# Assessing the Effects of Gamification on Enhancing Information Security Awareness Knowledge
## 2 Literature Review  
### Information Security Awareness Knowledge  
[PERSON] et al. [1] suggested that information security awareness (ISA) underpins the three aspects: knowledge, attitude, and behavior. If an employee is with adequate ISA, he/she would be knowledgeable about safe IS behaviors, committed to, and behave following best practices. In the context of health information security awareness (HISA), [PERSON] et al. [16] integrated the three concepts into HISA, namely, general ISA, health information security regulation awareness, and punishment severity awareness. Given our research aims, ISA knowledge in this study is defined as the extent to which students knowledge about the importance and implications of safe information security behaviors outlined in written policies, rules, and guidelines [1; 16]. This study employed the Human Aspects of Information Security Questionnaire (HAIS-Q) developed by [PERSON] et al. [1] to measure students' ISA knowledge. The HAIS-Q consists of a wide range of IS subjects: password management, email use, Internet use, social media use, mobile devices, information handling, and incident reporting. [PERSON] et al. [1] showed that the HAIS-Q may provide a complete understanding of cybersecurity vulnerabilities caused by human behavior. The IS focuses of the HAIS-Q are primarily aligned with IS education topics suggested by [PERSON] et al. [3] and with students' perceived threats domains identified by [PERSON] et al. [20]. Empirically, the HAIS-Q measurement was utilized to examine the relationship between individual differences and ISA [19] and explain undergraduates' problematic information security behaviors [21]. Consistent with the prior works, this study assumes that the HAIS-Q is a robust measurement to assess students' ISA knowledge as a significant predictor of security behaviors. Many security breaches are attributed to human errors [13; 18; 22]. Literature suggested that human's attitude and behaviors often exhibit weaknesses or vulnerabilities that likely lead to opportunistic attacks [7; 10; 23], particularly in those who has insufficient technical experience or are not aware of opportunistic attacks such as social engineering [12]. For example, [PERSON] and [PERSON] [5] surveyed university staff and found that lack of IS awareness may lead to non-technical threats such as user errors, software failure, social engineering problems, and data leakage problems. Human factors such as personal norms, self-control [16], perception of privacy and responsibility [14], and mindful awareness [21] were negatively associated with deviant behaviors. Furthermore, scholars [5; 13] stressed that considering human behaviors is beneficial in improving an organization's security culture, thereby reducing violations against security policies. Overall, along with advancements in the Internet and technological devices, the role of humans has increasingly expanded in addressing IS [23]. Moreover, human factors are intrinsic, and organization leaders often have limited influence on them [14]. Hence, in addition to rewards and sanctions, IS research highly recommended that ISA training and education is an essential part of defensive security policies to motivate students toward awareness of security policies [3; 5; 10; 15; 16]. In the context of IS training and education research, certain studies mainly focused on normative suggestions [3; 9]; several scholars examined the individual factors and characteristics influencing students' security beliefs and behaviors [6; 14; 16], whereas certain research provided empirical results concerning students' status of ISA knowledge [7; 10]. Recently, [PERSON] et al. [11] presented an approach of security training gamification to raise employees' awareness and keep their engagement in regular practicing. [PERSON] et al. [8] developed a cybersecurity educational game and validated its positive correlation to learning achievement.