Case Study

Metaverse - Cybersecurity Educational Escape Room

Overview

I was asked to develop a project accordingly to the below statement and to apply the Design Thinking model.

Project statement

You approached by S.K. Ape, the CEO of a fictional company who wants you to work as a team and design a Security Awareness Escape Room for his employees which will be part of the formal security awareness training for all workers when they join the company and periodically thereafter.

Client: MSc Project

My role: UX researcher, UI

Time: 3 months

Year: 2021

Tools: Adobe XD, Miro,

Problem statement

There is a need to create an engaging cybersecurity training that is based on real-life scenarios that can be replicated in the actual workplace as the traditional way of learning is less effective or less interactive for the employees to practice in protecting sensitive information which is crucial for the company's computer systems.

Timeline

Empathise phase

Define phase

Ideate phase

Prototype phase

Test phase

Secondary research

Primary research

Affinity diagram

Empathy map

Brainstorming

Storyline

Lo-fi prototype

Wireframes

Survey

User personas

Puzzles

Hi-fi prototype

User journey map

1 - Empathise

Secondary research

Cybersecurity

An increasing number of attacks are focusing on human failings. The majority of these attempts, known as social-engineering attacks, target employees who use computers on a daily basis.

Cybersecurity trainings

Current cybersecurity awareness training methodologies have been recently criticised for being based on passive learning.

Gamification

Gamification is a bottom-up design technique that emphasises the use of human incentive to increase engagement, motivation, and information retention. This human-centered design methodology aims to bring the most gratifying aspects of games to other valuable activities including training and education.

Escape rooms

Because they mix the enjoyment of games with the fulfilment of achieving a goal, these games can be excellent learning tools. In contrast to traditional learning approaches, the participant in an escape game is active rather than passive.

Primary research

Expert interview

The interview with an expert of cybersecurity helped to have a general idea of the topic and he was chosen because of his experience with trainings and the latest trends about cybersecurity. Also, from an expert point of view, understand whether applying gamification principles to a cybersecurity training would bring benefit to the employees and the company itself.

User interviews

I decided to take 4 user interviews to gather insights from a non-expert point of view. With these interviews, i was able to understand the participants awareness about cybersecurity, experiences with cybersecurity trainings but also what do they think about applying game-based principles to cybersecurity trainings.

Survey

The purpose of the survey is to gather as much details as possible in order to get mainly quantitative data. It helped the research by getting demographics data but also thoughts, opinions, feelings. The survey involved 30 participants with different background.

Key findings

"I have learned more about cybersecurity while doing my academics and research and not at my workplace."

"Gamification can be a way to make trainings more engaging."

"Trainings in general are usually boring and people, on a long-term period forget what they did during trainings."

Key findings

"My company provided workshops and online courses but i found them not very engaging."

"I think that companies should try with innovative ideas."

"Never thought about escape rooms but it sounds fun."

Key findings

2 - Define

Affinity diagram

After gathering all the information from the interviews and surveys, i decided to apply the affinity diagram to organise concepts into rational categories helping me in getting to the heart of results.

Empathy map

User persona

As a next step, i generated a persona to better represents the demands of a larger group of people therefore the target audience for this project. It also helped me to answer the question "Who am i designing for?".

User journey map

Point of View

Using the Point of View (POV) helped me to get a direct and clear problem statement stated at the beginning of the case study. It defined the right challenges to address for the design vision.

How Might We

Lastly, for the define phase, i decided to use the How Might We technique to help me generate ideas and support on answering the identified challenge. The following questions will help to open the following “Ideation Phase”.

How might we maximise the learning outcomes of a cybersecurity training?
How might we make a cybersecurity training more engaging?
How might we provide the best knowledge about cybersecurity to new and current employees?
How might we make a gamified training fully online?
How might we inspire employees to increase their knowledge about cybersecurity?
How might we shift from a traditional training to a gamified training?
How might we make feel employees safe and secure at their workplace?

3 - Ideate

Brainstorming

To come up with the storyline for the game i had some brainstorming sessions to gather ideas using paper and pen. I applied the mind mapping technique to stimulate my creative thinking and to visualise my ideas.

Storyboard

After a few feasibility tests, after deciding on the puzzles for different stages, the storyline was then incorporated for different stages of the game. The earlier versions of the puzzles were reviewed and scrutinised to find some loopholes that will make the puzzles to be solved easily. After that, the puzzles tied to the storyline were revised accordingly.

4 - Prototype

Wireframes

The below wireframes were designed on Adobe XD and have a specific path starting from the homepage ending with thanksgiving page. The final prototype of the escape room involves several different screens thus the wireframes shown below represents the concept of the game.

Hi-fi prototype

Below, it is stated the flow of the developed cybersecurity educational escape room created in Adobe XD. Obviously, the design stage involves several more screens with all the steps required to carry on with the game, nevertheless this is the principal game flow.

MacBook Pro mockup on a table with a plant in the background (Mockuuups Studio).png

5 - Test

Survey

The game was handed to 20 participants with the aim of testing and coming up with a general idea how people would respond to the game. The game served a purpose to make people aware of cyber security and its threats. Participants were timed and observed, and general feedback form was provided to the participants to check their level of understanding and engagement.

Feedback capture grid

Conclusion

Recommendations

For future work on this project few elements should be improved in order to be possible to make the game public for everyone. Adobe XD was utilised to develop the prototype which it was feasible for this project. Nevertheless, to allow users with more interactions and diversify the gameplay, a more advanced software is required to produce a business-like product.

Lastly, because technology is always changing, the game should be always updated with new trends. Innovative cyber-attacks can show up in future thus preventions will be created to defend from those attacks. Therefore, employees must be kept informed and trained accordingly to the latest cybersecurity trends.