Cracking User Education with a Smokescreen

One of the things I've been discussing lately, is how to successfully educate the users of IT services at the university to consider security a little more. And by "users" I pretty much mean staff. The particular hot topic this week is people responding to spam with their usernames and passwords and then having their account used to send obscene amounts of spam. It seems emails/alerts etc advising them to NEVER give their password out are invisible to some...and like all things, the more we bang on about it the more invisible the campaign becomes.

Which is why I like simulations and games to help people see what happens when they do these things - without having to actually suffer the consequences.

This week, I've been checking out a new game called Smokescreen designed to do just this. It describes itself as:

Smokescreen is a cutting-edge game about life online. We all use Facebook, MySpace, Bebo and MSN to keep up with our mates - and we've all heard the stories about parties on Facebook being mobbed, or people getting stalked on MSN. The question is, what would you do if it happened to you?

For example, in the first challenge you are playing an online game and then encouraged to find out your rock star name made up of your town of birth, full name etc...which then turn out to be the exact security questions required to reset your password for the site which you've just handed over to the (evil!) game designer.

The game feels like it's designed for young teens, and I think it works well as a safe way of exploring the risks of using social networking services etc. The tone and characters wouldn't work well to solve our problem with staff, but perhaps the same approach would. I'm thinking of a cleverly written email to selected staff groups - looking very legitimate and asking them to confirm some basic personal details in order to complete some likely-sounding but fictitious admin task. If they comply, the payoff would be to then send them a scary reply message indicating their account is now open to attack etc. But that this time it wasn't for real...(of course those who don't fall for it get a reply telling them to be smug - this time!)

It could backfire, but would be fun to see who fell for it...?