Passworld: A Serious Game to Promote Password Awareness and Diversity in an Enterprise

Authors: 

Gokul Chettoor Jayakrishnan, Gangadhara Reddy Sirigireddy, Sukanya Vaddepalli, Vijayanand Banahatti, and Sachin Premsukh Lodha, TCS Research, Tata Consultancy Services Limited, Pune, India; Sankalp Suneel Pandit, Former employee of TCS Research, Tata Consultancy Services Limited, Pune, India

Abstract: 

Usage of weak passwords for authentication within an organization can be exploited during cyberattacks leading to unauthorized account access, denial of service, data and identity theft, sabotage etc. Such attacks could bring financial and reputational losses apart from legal consequences. Organizational password policies came into being in an attempt to encourage users to create more complex and diverse passwords. However, it has been observed that people show similar behavior in adopting those policies and end up creating passwords with similar patterns. Security training has been found to be a popular mechanism in an enterprise setting, of which, game-based trainings have shown positive impact with an added advantage of being immersive. In this paper, we present a serious game-based training on creating password security awareness among enterprise users. The training involves promoting understanding among users about various common password heuristics during password creation. This study focuses on two research questions: 1) Can a game-based password awareness training teach participants about the various password heuristics? 2) Can such a training improve the organizational password diversity? With a participation of 4,906 employees from our enterprise in the study, we were able to observe effects of game-based training on password awareness. We also found insights during the study to show that users created diverse passwords.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@inproceedings {255650,
author = {Gokul Chettoor Jayakrishnan and Gangadhara Reddy Sirigireddy and Sukanya Vaddepalli and Vijayanand Banahatti and Sachin Premsukh Lodha and Sankalp Suneel Pandit},
title = {Passworld: A Serious Game to Promote Password Awareness and Diversity in an Enterprise},
booktitle = {Sixteenth Symposium on Usable Privacy and Security ({SOUPS} 2020)},
year = {2020},
isbn = {978-1-939133-16-8},
pages = {1--18},
url = {https://www.usenix.org/conference/soups2020/presentation/jayakrishnan},
publisher = {{USENIX} Association},
month = aug,
}

Presentation Video