Enhancing Information Security Awareness Programs Through Collaborative Learning

This paper presents a design science study aimed at improving the efficiency of information security awareness (ISA) training in higher education, targeting teachers and students. Motivated by the rise of human-targeted attacks such as phishing, the authors argue that existing awareness training is often ineffective and that gamification can boost engagement and motivation. The work proposes two artefacts: an interactive online book built on Moodle and H5P with quizzes, crosswords, videos, and word-completion games covering six categories (backup, remote access, data security, password management, social engineering, and software attacks), and a printed multiplayer board game in which players answer graded cybersecurity questions, draw personality and hacker cards, and challenge each other to duels.

The methodology follows Johannesson and Perjons' five-step design science framework: explicating the problem, defining requirements, designing and developing artefacts, demonstrating them, and evaluating them. Requirements were derived from a literature review and domain constraints, with brainstorming used for ideation. The book was evaluated through a prototype demonstration to project team members, while the board game was refined through dozens of playtest iterations. The paper also reviews related gamified security training studies, including work by Gjertsen et al. (2017), Scrimgeour and Ophoff (2019), Rieff (2018), and Silic and Lowry (2020), and draws on Nonaka's SECI knowledge-creation model to structure the transformation of information into learnable knowledge.

The only empirical result reported is a small two-group comparison: one group read a textbook, while the other used the interactive book and played the board game, with knowledge measured by quizzes before and after. The game group showed better retention, though the authors explicitly acknowledge that a broader sample is needed. Stated limitations include a narrow focus on university users without technical backgrounds, the lack of real-world deployment, and limited verification of generalizability. Future work proposes scenario-based storytelling, virtual and 3D technologies, and the incorporation of educational learning-theory frameworks.