Games for cybersecurity decision-making

Abstract

Decision-makers are often confronted with cybersecurity challenges, which they may not fully comprehend but nonetheless need to critically address. Efficient preparation through cybersecurity games has become an invaluable tool to better prepare strategy and response to cyber incidents. Such games offer the potential for capacity building of decision-makers through a controlled environment, often presenting hypothetical scenarios that are designed to invoke discussion, while decision-making skills are put to the test. While games are acknowledged to be an effective method for such situations, many rely on technical capabilities to address these challenges. However, a key challenge is to understand the factors that influence cybersecurity decision-making. Further, game effectiveness for developing these skills is often not validated. This paper surveys cybersecurity games and compiles a data-set of 46 games to investigate how effective cybersecurity games are for assessing decision-making skills, and determines the state-of-the-art game. Through critical review and analysis of the data-set, a criteria to assess games for decision-making skills is presented. Furthermore, the criteria is applied to ten games, which determined Cyber 9/12 to be the state-of-the-art cybersecurity game for decision-making. The paper concludes with insights into how the assessment criteria can support the development of better decision-making skills through games.