Game-Based Learning Can Make Security Training Stick With Lee Anderson

Welcome & Guest Introduction

Jackie Pelegrin 0:01

Hello, and welcome to the Designing with Love podcast. I am your host, Jackie Pellegrin, where my goal is to bring you information, tips, and tricks as an instructional designer. Hello, instructional designers and educators. Welcome to episode 146 of the Designing with Love Podcast. I'm thrilled to have Lee Anderson with me today. Lee is a cybersecurity professional with over 16 years of experience helping organizations reduce human risk by understanding how stress, behavior, and design influence security decisions. He is also the creator of Hack Attack Defense, a card game that teaches cybersecurity concepts through play and helps people think differently about online safety, decision making, and defense. Welcome to the show, Lee.

SPEAKER_01 0:50

Thank you, Jackie.

Jackie Pelegrin 0:51

Appreciate you having me on. And I'm so glad we got to meet through Pognatch. I wanted to give a little shout out to that because uh you and I are on there and it's a great platform. So for sure. Glad we got to connect. And and I think we'll stay connected too because we have the gaming aspect, right, that we both have in common. So that's great. A lot to share. All those new games that come out and and stuff. It's always fun.

From Magic Tricks To Cybersecurity

SPEAKER_01 1:13

That'd be great.

Jackie Pelegrin 1:13

So just yeah. So to start, can you tell us a little bit about yourself and share what inspired you to focus on cybersecurity as a profession?

SPEAKER_01 1:23

Sure. So I trace it back to when I was a young kid and I was fascinated by magic. I always caught the latest David Copperfield shows on TV. Uh my dad would bring home little uh tricks from his uh work trips, and it just fascinated me, this idea of secret knowledge and uh and seeing people get uh confused or excited or wowed by what was presented. And I never really saw much of it as a kind of in a professional um way. I wasn't looking to be a magician or any by any stretch, but as I was getting into information technology with my college career, cybersecurity came on my radar and learning how to uh how to do security assessments where you could legally hack into a company's system and again kind of that secret knowledge and that that power. So I mean it's a very immature way of looking at things as I'm looking at it back on it now. But it's what turned me on to this in general. And as I was diving more down this road um with the security assessments, I I got turned on to social engineering and understanding how behavioral psychology comes in and how people get manipulated by attackers. And we would do that in a again in a in a safe, controlled environment and learn how what made people tick, what made them um vulnerable to attacks, and then we'd need to train them on how to how how to avoid them. And I think what really I think solidified the course that I'm on now is that desire that understanding that it is a it's a feature uh in humanity that we have our the way our brains work is just we we have the fight-flight response. There are things that just we we can't um always control, but we can be more prepared for those types of things. And my goal from like I guess now and going forward is more of this curious and secure mantra where it's it's about helping people take a pause, ask questions, and to use their their mental and emotional health to help make them more secure. So that's kind of a long rambling way, but that that's kind of the tr the trajectory I followed.

Jackie Pelegrin 3:43

Oh, that's good. I like that. It's always good to hear the the history and what kind of uh sparked your attention and your interest in that because you have you had your your epiphany moment right then and there. So that's great. And then you were able to make it a profession. So that's that's really great. I you know, I've always been interested in that too, with the psychology behind things. I was actually gonna go into business and and I was training to do market research, and that has a lot of the psychological aspects of it. Why do people buy what they buy when they buy it? Right. Um, but also too, what you were talking about with the, you know, why do people get hooked into something, right? And yeah, what what causes that? So it's it's very interesting. And um, yeah, so that's yeah, that's a interest, you know, that you once you're hooked into it, you're like, oh, this is so good. I gotta learn more about this. So that's great.

Building A Card Game That Teaches

Jackie Pelegrin 4:38

Wow, I love that. And as I mentioned in the intro, uh you focus, uh, you you started your um your game last year. Um, you published it, uh Hack Attack Defense, the car game, uh, that teaches cybersecurity concepts through play. So, what did designing that game teach you about transfer of learning? Because I know that was one of the things you mentioned that we wanted to discuss in this episode today.

SPEAKER_01 5:01

Yeah, thank you. That that was definitely kind of along those lines, just a passion project to really help educate people on how to be more secure and and definitely wanted to not just make it a fun game, but have it be educational, mildly educational, because you try to force too much education in and it becomes not as fun. So I the the goal was to have something that they could that that mimicked real life, and then I would supplement it with social media posts that would dive more deeply into the concepts. And so, and and that's kind of where the transfer of learning happens is as people are playing the game, maybe they're not familiar with a certain concept. Um, there's a little bit of flavor text on each card that gives a little bit of idea about how those defenses will help protect you against cyber attacks, but then ultimately there's the online content that'll help really give a deeper explanation. But I've had some some fun stories just with um with friends that have played it with their kids. And the kids will ask their dad, uh, do we use a password manager? And it kind of puts puts the dad on the spot. And it's just like, oh, like my kids are actually paying attention to this, and it's something that they're learning that's important to protect these things. And so that that was kind of the overall goal is really just create a safe environment where you just put everything out on the table and the things that are gonna click, they're gonna latch on to, and it just gives them the opportunity to focus on one thing or another at a at a different time.

Jackie Pelegrin 6:32

Wow, that's great. So it brings more awareness to those things that maybe people don't think about or aren't aware of, right? So that's that's really great. And I love that kids are saying to the parents, oh, do we have this or do we need to get this? Right. So it brings awareness not only to the adults, but to the to the kids too, because uh as we'll probably talk about later with the uh the organization that you're part of, I think that's really great to not only have adults be aware of that, but I like that uh that the the game it allows families to do it together. So it's that cooperative learning. Um, but like you said, it's not too educational, it brings that fun into it. I agree. If you make it too serious, then people aren't gonna want to stay engaged with it. So you wanted to balance that out as well. I love that.

Stress, Amygdala Hijack, & Learning

Jackie Pelegrin 7:23

So what you do, you focus a lot on that human risk, that's uh stress and behavior. In cybersecurity, people are often expected to make smart decisions and high pressure moments, but that doesn't always happen, right? So uh what do learning designers and educators need to understand about how stress affects decision making?

SPEAKER_01 7:42

Yeah, that's that's a good question. And it's it's interesting thinking about it from so I'm I've kind of I emulate my one of the team that I'm on is called adversary emulation. So we actually try to mimic the bad guys to help train our employees. And so the way that we we study the attackers and they'll often uh take advantage of these stressors, they will send us something that might heighten our emotions, something that uh expresses urgency, or maybe there's fear or even excitement, just these different levels of that's going to trigger what um Daniel Golman is a behavioral psychologist, I think, and he he coined the term amygdala hijack, which is where the amygdala gets fired off, which is that emotional processing in our brain, and it will then suppress the logic thinking. And so the attacker will will bank on that in you not thinking logically to get you to do something that you might otherwise have scrutinized a little bit better. And so just kind of bringing that back to the educational and instructional design area, I think it's really important. We we want people to latch on to our messages, but we don't want to use fear or these other types of heightened emotional um tactics, even though they may work in the short term. If you if you tell somebody they're gonna get penalized with training or a dock and pay or something, if they don't uh do well on this training, yeah, it it it'll get them to check the box, but it's not gonna get them to absorb what's actually happening. And so I I really wanna in everything that I'm trying to promote is is to is to promote more of a a uh under like human-centered, really trying to help uh companies and businesses understand that they're working with people. And as as educational designers, I think that could easily um that could look like recognizing that the people that we're working with that we're training, they're not always in an ideal situation where they're able to learn. They may have stresses at home with relationships or financial issues or health issues. And I think, granted, we can't fix all of those or make them better, but we could start the training off with a breathing exercise or have a break in the middle that lets them that tells them go and walk, walk around for five minutes and say hi to somebody. I mean, there are ways that we can promote and encourage more of that mental and emotional health so that when they come back or they're participating in the training, they can have they can absorb the content more readily.

Jackie Pelegrin 10:22

I like that. That's great. I teach uh uh graduate classes and therefore instructional design professionals, right? Or those that are wanting to go into the field. And I would say about 80% of my students are in education already, whether they're in K through 12, sometimes some of them are in higher education or some are in corporate training, but they want to go into you know e-learning development, things like that. And this is something they don't really think about. And so uh, but but then a lot of my students will say the brain breaks are really beneficial. So that sounds like what you're talking about is those those brain breaks, those are really important as well.

SPEAKER_01 10:59

And I and I just to I guess to follow up on that. So I I just completed a learning experience design degree last year. And one of the things that really helped, I think, even solidify this even more was creating personas for the training where you identify an individual and you a very specific individual and their circumstances and you tailor the training to that individual and it makes it more personal and direct, and it really helps you empathize and and connect with with the other learners.

Jackie Pelegrin 11:29

I love that. I love the personas too. That's that's a great way to be able to connect with your learners. And they say even sometimes you can even print out the persona, like if you create like a an image or or some type of something that you can have, that visual. Um, they say sometimes printing it out and having on your desk is really helpful as you're creating the training or the curriculum because then you can look back to that. So it's really neat too. Yeah. When you were talking about that later, it reminded me, you know, that fear-based when I was at a company, um, I was working in enrollment in higher education. It was my first job in higher education. And I remember the first week of training that we were going through, and someone said to us, make sure you don't um get sent to the red room because the red room is like a no-no place. And so during, I think it was like the third day of training, they take the whole training class and they bring us into this room and it was painted red. And we're all like, Oh no, are we gonna get fired? What's going on? And so they're like, No, no, this is just the training room. And I'm like, you know, people need to be careful telling new hires something like that. Because we were all like, oh no, what's gonna um yeah, I've all I haven't been on this job but a not even a week, and oh no. So yeah, that really all that jolted all of us, and we were like, oh my goodness, yeah. So I agree with you, those fear-based tactics don't work. They may work for the short term, but not for the long term. And we ended up not even having desks, so it was, yeah, it was a crazy time for sure. Not for this experience or anything.

Practical Security Training That Works

Jackie Pelegrin 13:05

Right. Yes, exactly. Um, speaking of training, cybersecurity training or any type of compliance training, things like that can sometimes feel fear-based, maybe even overly technical or compliance driven, uh, which is is true of a lot of those types of training. So, from your experience, what makes security education more practical, memorable, and behavioral changing for everyday people?

SPEAKER_01 13:28

Yeah, and that that that's a good point. And it's hard because cybersecurity in and of itself is a, I mean, it's a high stressed area of in people's lives, in the corporate environment. And so often they want to resort to those short-term fear tactics because they need it to be done. They need the place to be secured, even if it's going to, and they may not even consider the trade-offs in the short term. But what I found is that uh if you can connect to people on a personal level and while still diving into these areas of sensitivity and and confidentiality and security, if you can what I've found is that in the trainings that we'll we deliver, if we introduce or we talk about how what we're talking about that's going to secure the company will also help you at home and talk about just make those parallels, those connections about how even you're if you're talking about something that maybe is unique to the environment, but translate it to how that how they can apply it in their personal life, they have been so appreciative of that connection because they may not make that connection. And by you showing that you care about how they are secure and safe and and feel okay in their home, in their personal life, they're gonna take that, implement it, and then they're gonna show up at work in a better situation. They're gonna have enveloped or uh absorbed that information on a personal level, which is going to just trickle down to how they show up at work. And so just that idea of just really again focusing on the human, just recognizing that these are people that if you show them just a little bit of attention and care and focus, um, that's gonna that's gonna have long-term uh effects.

Jackie Pelegrin 15:45

Absolutely. I love that. And especially today with such a hybrid workforce that we have, like you and myself, I work from home and I only have to go into the office for in-person conferences three times a year. Um, so those are required that we go into the office for those. And so it's a different dynamic now out there today, right? So it's even more important to have that security because of, you know, what uh because people are using their maybe their work computers for personal reasons now. Maybe they didn't before, right? So yes, exactly. And it's really neat because like where I work, we have our IT security department and they're always trying to make sure that they are on top of things, not just from the company standpoint, but also whenever they send out the the alerts or anything like that, they try to make sure, like you said, it's not fear-based. It's more here's the information you need to help protect not only the company assets, but your own as well. And they uh so like around the holidays, like Halloween, they'll do like a little trick-or-treat thing and it's really fun. So they'll make a a little poem out of it or something and and make it fun. So it's really nice when, you know, yeah, you're right, they can take the kind of that personal approach to it and and make it so that it's practical, um, not just on a business level, but personal level as well. I like that. That's great. Are there any tips that that you can share for companies, uh, or even those that are maybe in IT security or something like that about how they can make that so that it is more inviting for people when it comes to alerting people and not, you know, giving that fear so much of it?

SPEAKER_01 17:23

Yeah, yeah, I do. And because it does sound like, well, I mean we've got to do the training for work, and then we've got to figure out how to translate that to person. I mean, it sounds like more work and they're already stressed and busy as it is, but that's kind of like with the advent of artificial intelligence with AI, it becomes so much easier if you can just prompt, just pop in your training and say, This is the training, I'd like to be able to connect with people on a human level, and then have it make the connections, and then you just you just communicate that across the board. So I think that's a super easy way to do it that doesn't acquire doesn't require additional time or effort, maybe just a couple little minutes of typing an extra prompt in. But um and then and then just going back to the personas, just really understanding like these are people that you're working with. How can you, what, what steps can you take, even if it's not within the training itself. Maybe there are other ways that you can incentivize uh the positive aspects of security, like instead of focusing on who clicked on the fishing training exercise, focus on who reported it and realize that everybody's gonna click at some point, everybody's gonna be stressed or whatever. That's not really the point of those trainings. The point of the trainings is to help your employees make you aware of the risks that are entering the environment. And so I think just reframing that focus can help a lot.

Jackie Pelegrin 18:42

I agree. That's really great. I like that. They have every year, it's an annual uh event that they have, and it's uh so IT security will send out these fake type of things where it's like uh and you have to, and if you find it, like a malicious email or link or or attachment or something like that, if you find it and then you report it to IT and they they do it for a whole week. And so it's like Cybersecurity Awareness Week or something, and then they do a contest and they draw your name and you can win a prize. So it's kind of cool. It's like neat.

SPEAKER_01 19:14

Yeah.

Jackie Pelegrin 19:15

So a lot of people take the time to do that, and I've I've won a couple of times, so it's um it kind of brings more awareness to that. It's like, oh yeah, I should do that. Um, and they always put like tips in in that every day of the week, so it's kind of neat. So nice. Yeah, so it's a lot of fun. So I agree. If you can make make it um applicable and bring some fun to it, yeah, I think that really helps too.

SPEAKER_01 19:38

Yeah.

Jackie Pelegrin 19:39

Yeah, absolutely. So I Lee, I wanted to do our bonus question, which I always love doing. So if an instructional

Game Design Advice & Future Plans

Jackie Pelegrin 19:46

designer, educator, or trainer wanted to use game-based learning to teach a complex or serious topic, what advice would you give them based on your experience of creating hack attack defense?

SPEAKER_01 19:58

Yeah, that's a that's a really good question. And it's something that I struggled with a bit. Like the idea of the game had been kind of floating around my head for a couple years, and then taking uh getting my my degree in learning experience design helped, I think, crystallize or or I don't know, w winnow down those just the ideas there. And I and as I wanted to just kind of throw the kitchen sink at it, I wanted everybody to experience everything and have just this just transfer everything in my head into this game and to other people, I realized that's not reality and that honestly the best thing is to focus on one concept and try to get that one con the most important concept across the board. And then, I mean, if I want to down the road, I can create other games that can maybe focus on other aspects of it. But if you can focus on that just on one aspect, then it you may have to um cut out some of the the the fun or or some of the other things that may that you were hoping to include, but it's going to be less of an enjoyable experience if there's too much going on, if there's even just a little bit extra confusion or whatnot. And so I think just working and that took a lot of time to a lot of iterations of taking it to uh people that I would be targeting the game towards and having them play it, so non-security folks that have them experience it and see what they get out of it. And so that took time, that's just lots of lots of iterations to go through. But again, just that keeping it simple, I think was a big key.

Jackie Pelegrin 21:32

Yeah, absolutely. I love that. And I love being able to test it out with individuals, which is what we do quite a bit in training and curriculum design. We try to make sure that we have a test group, right, that we can test it out with and make sure that we do focus groups or something like that too. And after that round, you know, we we talk with them and say, okay, what what was easy, what was hard, you know, what was frustrating for you? And you know, then that way you can find those pain points and and what were the successes too? Because they're you know, there's always room for improvement, but it's nice to know what worked. And then that way you you know, okay, this is good. You know, I need to keep this, and yeah, that's great. Uh I I love that. How many iterations has the game been through? Um, like how many versions have you done since it initially rolled out last year?

SPEAKER_01 22:18

Um I've only had so we've only had the the first print run um that we've done. There's iterations leading up to that, but already right now we're looking at kind of redesigning the visual elements to maybe target a slightly different audience. Um I'm I'm actually creating a uh A follow-up of sorts called Hack Attack Offense. So in this one, you're going to be the attacker and learn how to how you would exploit vulnerable people. So it's just kind of putting you in a different, just looking at security from a different lens. And so I've taken so that that may be just kind of like few like additional iterations on my previous game. Because I'm trying to keep similar mechanics so that it's familiar enough. But I'm I'm trying to figure out, okay, maybe there's a better way to have more engagement in the group or whatnot.

Jackie Pelegrin 23:07

That's really great. I love that. And I think that would be this would be a great game for those that are going into cybersecurity as far as education. You know, if they're because we at the college I teach at Grand Canyon University, we have a cybersecurity program. We have several within there, and they do have a lab for them that they can go in and they can test things out. So, but that would be really fun to maybe I'll um because I I know some people that uh teach for the program. So I'll be like, hey, you should check this out and maybe have it with your your students because a lot of the college kids they love the game-based stuff, right? Um, they resonate with it. So that's really neat. Wow.

SPEAKER_01 23:48

Yeah. That's great. And well, and another so right now I'm also working on creating some facilitator guides so that people can use my game in uh a school, a library, or in a corporate training so that they can play the game, but then have a little bit of extra content to help again kind of solidify some of the educational principles that are are briefly introduced in the game.

Jackie Pelegrin 24:11

Wow. That's great. I love that. You know, and I think that could even work for the AI program that we're introducing too. Um, because like you had mentioned before, AI is such a big part of everything now. And so even with cybersecurity, it's it's changed in the game, hasn't it? Yeah, it really has. Wow. That that's really cool. I love that. I I'll be on the lookout for the the other one. That sounds neat because you want to kind of see what both sides are like, right? Right. Of that. And flip flip the coin a little bit and see what that's like. I like that. Love it. So before we close, Lee, what's one mindset shift you wish more educators, instructional designers, and maybe even organizational leaders would make when it comes to teaching cybersecurity and reducing reducing human risk?

SPEAKER_01 24:59

Yeah, I I think um I may sound like a broken record, but it's it's that that human-focused

Curious & Secure Mindset Shift

SPEAKER_01 25:07

approach. And I'm I'm trying to create my my my personal brand is uh curious and secure. So just kind of just really emphasizing and encouraging a curiosity mindset, a place where it's safe to fail. Like I said, it's okay if you click a link. It's okay if if you miss something, or you maybe you don't get all the you don't pass a quiz on the first time. The goal isn't for you to pass the quiz, the goal is for you to understand what's happening and we want to help you succeed, not try to find a way to get you to exit the the company or whatever. But just really again, just just building that that connection with people.

Jackie Pelegrin 25:49

I like that. I like that mindset shift, yeah. That curious but secure. Yeah, I love that. Because a lot of times it's all about getting to the end, right? And just clicking through. And I think even with uh compliance training, they can do a better job at companies with that, and you know, kind of have that that shift of it because every year we have to do the compliance training, and the and one of them is about IT security. And unfortunately, they don't change it enough to where people are interested in it, and so they're just let's just get to the quiz and get to the end. And I'm like, oh no, they need to switch it up a little bit, give them give people new information, especially now with with everything. So yeah, that's great. I like that. Wonderful. Well, Lee, thank you so much for joining me today and for helping us to think differently about cybersecurity, learning, and even human behavior. This conversation is a great reminder that effective learning is not just about sharing information, it is about helping people practice, make decisions, build confidence, and apply what they learn when it matters most. So for anyone who wants to keep learning from you, Lee, what's the best place to follow you or connect?

SPEAKER_01 26:59

I'm on social media at Curious and Secure is my handle. And then yeah, I also have a website, Leeanderson.net, where you can find more information about what I've been doing. And uh, there's a link to my game on there as well. And I've I've really enjoyed the conversation as well. I appreciate you taking the time today.

Jackie Pelegrin 27:16

Absolutely. Yes, you're always welcome to come back on the show. And if there's anything you want to talk about uh with your game as you develop it or anything like that that you wanted to share when it comes to that learning transfer and the game design itself, um, feel free to get in touch with me and we can have you back on the show. I'd love to d dig a little bit more into that and learn more about what kind of makes that that all happen because it's always exciting. I'm I'm always interested in learning more about game design and and just gaming in general. It's really neat and how you can connect it to what you're what you're doing. So that's really great.

SPEAKER_01 27:51

Yeah, that'd be great.

Jackie Pelegrin 27:52

Wonderful. Thanks again, Lee. I appreciate it.

SPEAKER_01 27:55

Yeah, thank you.

Jackie Pelegrin 27:58

Thank you for taking some time to listen to this podcast episode today. Your support means the world to me. If you'd

Where To Follow Lee & Closing

Jackie Pelegrin 28:05

like to help keep the podcast going, you can share it with a friend or colleague, leave a heartfelt review, or offer a monetary contribution. Every act of support, big or small, makes a difference, and I'm truly thankful for you.