# Assessing the Effects of Gamification on Enhancing Information Security Awareness Knowledge
## 1 Introduction  
Information security awareness (ISA) has become a vital issue for scholars and practitioners given an individual's increased risky behaviors along with a growth of the size of networks and Internet applications [1, 2]. Information security (IS) has also been a significant concern to educators [3]. According to an EDUCAUSE review [4], IS refers to developing a holistic, agile approach to reduce institutional exposure to IS risks and is the top information technology (IT) issue of foundations for student success. Moreover, students and the use of computers and the Internet have become inseparable, suggesting students are at a higher risk of exposing themselves to IS threats such as hacking, malware, and viruses [5, 6]. IS breaches can lead to losses and damages at the individual and organizational levels. Thus, equipping students with adequate ISA knowledge and concepts is essential for future professional life and societies [3, 7, 8, 9]. However, teaching ISA knowledge is challenging. First, security includes a wide range of subjects and modules, such that IS curricula are not being adequately addressedin undergraduate programs [3]. Second, information risk profiles continue to change, such that IS training and education provide relevant and timely knowledge [2; 9]. Third, budget and resource constraints are the main barriers to ISA programs in universities [7]. Lastly, given students' learning behaviors and limited experience, the previous literature suggested varying teaching methods, such as media richness systems [2], e-learning approach [10], virtual training [7], hands-on learning [6], or gamification training [11], may potentially benefit students to improve ISA. Hence, effective IS training and education rely on content materials and learning methods to achieve desired outcomes in the educational, economic, and social fields [3]. Despite the difficulties, scholars [5; 10; 12] emphasized the urgent need for IS training and education because human factors significantly predict employees' and students' security beliefs and behaviors. [PERSON] and [PERSON] [13] noted that according to the 2001 Information Security Industry survey, 48 percent of the security breaches were accidental and may result from negligence or ignorance of an organization's IS policies. The technical side of the organization cannot achieve security objectives; educating the security attitude of employees [5] or changing a more IS conscious organizational culture [13; 14; 15] or encouraging end-user involvement in IS compliance [14; 15] are also vital to ensure adequate security. IS education thus becomes an effective strategy that motives students' security attitude and likely prevents students from being the weakest link in a security chain [16]. It is thus essential to offer adequate IS education for students to understand IS knowledge, train security best practices, and repeat training regularly to increase their awareness and commit to security compliance [6; 7]. Accordingly, this study incorporated a novel educational practice, gamification, into IS education and examined its effect on enhancing students' ISA knowledge and students' attitudes toward and intentions to comply with security policies. Given an influential role of gender in students' learning and security behaviors [17; 18; 19], this study also explored gender differences in IS learning under a gamified education setting. The following questions were investigated:  
_RQ1_: Does gamification practice enhance students' overall ISA knowledge performance or specific security subjects? _RQ2_: Does gamification practice influence students' attitude and intention to comply with security policies and students' willingness to learn IS subject? _RQ3_: Does gender moderate the effect of gamification practice on students' ISA knowledge enhancement? This study continues to review the relevant literature on information security awareness and gamification. This study then outlines the methodology of participants and procedure and the results of the data analysis.