Control-Alt-Hack: the design and evaluation of a card game for computer security awareness and education

ABSTRACT

We scoped, designed, produced, and evaluated the effectiveness of a recreational tabletop card game created to raise awareness of and alter perceptions regarding-computer security. We discuss our process, the challenges that arose, and the decisions we made to address those challenges. As of May 2013, we have shipped approximately 800 free copies to 150 educators. We analyze and report on feedback from 22 of these educators about their experiences using Control-Alt-Hack with over 450 students in classroom and non-classroom contexts. The responses from the 14 educators who reported on their use of the game in a classroom context variously indicated that: their students' awareness of computer security as a complex and interesting field was increased (11/14); they would use the game again in their classroom (10/14); and they would recommend the game to others (13/14). Of note, 2 of the 14 classroom educators reported that they would not have otherwise covered the material. Additionally, we present results from user studies with 11 individuals and find that their responses indicate that 8 of the 11 had an increased awareness of computer security or a changed perception; furthermore, all of our intended goals are touched upon in their responses.

References

1. E. Andersen. Optimizing Adaptivity in Educational Games. Foundations of Digital Games, 2012.
2. B. Brinkman. The Heart of a Whistle-blower: A Corporate Decision-Making Game for Computer Ethics Classes. SIGCSE Technical Symposium, 2009.
3. Center for Game Science. Refraction. http://centerforgamescience.org/portfolio/refraction/.
4. The Center for Information Systems Security Studies and Research, Naval Postgraduate School. CyberCIEGE. http://cisr.nps.edu/cyberciege/.
5. Core Impact. Exploit! http://www.coresecurity.com.
6. DEF CON. DEF CON Capture the Flag. https://www.defcon.org/html/links/dc-ctf.html.
7. T. Denning, C. Matuszek, K. Koscher, J. R. Smith, and T. Kohno. A Spotlight on Security and Privacy Risks with Future Household Robots: Attacks and Lessons. Ubicomp, 2009.
8. {d0x3d!}. http://www.d0x3d.com.
9. S. Drimer and S. J. Murdoch. Keep Your Enemies Close: Distance Bounding Against Smartcard Relay Attacks. USENIX Security, 2007.
10. A. J. Feldman, J. A. Halderman, and E. W. Felten. Security Analysis of the Diebold AccuVote-TS Voting Machine. Electronic Voting Technology Workshop, 2007.
11. M. Gondree, Z. N.J. Peterson, and T. Denning. Security through Play. IEEE Security & Privacy, 11(3), 2013.
12. G. Gu, J. Zhang, and W. Lee. BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic. Network and Distributed System Security Symposium (NDSS), 2008.
13. M. Hicks, M. Finnicum, S.T. King, M. Martin, J.M. Smith. Overcoming an Untrusted Computing Base: Detecting and Removing Malicious Hardware Automatically. IEEE Symposium on Security and Privacy, 2010.
14. E. Klopfer, S. Osterweil, and K. Salen, Moving Learning Games Forward: Obstacles, Opportunities, and Openness. The Education Arcade, 2009.
15. K. Koscher, A. Czeskis, F. Roesner, S. Patel, T. Kohno, S. Checkoway, D. McCoy, B. Kantor, D. Anderson, H. Shacham, and S. Savage. Experimental Security Analysis of a Modern Automobile. IEEE Symposium on Security and Privacy, 2010.
16. C. Li, A. Raghunathan, N.K. Jha. Hijacking an Insulin Pump: Security Attacks and Defenses for a Diabetes Therapy System. Healthcom, 2011.
17. P. Mateti. A Laboratory-Based Course on Internet Security. SIGCSE Technical Symposium, 2009.
18. Microsoft. Elevation of Privilege. http://www.microsoft.com/security/sdl/adopt/eop.aspx.
19. National Collegiate Cyber Defense Competition. http://www.nationalccdc.org/.
20. OWASP. OWASP Cornucopia Ecommerce Website Edition. https://www.owasp.org/index.php/OWASP_Cornucopia.
21. PlaidCTF. http://play.plaidctf.com.
22. A. Rabkin. Personal Knowledge Questions for Fallback Authentication: Security Questions in the Era of Facebook. Symposium On Usable Privacy and Security (SOUPS), 2008.
23. F. Roesner, T. Kohno, and D. Wetherall. Detecting and Defending Against Third-Party Tracking on the Web. USENIX Symposium on Networked Systems Design and Implementation (NDSI), 2012.
24. K. Seaborn, M. S. El-Nasr, D. Milam, and D. Yung. Programming, PWNed: Using Digital Game Development to Enhance Learners' Competency and Self-Efficacy in a High School Computing Science Course. SIGCSE Technical Symposium, 2012.
25. S. Sheng, B. Magnien, P. Kumaraguru, A. Acquisti, L.F. Cranor, J.Hong, and E. Nunge. Anti-Phishing Phil: The Design and Evaluation of a Game That Teaches People Not to Fall for Phish. Symposium on Usable Privacy and Security (SOUPS), 2007.
26. B. Shimanovsky, J. Feng, and M. Potkonjak. Hiding Data in DNA. Information Hiding, 2002.
27. A. Shostack. Elevation of Privilege: Drawing Developers into Threat Modeling. Microsoft Technical Paper, 2012.
28. Steve Jackson Games. http://www.sjgames.com.
29. L. Sweeney. Weaving Technology and Policy Together to Maintain Confidentiality. Journal of Law, Medicine & Ethics, 25(2--3), 1997.
30. US Department of Defense. CyberProtect. http://iase.disa.mil/eta/cyber-protect/launchpage.htm.
31. WeWantToKnow. DragonBox. http://www.dragonboxapp.com/.
32. G. White and G. Nordstrom. Security Across the Curriculum: Using Computer Security to Teach Computer Science Principles. National Information Systems Security Conference, 1996.
33. L. Williams, A. Meneely, and G. Shipley. Protection Poker: The New Software Security 'Game.' IEEE Security & Privacy, 8(3), 2010.
34. E. Wustrow, S. Wolchok, I. Goldberg, and J. A. Halderman Telex: Anticensorship in the Network Infrastructure. USENIX Security, 2011.

Index Terms

• Social and professional topics

  • Professional topics

    • Computing education

      • Computing education programs

        • Computer science education

        • Information science education