Why make it visible
Good security work mostly shows up as nothing happening. That makes it hard to notice and easy to defer. Gamification gives the work a visible result and gives people a reason to return to it.
Four elements
- Role-specific competitions. Challenges and achievements are matched to roles, so people compete with peers who have similar responsibilities.
- Team challenges. Teams compete as well as individuals, which builds shared ownership of the outcome within a department or group.
- A flexible point system. People earn points for completing activities, improving security posture and contributing to the organization's goals. Leaderboards and progress dashboards show the totals.
- Rewards the organization chooses. Each organization decides what points are worth: recognition, privileges or something tangible.
Fair comparison
Competition motivates when it is between peers. Teams differ in size and in the number and complexity of the resources they manage, so raw totals favor some and discourage others.
It is usually fairer to compare each team with its own past, looking at how far it has moved more than at where it stands.
Guarding against gaming
Any point system can be gamed. Reward improvements in posture as well as activity, so that points follow real progress. Watch for behavior that earns points without doing good, such as reassessing a resource far more often than it needs.
What it produces
Done well, gamification creates friendly competition and a sense of shared effort. Security starts to look like a way for anyone, in any role, to make a difference to the organization.
Gamification is one of the five principles of participation. The Five Principles of Participation sets it beside the other four.