German SMEs and “Home Office”: Narrative-Driven Game-Based Awareness Raising with Long-Term Efficacy

Abstract

The COVID-19 pandemic triggered a large, sustained shift to working from home. This sudden shift to a new environment rapidly increased the opportunities for cyberattacks on individuals. The employees of small- and medium-sized companies can be seen as a major new target for cyberattacks because cybercrime prevention is often neglected in home offices. Human beings are the current target of cyberattacks as well as the last line of defense, especially when technology fails. Awareness of cyber situations is an essential aspect of managing information security risks. Continuous information security awareness measures targeted to all employees are an existential necessity for companies if they are to develop their digitization successfully. The article illustrates a German project developing an overall scenario with a mix of measures for companies designed to raise such awareness. Analog and digital narrative serious games with interactive and discursive elements focused on the home office are described in detail as a part of the overall scenario. They must be carefully designed and used within a practice-oriented mix for the target groups, so that information security is made tangible and comprehensible. All materials will be made available for noncommercial use in German on the project website by September 2023.