How to Educate an Organization in Working with Security Topics from a User Experience Perspective

Sammanfattning: In today's rapidly evolving society, the pervasive influence of technology has profoundly transformed various aspects of human life, presenting both unprecedented opportunities and critical security challenges. To mitigate the risks of data breaches, malicious attacks, and overall cyber threats, companies have taken proactive measures by providing education and training to their employees in the areas of cyber security and software security. However, these kind of educations are often considered unmotivating and are often skipped trough as quickly as possible, which is troubling since security is of great importance. This master's thesis has therefore investigated how to educate an organization in working with security topics from a user experience perspective, to examine whether user centered design can aid in learning. Through the implementation of user research, which included a knowledge test, and the performance of a threat analysis, three specific security areas were identified. From the derived security areas an educational computer game was implemented, where each level focused on a security threat, keeping user experience and usability in mind when creating tasks. By having two groups with ten participants in each, we let one group complete a traditional PowerPoint security education and one group play the game. Both groups took a knowledge test, consisting of various questions about security, immediately after completing the education as well as two weeks afterwards. This resulted in better results for the group who played the game. The final conclusion was not only that experience based on usability and gamification do aid in learning, but also that deeper learning concerning security also benefits from learning with the use of a digital, interactive tool compared to traditional learning.