinants of Parental Engagement in Online Privacy Protection: A Qualitative ApproachProceedings of the 2024 European Symposium on Usable Security10.1145/3688459.3688476(94-111)Online publication date: 30-Sep-2024
      • (2024)Manipulating Recommender Systems: A Survey of Poisoning Attacks and CountermeasuresACM Computing Surveys10.1145/367732857:1(1-39)Online publication date: 7-Oct-2024
      • (2024)Evaluating the Use of Hypothetical 'Would You Rather' Scenarios to Discuss Privacy and Security Concepts with ChildrenProceedings of the ACM on Human-Computer Interaction10.1145/36410048:CSCW1(1-32)Online publication date: 26-Apr-2024
      • (2024)Self-Efficacy and Security Behavior: Results from a Systematic Review of Research MethodsProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642432(1-32)Online publication date: 11-May-2024
      • (2024)Towards Understanding Family Privacy and Security Literacy Conversations at Home: Design Implications for Privacy Literacy InterfacesProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3641962(1-12)Online publication date: 11-May-2024
      • (2024)The Effects of Group Discussion and Role-playing Training on Self-efficacy, Support-seeking, and Reporting Phishing Emails: Evidence from a Mixed-design ExperimentProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3641943(1-21)Online publication date: 11-May-2024
      • (2024)Personal Cybersecurity Tracker2024 15th Annual Undergraduate Research Conference on Applied Computing (URC)10.1109/URC62276.2024.10604561(1-6)Online publication date: 24-Apr-2024
      • Show More Cited By

      View Options

      Login options

      Full Access

      View options

      PDF

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      HTML Format

      View this article in HTML Format.

      HTML Format

      Media

      Figures

      Other

      Tables

      Share

      Share

      Share this Publication link

      Share on social media