Unlocking Awareness: Escape Experience made Security Fun

This talk explains how a regional Federal Reserve bank's information security team built a portable "escape room in a box" to make security awareness engaging for staff, many of whom are not technical. The speaker describes the goals behind the project: keep it fun, make it collaborative, avoid requiring prior knowledge, and reach colleagues across branches. The box carried a story in which an AI guards a formula, and players had to prove their security knowledge to open it.

The middle of the talk walks through the puzzles in order. Players sort examples of risky behavior, such as sharing a screen, leaving a laptop unlocked, and ignoring phishing. Later steps include a word search built from definitions, a jigsaw puzzle, a crossword with a transparent overlay, a true-or-false password grid, and a multi-factor step that contrasts something you know with something you have. The last step gives a light introduction to encryption using a simple cipher. Teams divided the work, and the speaker noted that players often found solutions the designers had not planned.

The closing lessons are practical: test the puzzles with pilot groups, make assembly instructions clear, laminate parts so they can be reused, keep groups to four to six people, get leaders to play, and follow up with an email summarizing the key points. The team saw more friendly interaction with colleagues and a strong phishing-test result, though measuring the program's impact more formally remains a goal.