Trying to make security awareness less dry – does this scenario work as a group activity?

Hi everyone. I’m trying to design a security awareness activity for regular office employees, and I could use a sanity check from people who know learning design better than I do.

The idea is simple: people work in teams, read a short workplace scenario, talk through what they would do, choose an answer, and then the facilitator reads a scripted explanation. The facilitator doesn’t need to be a security expert.

The larger theme is “security awareness through the decades” – technology changes, but the same basic security principles and risky behaviors keep coming back in new forms.

I’d really appreciate feedback on one sample scenario: would this kind of approach create a useful discussion, or would it feel too forced?

-------

SAMPLE SCENARIO

Monday, May 5th, 1986. Your green-screen monitor is humming with static, and the
dot-matrix printer in the corner sounds like a screeching chainsaw. Your computer takes
only two full minutes to boot up.

Your friend Mike, the new junior accountant, slides into your cubicle and proudly shows you
a plastic floppy disk he just got in the mail.

"Look at this," Mike says. "I won a game called Zorkblaster 3000 at a tech convention. You
have the computer, I have the game. Let’s try it out!"

What do you do?

CHOICES

A. Let Mike install the game – he seems to know this stuff.

B. The disk looks professional and the sticker on it seems legitimate – you install the
game.

C. You refuse to use the floppy disk on your office computer and tell Mike it's not a good
idea.

D. Although Mike is a good friend, you ask him to try the game on his home computer first.

CORRECT ANSWER & EXPLANATION

!Correct answer: C!<

!You made the right call. Mike is disappointed, but his enthusiasm and the professional-looking sticker do not make the disk safe. Installing unknown software on an office computer is a risk that simply isn't worth taking – and testing it somewhere else is just moving the risk, not removing it.!<

!Later that day, Mike ignores your warning and tries the disk at home. He calls you with a shaky voice: “My screen says: ‘Your files are deleted. Muahaha!’”!<

!The disk was infected with a virus.!<

!CORE PRINCIPLE: Zero trust!<

!Never automatically trust files, devices, or software just because they look legitimate or come from someone you know. Unknown input is unknown input – whether it arrives as a floppy disk, a USB stick, a browser extension, or a helpful-looking AI recommendation. If you didn’t go looking for it, be suspicious of it.!<

BONUS QUESTION

There is one more security principle hidden in this scenario. Which one?

1. Encryption
2. Social engineering
3. Authentication
4. Least privilege

!BONUS ANSWER: Social engineering!<

!Someone deliberately constructed a believable story – “a prize won at a convention” – to get the disk installed. Mike wasn't the attacker, he was the victim. Social engineering doesn't attack the system, it attacks the person.!<