From Lessons Learned to Improvements Implemented: Some Roles for Gaming in Cybersecurity Risk Management

Abstract

Effective cybersecurity risk management hinges on a strategic blend of people, processes, and technology working together to recognize and prevent attacks; mitigate and minimize negative impacts should attacks succeed; and resume operations after recovery. Ideally, risk management involves processes that engage the entire organization continually and holistically—not just episodic reactions by a few key personnel in times of crisis. The translation of lessons learned into implemented and validated improvements may be a missing or underutilized best practice. This chapter explores ways gaming can be used as a complement to authoritative standards and frameworks to optimize an organization’s cybersecurity posture and preparedness. A variety of gamified approaches are described and presented as useful tools with differentiating value at multiple stages in an ongoing cybersecurity risk management cycle. State-of-the-practice exemplars and successes are cited as are approaches to adapting games to both assess and improve an organization’s cybersecurity posture. The chapter concludes with some speculations about how games focused on cybersecurity can be expected to evolve and gain greater traction for risk management in light of emergent technologies and increasingly complex threat and defense landscapes.