Promoting Secure and Sustainable Behavior in Digital Ecosystems Through Gamification

Introduction

Evolving malicious cyber activities and increasing cyber risks to individuals, organizations, and governments have made cybersecurity a significant challenge and core part of societal, political, and economic decisions (Anderson et al., 2019; Geer et al., 2020). The Global Risks Report 2021, published by the World Economic Forum, has categorized cybersecurity failures as clear and present dangers (McLennan, 2021). This category reveals concern about lives and livelihoods – among them infectious diseases, employment crises, digital inequality, and youth disillusionment. Moreover, the increasing value of tangible and intangible assets in cyber-physical systems is becoming more attractive to those who wish to penetrate systems for financial gains, psychological and reputational gains, or to cause instability. Therefore, ensuring cybersecurity through greater awareness, strong multi-stakeholder partnerships, and deep structural changes in key areas of institutional activities are crucial for having secure, sustainable hyper-connected societies that rely on digital infrastructure (Assembly, 2017).

The solution to many cybersecurity problems is to build and develop strong cybersecurity policies that enable the organizations to extend protection against cyber-attacks, and strategies that enable timely detection of risks, threats, and breaches, and allow the organizations to tackle them. Cybersecurity policies and strategies need to be sustainable, measurable, and offer actionable insights. In addition to security, therefore, this work focuses on a hard-to-quantify but vital concept known as sustainability.

Galaitsi et al. define sustainability as the ability to maintain a high level of functionality without inputs from external resources (Galaitsi et al., 2021).¹ This definition can be extended through interconnected domains, including society, technology, and economics. Secure, sustainable cybersecurity behavior in the presence of rapid-paced socio-technical changes in today's world compel the organizations and governments to deal with cyber threats potentially affecting them, to prioritize the defense of their digital and physical assets, decide what security measures should be implemented, and what operations need to be integrated into their daily routines.

Both of these concepts, security and sustainability, focus on both ordinary, repetitive threats and those that are extreme and rare. Therefore, consideration of security and sustainability goals together, reflection on current behavior, and engagement in more secure operations that lead to the formation of sustainable behaviors are the challenges that this work tackles. To tackle these challenges, the authors designed and developed a strategic simulation, also known as policy simulation or policy exercise. Strategic simulations are interactive, participatory methods to develop strategic insight that builds on selected representations of real-world structures and processes (Duke & Geurts, 2004). This approach allows individuals to explore real policy issues, using design elements known from serious games to structure communication (Geurts et al., 2007), as well as to include feedback that participants receive based on their decisions.

The current state of the art of gamification studies shows that integrated concepts of security and sustainability are not at the forefront of the design and execution of games initiatives, despite some awareness of security and privacy implications and developing skills. However, the uptake in the field of gamification in cybersecurity dictates a necessary shift from implementing a limited set of security measures to a more mature and holistic conception of security and sustainability as integral parts of digital ecosystems, starting at the very first stages of design. In many current reports on sustainable cybersecurity, these factors are only discussed in a limited fashion. (Sadik et al., 2020; Shackelford et al., 2016; Vasiu & Vasiu, 2018). This chapter does not aim to suggest that these initiatives are necessarily insufficient in this respect, but in general, it appears that the focus on the aspects related to security and sustainability is relatively peripheral.