# A Novel Framework for the Development of Age Appropriate Information Security Serious Games

Rudi Serfontein, Riana Serfontein

► To cite this version:

Rudi Serfontein, Riana Serfontein. A Novel Framework for the Development of Age Appropriate Information Security Serious Games. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.120-129, 10.1007/978-3-031-12172-2_10. hal-05324923

HAL Id: hal-05324923

https://inria.hal.science/hal-05324923v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# A Novel Framework for the Development of Age Appropriate Information Security Serious Games

Rudi Serfontein and Riana Serfontein

North-West University, Potchefstroom, South Africa
Rudi.Serfontein@nwu.ac.za

**Abstract.** Serious games have been shown to be an effective tool when teaching information security concepts to children and adults alike. However, due to the different ways in which people learn during different stages of their life, developing effective games for children can be a non-trivial task. In this paper, a novel framework is introduced that aims to simplify the process of developing serious games for children by making use of well-known developmental psychology principles. The framework is based on Erikson's Theory of Psychosocial Development, as well as Bandura's Social Cognitive Theory. Both of these theories are well-known within the field of developmental psychology, and have been shown to be valid in prior studies. To validate the proposed framework, a number of existing serious games from the literature is used in order to determine if the framework could have been used to develop the extant games. The framework, developed from a psychological basis, matches the games found in the literature. This suggests that the framework is a valid approach when developing age appropriate information security games.

**Keywords:** Information security · Serious games · Developmental psychology

## 1 Introduction

It is well known that addressing the human aspect in information systems is crucial for effective information security risk management [1]. Sadly, many users of information systems still act as the greatest vulnerabilities to these systems as a result of unsafe or irresponsible behaviour [2]. Studies have shown that one of the most effective ways to reduce the risks associated with users is to improve their behaviour when it comes to interacting with these systems [2–4]. There are several methods that can be used in organisations to address this problem, such as clear and well-structured policies [5], but when it comes to improving information security behaviour outside of organisations different approaches are needed [6]. Two of the best known approaches are awareness programmes and education, both of which can also be used in organisations to improve information security in general [7, 8]. The difficulty with both of these approaches, however, is that they can be difficult to implement effectively, especially outside of
organisations: continuous awareness programmes could lead to information security fatigue if it is not managed correctly [9], whereas education requires structured courses presented by appropriately trained educators. This leads to the suggestion that using formal education to improve information security becomes more difficult when targeting larger, unstructured groups. There is also the risk that education courses might not be as effective as hoped [10]. One potential approach to improving the efficacy of information security education in a larger group, while also potentially improving the efficacy of the education course, is to use serious games. A serious game, in principle, is any game where the primary focus is on teaching or education, rather than amusement [11]. These games have been shown to be an effective way to improve education courses, and there are several serious games that have focussed specifically on information security concepts [12, 13]. These serious games do have limitations, however, one of which is that they can only target particular age groups due to the way in which education occurs at various stages in a person's life [14]. This highlights two important aspects that need to be taken into account when developing serious games: firstly, for a serious game to be effective, it needs to conform to the principles of effective education, and secondly, it needs to be appropriate for a specifically targeted age group. Addressing these factors could pose problems if a serious game developer is unfamiliar with the concepts of developmental psychology, and especially if the serious game being developed has a specialised focus like information security that also needs other areas of specialised knowledge.

In this paper, a novel framework will be introduced that aims to simplify the process of developing age appropriate information security serious games for children by making use of the principles of developmental psychology. Specifically, the framework incorporates Erikson's Theory of Psychosocial Development [15], which details the various developmental stages a human being goes through during their life, and Bandura's Social Cognitive Theory [16], developed from Bandura's Social Learning Theory [17], which explains how learning occurs. Both of these theories are well-known within the field of developmental psychology, and they have been shown to be valid in a number of studies over the years [18-21]. A serious game developed using a framework that incorporates these two theories could, therefore, be both age appropriate for the targeted age groups, as well as effective from an educational standpoint.

The remainder of the paper is structured in the following manner. In the next section, background is provided on the topics of developmental psychology, serious games, and information security in serious games. Then the proposed framework is introduced, followed by an evaluation of the validity of the framework using existing information security focussed serious games. The paper then concludes with a discussion of the results and potential further research.

## 2 Background

The purpose of the framework presented in this paper is to make it easier for developers to create age appropriate information security serious games. In this section, some of the background necessary for the development of such a framework is discussed. The section starts with an overview of Erikson's Theory of Psychosocial Development, followed by a brief discussion of Bandura's Social Cognitive Theory. The section concludes by
considering serious games and, in particular, the information security concepts addressed in serious games.

## 2.1 Erikson's Stages of Psychosocial Development

Erik Erikson's theory on psychosocial development posits that there are eight stages of development [14, 15]. These stages are defined by specific crises that should be resolved during the stage so that the person can function successfully in life [14, 22]. The stages are presented in Table 1. The stages that will be focused on are the third through fifth stages: Initiative versus guilt; Industry versus inferiority and Identity versus role confusion. The reason for focussing on these three stages in the development of the framework proposed in this paper are twofold. Firstly, it is expected that younger children (under 3 years of age) would not be able to effectively learn from a serious game. Secondly, the purpose of this framework is specifically to aid in the development of age appropriate serious games aimed at improving information security skills among children, and thus the framework does not focus on adults.

<table><caption>**Table 1.** Erikson's stages of development [14, 23]</caption><thead><tr><td>Period in life/age</td><td>Psychosocial stage</td><td>Challenge</td></tr></thead><tbody><tr><td>Infancy (0–1)</td><td>Trust vs Mistrust</td><td>Develop trust in caregivers/world</td></tr><tr><td>Toddlerhood (1–3)</td><td>Autonomy vs Shame</td><td>Realise ability to make decisions</td></tr><tr><td>Preschool (3–6)</td><td>Initiative vs Guilt</td><td>Develop willingness to try new things and handle failure</td></tr><tr><td>Childhood (6-adolescence)</td><td>Industry vs Inferiority</td><td>Learn basic skills and how to work with others</td></tr><tr><td>Adolescence</td><td>Identity vs Role confusion</td><td>Develop a lasting, integrated sense of self</td></tr><tr><td>Young adulthood</td><td>Intimacy vs Isolation</td><td>Develop lasting relationships</td></tr><tr><td>Middle adulthood</td><td>Generativity vs Stagnation</td><td>Contribute to future generations and community</td></tr><tr><td>Late adulthood</td><td>Integrity vs Despair</td><td>View life as satisfactory with no regret</td></tr></tbody></table>

During the three stages that span the time between preschool and adolescence, children develop certain skills through play and observation [15, 16], as well as becoming more steadfast in the skills and habits that they have learned during the previous stages of development [15]. During the preschool phase (initiative vs guilt), a child should develop purpose, allowing the child to develop and realise goals as well as learn to handle failure and try new methods to solve a problem [14, 15, 23]. The childhood phase (industry vs inferiority) is where the child develops a sense of competence, learning what their strengths are and honing their skills [14, 15]. During this phase children start developing habits that will stay with them for the rest of their lives [24]. Finally, the third phase that
will be focused on is the adolescence phase (identity vs role confusion), where fidelity is developed [14, 22], meaning that the child develops a strong sense of self and start to consider their meaning in life [14, 22]. In adolescence the person needs to develop their own value system, that they can be faithful to [23].

## 2.2 Bandura's Social Cognitive Theory

People learn certain behaviours, often through observation and experience [17]. By observing or experiencing certain consequences, certain behaviours are strengthened or discouraged [16, 17]. This process happens constantly throughout a person's life, as they learn more about themselves and the world around them [16, 17]. The process of observing consequences of behaviours and adjusting behaviour to get the desired consequence is not limited to the “real world”, but is also valid within the world of games. Computer programs allow a person to test risky behaviours, without any real risk to themselves [16]. Behaviour is influenced by a person's expectations, experiences and environments. If a person expects a certain behaviour will have a rewarding effect (emotional or physical), they are more likely to perform that behaviour, than if they expect a punishment or negative effect. This behaviour can also be dependent on the environment as the expected effect might be different based on who the person is with, or where they are, for example a child might be more comfortable doing certain things at home, rather than at school [17].

## 2.3 Information Security Serious Games

Serious games are generally accepted to be games that have a serious or utilitarian focus, while still being fun [13]. These games have been shown to be effective in teaching information security concepts, and the targeted age ranges for these games span from preschool to adulthood. One such game, named CyberCIEGE, has been used in organisations in the past to teach information security concepts [12]. The topics covered in these games vary from game to game, but a non-exhaustive list of topics that are covered by some of these games are shown in Table 2.

<table><caption>**Table 2.** Information security serious games for children (adapted from [25])</caption><thead><tr><td>Game name</td><td>Cybersecurity topics</td></tr></thead><tbody><tr><td>Interland<sup>a</sup></td><td><ul><li>Communicate responsibly</li><li>Know the signs of a potential scam</li><li>Create a strong password</li><li>Set an example and take action against inappropriate behaviour</li></ul></td></tr><tr><td>Carnegie Cadets<sup>b</sup></td><td><ul><li>Staying safe online</li><li>Protection against malware</li><li>Using social media responsibly</li></ul></td></tr></tbody></table>

(continued)
<table><caption>**Table 2.** (continued)</caption><thead><tr><td>Game name</td><td>Cybersecurity topics</td></tr></thead><tbody><tr><td>CyberKids [26]</td><td><ul><li>Strong passwords</li><li>Vulnerability identification</li></ul></td></tr><tr><td>PBS Cybersecurity Lab [27]</td><td><ul><li>Staying safe online</li><li>Spotting scams</li><li>Defending against cyber attacks</li></ul></td></tr><tr><td>Wolf, Hyena, and Fox, and Happy Hippo [13, 25]</td><td><ul><li>Password complexity</li><li>Online bullying</li></ul></td></tr></tbody></table>

As shown in Table 2, there are a variety of information security topics that can be covered in a serious game. Some of these topics might be too simple or too advanced when targeting a specific age group, however, so it is important to keep the developmental stage of the targeted group in mind when developing a serious game.

## 3 Method

In this section the proposed framework will be introduced. The framework has three main components that need to be addressed, namely the selection of an age group, the factors that the game will need to focus on as a result of the selected age group, and finally the structure of the overall game cycle. In this paper, the game cycle is defined as the basic flow of a game's events, such as the tasks and challenges that a player will need to complete in order to progress through the game.

The framework as presented in this paper is focussed on the development of serious games for children, and is therefore limited to the third, fourth, and fifth stages of development. The first step in utilising the framework is identifying which age group the game will target; this can be based purely on selecting an age group, but it should also be possible to select a developmental group based on the attributes of the group being targeted. For the second component of the framework, the challenges and developmental features of the targeted group are used to determine which skills or knowledge the game should focus on. During the third stage, Preschool, for instance, a child will be challenged to develop a willingness to try new things and learn to handle failure. This is, arguably, an ideal phase to introduce the foundational concepts of information security, such as the importance of remembering a password, or not sharing your password with others. This is also the stage where the child can be encouraged to determine why information security is important in a personal sense. During the fourth stage, when a child is challenged to develop basic skills, the game could focus on teaching simple information security skills, such as the creation of strong passwords, how to protect against malware, identifying obvious scams, etc. Finally, during the fifth stage, when a child is challenged to develop an integrated sense of self, the game could focus on helping to develop the player's way of thinking with regard to information security concepts. The game could also attempt

<footnote>ahttps://beinternetawesome.withgoogle.com/en_us/interland</footnote>

<footnote>bhttps://www.carnegiecyberacademy.com</footnote>
to improve a player's overall security behaviours by helping them to develop a sense of value within this context, i.e. the conviction that safe behaviour is important and has personal value to the player.

The third component, namely the game cycle, is the core of what the game will be structured around. In order to determine how the game cycle should be structured, the pattern found in Bandura's Social Cognitive Theory, which is similar to the pattern commonly found in normal games, is considered. In normal games, this pattern is one of the more typical ways in which players are taught gameplay skills: a player will be taught the basics of the skill, be put into environments where the skills are used with increasing levels of difficulty, and then finally be confronted with problems that require the use of multiple combined skills [28]. This can also have a positive effect on physical skills in addition to cognitive skills, as players can be trained to have better visual skills through games [29]. In this framework, this pattern is used to inform the design of the game cycle. This cycle has four main stages as informed by Bandura's theory: the introduction of a new skill (or knowledge), the testing of that skill in a suitable game environment, challenging the skill via a more advanced set of tests, and finally the combination of the new skill with existing skills in order to solve more complex problems. Once these four stages have been completed, a new skill can be introduced. An example of how this cycle could be used to teach password safety is as follows. The basic rules of secure passwords are introduced in the first stage, and then used by the player in the second stage to create a secure password. This is repeated until the user can easily create simple secure password repeatedly, at which point the game transitions to the third stage. Here the user must then evaluate seemingly secure passwords and determine if they are, in fact secure. Upon completion of the third stage, the player could be expected to combine previously acquired knowledge on safe password use with the newly acquired knowledge on secure passwords to determine safe and unsafe situations in the fourth stage. The proposed framework, with all three components included, is presented graphically in Fig. 1.

<figure><img src="image_3.png" /><figcaption>Fig. 1. The proposed serious game development framework</figcaption></figure>
In the next section, the framework will be evaluated by using serious games from the literature and determining if those games could have been developed with the aid of this framework.

# 4 Framework Evaluation

While the framework presented in the previous section should be valid as it is based on accepted developmental psychology principles, it is important to confirm the validity of the framework by evaluating it against existing serious games. In this section this validation is accomplished by studying existing serious games literature, and comparing the patterns and topics covered in the literature to those contained in the framework. By demonstrating that the framework could have been used to develop extant serious games, it is reasoned that the framework may be considered valid within the context of the existing literature, and therefore could be used effectively to create new games.

## 4.1 3rd Stage: 3–6 Years Old

The game that is used to evaluate the 3rd stage (preschool) of the framework is the Wolf, Hyena, and Fox games, as well as the Happy Hippo game [13, 25]. These are two components of a single serious game that targets preschool children, and makes use of poems to teach information security concepts, at an appropriate level of difficulty, in order to spread awareness of digital wellness and information security concepts. The game touches on password complexity and good online behaviour, which are fundamental concepts in information security.

The game cycle starts by reading a poem to the player, and then asking a number of reflection questions about the contents of the poem after it has finished. After this, a quiz is opened to test the player's comprehension of the topics addressed in the selected poem, and a mini-game is launched once the quiz is over. Finally, at the end of the cycle, a message is shown to the player that shows whether they won or lost. The game does not place blocks on a player's progress if they get answers wrong during the game's quiz component; while the authors indicated that this was done because the game is meant as an awareness tool, it could also have the added benefit of teaching its players that failure is not a disaster, and that it is possible to recover and improve following failures. Based on these attributes of the game, it seems probable that the proposed framework could have been used to aid the development of this game had it been available. This conclusion is based on a consideration of the focus topics and content, as well as the design of the game cycle.

**Focus Topics and Content:** The game is targeted at children in the preschool stage of development, which means that it should focus on introducing fundamental concepts. It should also aim to help children learn how to handle failure. This game addresses both of these aspects in one way or another, as both password complexity and good online behaviour could be considered fundamental concepts when discussing information security education.
**Game Cycle:** This game has a game cycle that matches the cycle proposed in the framework. The game cycle starts by teaching a new skill or knowledge by means of a poem, and then transitions to a testing phase where the player must reflect on what they have learned. The quiz represents the challenge phase, where the player must use their new skills/knowledge in order to solve the quiz. During the integration phase, a mini-game is presented, where the player can engage in a fun activity where some of the content of the selected poem is coupled with gameplay skills (e.g. memory of tile locations). The game cycle therefore matches the pattern as presented in the framework.

In summary, the framework seems to be valid where the development of serious games targeted at preschool children is concerned.

## 4.2 4th Stage: 6 Years Old to Adolescence, and 5th Stage: Adolescence

For evaluating the 4th stage, the PBS Cybersecurity lab [27] that is targeted at school children is considered, and for the 5th stage the six games developed by Mostafa & Faragallah [30] for teaching undergraduate students is used. In both cases, the games match the framework.

**Focus Topics and Content:** The Cybersecurity lab, which is aimed at children from as young as 6th grade, has a focus on the development of skills, such as coding and password cracking. The six Mostafa & Faragallah games, meanwhile, are aimed at improving comprehension of the topics and the integration of these topics into real-world scenarios, and many of the games have the stated goal of helping students to understand particular concepts. This could help to incorporate these topics into a student's way of thinking, while also enforcing the idea that it has personal value to the individual.

**Game Cycle:** The game cycles also match those proposed in the framework. While the Cybersecurity lab does place a greater emphasis on teacher input during the process, the overall cycle is still the same. The six games developed by Mostafa & Faragallah also have this game cycle, in that these games all introduce a skill that has to be used, and then tests and challenges that skill.

In conclusion, the proposed framework should be useable in developing new games, as there are existing serious games that follow the principles incorporated into the framework.

# 5 Conclusion and Future Work

In this paper, a novel framework is introduced that aims to simplify the process of developing serious games for children. The framework is based on developmental psychology principles, and in particular makes use of Erikson and Bandura's theories in order to provide guidance when developing games for specific age groups. The framework was tested by comparing it to extant serious games, and it matches the games that were used in the evaluation. The framework has not yet been used directly to create a game, which is a limitation to the current research, but it is expected that this framework could be used to create effective age appropriate serious games that can be used to effectuate information security education, training, and awareness in future research.
## References

1. Dang-Pham, D., Kautz, K., Hoang, A.-P., Pittayachawan, S.: Identifying information security opinion leaders in organizations: insights from the theory of social power bases and social network analysis. Comput. Secur. **112**, 102505 (2022)

2. McLeod, A., Dolezel, D.: Information security policy non-compliance: can capitulation theory explain user behaviors? Comput. Secur. **112**, 102526 (2022)

3. López, A.U., et al.: Analysis of computer user behavior, security incidents and fraud using self-organizing maps. Comput. Secur. **83**, 38–51 (2019)

4. Tsai, C.-Y., Shih, W.-L., Hsieh, F.-P., Chen, Y.-A., Lin, C.-L., Wu, H.-J.: Using the arcs model to improve undergraduates' perceived information security protection motivation and behavior. Comput. Educ. 104449 (2022)

5. Moody, G.D., Siponen, M., Pahnila, S.: Toward a unified model of information security policy compliance. MIS Q. **42**(1), 285–311 (2018)

6. Holgersson, J., Kävrestad, J., Nohlberg, M.: Cybersecurity and digital exclusion of seniors: what do they fear? In: International Symposium on Human Aspects of Information Security and Assurance, pp. 12–21, Springer (2021)

7. Kemper, G.: Improving employees' cyber security awareness. Comput. Fraud Secur. **2019**(8), 11–14 (2019)

8. Chen, Y.-T., Shih, W.-L., Lee, C.-H., Wu, P.-L., Tsai, C.-Y.: Relationships among undergraduates' problematic information security behavior, compulsive internet use, and mindful awareness in taiwan. Comput. Educ. **164**, 104131 (2021)

9. Furnell, S., Thomson, K.-L.: Recognising and addressing 'security fatigue.' Comput. Fraud Secur. **2009**(11), 7–11 (2009)

10. Bernard, L., Raina, S., Taylor, B., Kaza, S.: Minimizing cognitive overload in cybersecurity learning materials: an experimental study using eye-tracking. In: IFIP World Conference on Information Security Education, pp. 47–63, Springer (2021)

11. Jaffray, A., Finn, C., Nurse, J.R.: Sherlocked: a detective-themed serious game for cyber security education. In: International Symposium on Human Aspects of Information Security and Assurance, pp. 35–45, Springer (2021)

12. Cone, B.D., Irvine, C.E., Thompson, M.F., Nguyen, T.D.: A video game for cyber security training and awareness. Comput. Secur. **26**(1), 63–72 (2007)

13. Allers, J., Drevin, G., Snyman, D., Kruger, H., Drevin, L.: Children's awareness of digital wellness: a serious games approach. In: IFIP World Conference on Information Security Education, pp. 95–110, Springer (2021)

14. Dunkel, C.S., Harbke, C.: A review of measures of Erikson's stages of psychosocial development: evidence for a general factor. J. Adult Dev. **24**(1), 58–76 (2017)

15. Erikson, E.H.: Childhood and society. Paladin Grafton Books (1993)

16. Bandura, A.: Social cognitive theory: an agentic perspective. Asian J. Soc. Psychol. **2**(1), 21–41 (1999)

17. Bandura, A.: Social Learning Theory. Prentice Hall (1977)

18. Nwosu, H.E., Obidike, P.C., Ugwu, J.N., Udeze, C.C., Okolie, U.C.: Applying social cognitive theory to placement learning in business firms and students' entrepreneurial intentions. Int. J. Manag. Educ. **20**(1), 100602 (2022)

19. Woods, E.K., Fly, A.D., Dickinson, S.L., Chen, X.: P18 a test of social cognitive theory on fruit and vegetable intake in indiana high school students. J. Nutr. Educ. Behav. **53**(7), S32 (2021)

20. Maree, J.G.: The psychosocial development theory of Erik Erikson: critical overview. Early Child Dev. Care **191**(7–8), 1107–1121 (2021)
21. McGaw, J., Vance, A., White, S., Mongta, S.: Whose place? Lessons from a case study of a guardianship determination for an Australian indigenous child. Health Place **73**, 102739 (2022)

22. Sokol, J.T.: Identity development throughout the lifetime: an examination of Eriksonian theory. Graduate J. Counsel. Psychol. **1**(2), 1–10 (2009)

23. Louw, D., Louw, A.: Child and Adolescent Development. Psychology publications (2014)

24. Blake, S., Winsor, D.L., Allen, L.: Child Development and the Use of Technology: Perspectives, Applications and Experiences. Information Science Reference (2011)

25. Snyman, D.P., Drevin, G.R., Kruger, H.A., Drevin, L., Allers, J.: A wolf, hyena, and fox game to raise cybersecurity awareness among pre-school children. In: International Symposium on Human Aspects of Information Security and Assurance, pp. 91–101, Springer (2021)

26. Pérez, J., Torres, R., Brand, S.V.: Cyberkids: video game for raising cyber security awareness in children. In: 2020 39th International Conference of the Chilean Computer Science Society (SCCC), pp. 1–8 (2020)

27. Pbs.Org: The cybersecurity lab – educator guide | nova labs | pbs. https://www.pbs.org/wgbh/nova/labs/about-cyber-lab/educator-guide/. Accessed 6 Apr 2022

28. Rogers, S.: Level Up! The Guide to Great Video Game Design. John Wiley & Sons (2014)

29. Green, C.S., Bavelier, D.: Action video game modifies visual selective attention. Nature **423**(6939), 534–537 (2003)

30. Mostafa, M., Faragallah, O.S.: Development of serious games for teaching information security courses. IEEE Access **7**, 169293–169305 (2019)