SOT

SOT

SOAR
Security Orchestration, Automation and Response

Automation of response to information security incidents using dynamic playbooks and information security tools, building an attack chain and with an object-oriented approach

NG SOAR
Next Generation SOAR

Automation of response to information security incidents with built-in basic correlation (SIEM), vulnerability Scanner (VS), collection of raw events directly from information security tools, dynamic playbooks, building an attack chain and an object-oriented approach. AM and VM are included

AM
Asset Management

Description of the IT landscape, detection of new objects on the network, categorization of assets, inventory, life cycle management of equipment and software on automated workstations and servers of organizations

VS
Vulnerability Scanner

Scanning information assets with enrichment from any external services (additional scanners, The Data Security Threats Database and other analytical databases) to analyze the security of the infrastructure.

VM
Vulnerability Management

Building a process for detecting and eliminating technical vulnerabilities, collecting information from existing security scanners, update management platforms, expert external services and other solutions

FinCERT
Financial Computer Emergency Response Team

Bilateral interaction with the Central Bank, namely the transfer of information about incidents and receipt of prompt notifications/bulletins from the regulator

GovCERT
Government Computer Emergency Response Team

Bilateral interaction with the state coordination center for computer incidents, namely the transfer of information about incidents and receipt of prompt notifications/bulletins from the regulator

Mail us to sales@securityvision.ru or get demo presentation

Gamification and human resource management

Gamification and human resource management
18.07.2024

  |  Слушать на Google Podcasts  |   Слушать на Mave  |   Слушать на Яндекс Музыке  |  


Eva Belyaeva, Security Vision


Introduction


In the last article, we considered gamification as applied to the IS sphere, taking into account the relevant specifics. Now we would like to discuss something that already exists in some form in many companies, which may not only relate to IS, but still use game methods in their work. What are these games, what are they used for?


Games in the work process


Aims and tasks of games


Let's start with why we need to translate formalised processes inside the company into a game format. In some cases, the process needs to be either accelerated or simplified (for the employee). When it comes to explaining something to an employee quickly and easily, the individual approach can be formalised and presented in game form.


The game can also be used for the purpose of additional motivation and feedback from colleagues or superiors (a positive performance evaluation will be perceived in a more positive way, and a negative one - in a less negative way). Let's look at this in a little more detail using examples.


Originally, when games in the workplace were only heard of, it was about teaching employees something new by letting them try on new roles in a simulated work situation.


A game can also be used to diversify the work process (this is also more about motivation) and to get more out of their work and routine tasks.


If you combine all the goals to create one game, you will get a full-fledged system of searching for signs of early burnout in employees, tracking emotional and working background during communication between employees, cross-evaluation and much more.


What is interesting is that at the moment games are used only ‘for the good’ and have exclusively positive reinforcement for the user. At least, we haven't encountered the opposite.


Where games live


Different companies in different fields use different patterns to implement gaming; however, some of them are similar and we can group them into certain groups.


Let's first look at the need to implement games in general. How workflow changes to move away from formal presentation depends on several factors:


- The sphere of the company's activity - for example, banks and telecoms have different approaches; their processes, relevant only among themselves, are among the first to acquire a gamified form (for example, the introduction of this element in banking applications or internal games for the sales of mobile phone handsets).


- Formalisation of internal processes - sometimes game techniques are implemented everywhere, and sometimes - selectively in hiring/firing processes, as they require increased attention due to the large number of employees going through them.


- The need to develop employee's skills in the absence of more complex tasks - then such tasks are simulated in game form and can at least prepare a person for solving similar problems in the future.


- As the team grows, it becomes more and more difficult for a manager to monitor in real time the general state of subordinates; it is easy to miss the first signs of burnout or disappointment in the company.


- Games for the sake of games. Routine processes, including those that are impossible, difficult or expensive to automate, may be easier to present in a game format.


Let's look at the most popular activities from those that have already been implemented in companies.


Types of games


Games for new employees


When a new person, even a very competent one, comes to the workplace, the biggest challenge for him/her is the established internal processes of the company.


Who to address, who to ask questions to correctly - all this without games can be obtained in several ways:


- Addressing HR. Yes, this may be the custom in the company, especially if the company is small. But there may be many departments, and each has its own specifics, and there is not enough HR for all of them.


- Referring to your manager or mentor. This is a classic story, in which a manager or a more experienced employee guides newcomers through the process already worked out in the department (including answers to all questions may be ready in advance and described in some Wiki). But you still won't get rid of all the questions.


- Ask colleagues. The most probable answer is honest and corresponding to reality, but the work will not do itself and it will not be possible to distract people so often.


Many companies (for some reason, most often the banking sector) already have games for newcomers, which are built as a quest to reach the top, where the highest point is passing the probationary period.

 

рис 1.jpg

 

Also together with the game or separately, the employee gets access to a chatbot, which will just answer any questions, whether it's a holiday or an escalation of work tasks.


Achievement items motivate the employee to do basic things: sign all necessary papers, watch a video about awareness or get to know certain colleagues.


The milestone game for current employees


Here, according to our internal statistics, colleagues from the telecom sector are ahead of everyone else. Outwardly, the game is somewhat similar to the previous one, except that it never ends (unless you quit, of course).


Such games contain all the HR processes that are repeated throughout the year, in which an employee is involved: holidays, safety and other training, awareness-raising and other things.


Although everyone needs to participate in these activities without exception, the games have a competitive element and rewards if everything is done on time.


Character development


This type of games can be both a motivational part of the previous one and an independent element of daily work, introduced ‘next to’ the other processes.


  • Points from colleagues or for completing tasks. Nowadays you can find many places where you can find the use of the company's game currency in order for employees to either measure their rating or buy some merchandise for a ‘thank you’ for the fulfilled request.

  • Quizzes with prizes. From time to time, employees are asked to answer a question that is somehow related to the company or their direct job. On the one hand, it's another way to score points, and on the other hand, it's an opportunity to take your mind off the flow and relax a bit during the working day.

  • Level up in soft skills - you can raise your level in something that is often difficult to formalise. For example, when it comes to hard skills, you can track your development in them with the help of certificates or simply by adding a new system or programming language to your CV. But it is somewhat difficult to objectively assess business communication, creativity, adaptability and teamwork skills. Or it can be done by a person from the HR team, but it is labour-intensive. Then a game format with feedback from several colleagues at once comes to the rescue.

  • Format of internal notifications - because of the external similarity to achievements in video games, achivements-notifications can both give a sense of achievement and simply inform the employee about an element of the workflow.

The process of firing an employee


Funnily enough, in one of the companies I dealt with, it was the process of firing an employee that was gamified instead of the onboarding process.


In general, maybe it is right, because here in a short period of time (and it's not always two weeks), you have to have time to prepare a number of important documents, not to forget anything and not to mess up anywhere. In places where it is put on a stream - and this is not about companies, but about, for example, universities, where students graduate in large numbers - such a process is simply necessary.


Instead of a sheet with room numbers and a list of documents or other documents, the employee receives an app, which is also available to the responsible persons, who can immediately mark and confirm the pass, equipment and the rest.


Team building games


Games within an established team can be ‘analogue’, which doesn't make them any worse than a full mobile or desktop game. Team building is often not part of the job, but regular, on-site or off-site events that aim to build trust between team members.


However, some elements of team building are also built into work processes and everyday tasks, for example, brainstorming sessions in front of a complex engineering task can be structured to feel more like a game than a job.


Business games


Business games are the game format most familiar to experienced employees. What's interesting is that this format is not only used in training for adults with jobs, but also for school children and students - a mock courtroom or political debate is often conducted as part of the learning process where participants try on different roles.


Similarly, business games allow you to put yourself in the shoes of a supplier or a customer, a director or a subordinate. You can be a marketer or a creative while actually being someone else.


Such games are used either to bridge differences, to understand the value and artefacts of another profession, or to prepare and train a person for their new role (e.g. when an ordinary employee becomes a manager or when an L3 SOC analyst needs to be prepared for sophisticated attacks).


The bottom line


As companies grow and evolve, gamification is becoming an integral part of processes. It will likely become the new standard of operation in the near future.


The benefits that come with implementing games into the workflow can be measured on one hand (e.g., the speed of a new employee's immersion into processes) and received in the form of feedback from employees on the other.

Recommended

Security Vision Compliance Management capabilities
Security Vision Compliance Management capabilities
The IT/IS interface: defence tools
The IT/IS interface: defence tools
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #9 ‘Communicate, Interact, Share Information’
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #9 ‘Communicate, Interact, Share Information’
The role of the cyber polygon in IS assurance
The role of the cyber polygon in IS assurance
Current cybersecurity trends in 2021
Current cybersecurity trends in 2021
The Three Elephants of Windows Logging
The Three Elephants of Windows Logging
The ethical hacker and his role in security
The ethical hacker and his role in security
New capabilities of TIP, SGRC, IRP/SOAR, UEBA and Anomaly Detection on the Security Vision 5 platform
New capabilities of TIP, SGRC, IRP/SOAR, UEBA and Anomaly Detection on the Security Vision 5 platform
Raising awareness on IS issues
Raising awareness on IS issues
Review of NIST Publication SP 800-128 "Guide for Security-Focused Configuration Management of Information Systems"
Review of NIST Publication SP 800-128 "Guide for Security-Focused Configuration Management of Information Systems"
FSTEC Threat Model
FSTEC Threat Model
Container security at a new level: diving into Trivy
Container security at a new level: diving into Trivy

Recommended

Security Vision Compliance Management capabilities
Security Vision Compliance Management capabilities
The IT/IS interface: defence tools
The IT/IS interface: defence tools
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #9 ‘Communicate, Interact, Share Information’
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #9 ‘Communicate, Interact, Share Information’
The role of the cyber polygon in IS assurance
The role of the cyber polygon in IS assurance
Current cybersecurity trends in 2021
Current cybersecurity trends in 2021
The Three Elephants of Windows Logging
The Three Elephants of Windows Logging
The ethical hacker and his role in security
The ethical hacker and his role in security
New capabilities of TIP, SGRC, IRP/SOAR, UEBA and Anomaly Detection on the Security Vision 5 platform
New capabilities of TIP, SGRC, IRP/SOAR, UEBA and Anomaly Detection on the Security Vision 5 platform
Raising awareness on IS issues
Raising awareness on IS issues
Review of NIST Publication SP 800-128 "Guide for Security-Focused Configuration Management of Information Systems"
Review of NIST Publication SP 800-128 "Guide for Security-Focused Configuration Management of Information Systems"
FSTEC Threat Model
FSTEC Threat Model
Container security at a new level: diving into Trivy
Container security at a new level: diving into Trivy

Other articles

How to manage a flock of sheep with one dog, or current approaches to configuring network equipment
How to manage a flock of sheep with one dog, or current approaches to configuring network equipment
Threat analysis and cyber intelligence: what problems the updated Security Vision TIP solves
Threat analysis and cyber intelligence: what problems the updated Security Vision TIP solves
What Kerberos authentication is, what NTLM is and how they work
What Kerberos authentication is, what NTLM is and how they work
Information security trends. Part 2
Information security trends. Part 2
Features of the new versions of UEBA and Anomaly Detection products on the Security Vision 5 platform
Features of the new versions of UEBA and Anomaly Detection products on the Security Vision 5 platform
Review of NIST Publication SP 800-128 "Guide for Security-Focused Configuration Management of Information Systems"
Review of NIST Publication SP 800-128 "Guide for Security-Focused Configuration Management of Information Systems"
MITRE's publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #10 ‘Apply performance metrics to improve SOC performance’
MITRE's publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #10 ‘Apply performance metrics to improve SOC performance’
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #2 ‘Ensure the SOC has the authority it needs to fulfil its mission’
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #2 ‘Ensure the SOC has the authority it needs to fulfil its mission’
Directory of Information Security Legislation of the Russian Federation
Directory of Information Security Legislation of the Russian Federation

Other articles

How to manage a flock of sheep with one dog, or current approaches to configuring network equipment
How to manage a flock of sheep with one dog, or current approaches to configuring network equipment
Threat analysis and cyber intelligence: what problems the updated Security Vision TIP solves
Threat analysis and cyber intelligence: what problems the updated Security Vision TIP solves
What Kerberos authentication is, what NTLM is and how they work
What Kerberos authentication is, what NTLM is and how they work
Information security trends. Part 2
Information security trends. Part 2
Features of the new versions of UEBA and Anomaly Detection products on the Security Vision 5 platform
Features of the new versions of UEBA and Anomaly Detection products on the Security Vision 5 platform
Review of NIST Publication SP 800-128 "Guide for Security-Focused Configuration Management of Information Systems"
Review of NIST Publication SP 800-128 "Guide for Security-Focused Configuration Management of Information Systems"
MITRE's publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #10 ‘Apply performance metrics to improve SOC performance’
MITRE's publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #10 ‘Apply performance metrics to improve SOC performance’
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #2 ‘Ensure the SOC has the authority it needs to fulfil its mission’
MITRE publication ‘11 Strategies for a World-Class SOC Centre’. Strategy #2 ‘Ensure the SOC has the authority it needs to fulfil its mission’
Directory of Information Security Legislation of the Russian Federation
Directory of Information Security Legislation of the Russian Federation