This paper reviews and assesses classical and novel methods and tools towards engaging students and workforce in the concepts of information security and privacy. We investigate the theoretical basis for deploying a game-based approach for security/privacy learning and awareness, and assess state-of-the-art tools and methods that could be used as part of a challenge-based or game-based framework for learning, including serious games, CTF platforms, escape rooms, puzzle/interactive books and Alternate Reality Games (ARGs), while also identifying key-elements and important aspects that should be taken into consideration when designing a security and privacy learning/awareness program. For each of the above approaches and tools’ categories, we highlight their potential for using them for education and awareness of information security and privacy.