Alireza Shojaifar
email: a.shojaifar@uu.nl

Samuel A Fricker
email: samuel.fricker@bth.se

Martin Gwerder

Automating the Communication of Cybersecurity Knowledge: Multi-Case Study

Keywords: Cybersecurity, Small and Medium-sized Businesses, Capability Assessment and Improvement, Do-It-Yourself, Multi-Case Study

Cybersecurity is essential for the protection of companies against cyber threats. Traditionally, cybersecurity experts assess and improve a company's capabilities. However, many small and medium-sized businesses (SMBs) consider such services not to be affordable. We explore an alternative do-it-yourself (DIY) approach to bringing cybersecurity to SMBs. Our method and tool, CYSEC, implements the Self-Determination Theory (SDT) to guide and motivate SMBs to adopt good cybersecurity practices. CYSEC uses assessment questions and recommendations to communicate cybersecurity knowledge to the enduser SMBs and encourage self-motivated change. In this paper, the operationalisation of SDT in CYSEC is presented and the results of a multi-case study shown that offer insight into how SMBs adopted cybersecurity practices with CYSEC. Effective automated cybersecurity communication depended on the SMB's hands-on skills, tools adaptedness, and the users' willingness to documenting confidential information. The SMBs wanted to learn in simple, incremental steps, allowing them to understand what they do. An SMB's motivation to improve security depended on the fitness of assessment questions and recommendations with the SMB's business model and IT infrastructure. The results of this study indicate that automated counselling can help many SMBs in security adoption.

Introduction

Small and medium-sized businesses (SMBs) as the foundation of the EU's economy [START_REF] Muller | Annual report on European SMEs 2016/2017: Focus on self-employment[END_REF] are the weakest spot for cyber-attacks [START_REF] Caldwell | Securing small businessesthe weakest link in a supply chain?[END_REF][START_REF] Ntouskas | A Collaborative System Offering Security Management Services for SMEs/mEs[END_REF]. SMBs have specific characteristics, and these characteristics separate them from large companies and make them highly vulnerable to security attacks [4,5,6 ,7]. The lack of financial resources, expertise, written formal security policies, and also the common wrong attitude towards security and risks are some of these characteristics. Previous studies considered these characteristics and their influences on SMBs' resilience to security threats [START_REF] Ntouskas | A Collaborative System Offering Security Management Services for SMEs/mEs[END_REF][START_REF] Valli | Small to Medium Enterprise Cyber Security Awareness: an initial survey of Western Australian Business[END_REF][START_REF] Brunner | Towards Automation in Information Security Management Systems[END_REF][START_REF] Furnell | A prototype tool for information security awareness and training[END_REF].

Ntouskas et al. [START_REF] Ntouskas | A Collaborative System Offering Security Management Services for SMEs/mEs[END_REF] present a self-management security method which provides a consultancy environment for SMBs. Brunner et al. [START_REF] Brunner | Towards Automation in Information Security Management Systems[END_REF] focus on the level of automation in information security management and describe a continuous, risk-driven, and context-aware information security management system. Their framework is applicable to SMBs [START_REF] Brunner | Towards Automation in Information Security Management Systems[END_REF]. Furnell et al. [START_REF] Furnell | A prototype tool for information security awareness and training[END_REF] present a self-paced, flexible, and personalised security training software tool. The tool provides employees with the ability to learn some security countermeasures and desired behaviours.

In our experience of working with SMBs that were active in the IT industry, we found out that access to knowledge is not enough for motivating the SMBs to adopt appropriate behaviour. The SMBs need to understand the severity of threats and the impacts on their businesses. Moreover, providing hands-on skills that are consonant with the SMBs' capability motivates them to have security practices. We have not found any approach that considers the SMBs' motivation in the adoption of cybersecurity through self-assessment, learning, and improvement. Technical security measures form a large part of information security research [START_REF] Dhillon | Value-focused assessment of information system security in organizations[END_REF]. Cybersecurity is more effective if the attention goes beyond the technical protecting means to the users, social, and organisational environment [START_REF] Dhillon | Value-focused assessment of information system security in organizations[END_REF][START_REF] Cranor | A framework for reasoning about the human in the loop[END_REF][START_REF] Pahnila | Employees' Behavior towards IS Security Policy Compliance[END_REF]. Human errors are the main cause of security failures [START_REF] Cranor | A framework for reasoning about the human in the loop[END_REF] and promoting users' self-efficacy, and knowledge in information security can enhance organisation security [START_REF] Rhee | Self-efficacy in information security: Its influence on end users' information security practice behavior[END_REF].

CYSEC is a self-paced SMB-specific training and assessment method that automates elements of a counselling dialogue [START_REF] Shojaifar | Elicitation of SME Requirements for Cybersecurity Solutions by Studying Adherence to Recommendations[END_REF] between a security expert and employees in the SMB to ward off cyber threats. The interaction and dialogue between employees and security experts bridge the gap between them and makes the information security measures more effective [START_REF] Albrechtsen | The information security digital divide between information security managers and users[END_REF]. Since users' resistance to accepting security tools and advice is one of the main problems for information security [START_REF] West | The psychology of security[END_REF], the dialogue in CYSEC is based on theoretical foundations of motivation and the effects of employees' psychological needs on cybersecurity adoption. Persuasion is more effective than rational training strategies when the level of commitment to change is low [START_REF] Hayes | The theory and practice of change management[END_REF].

The current study focuses on CYSEC evaluation to see whether the CYSEC is useful and effective as a method of communicating cybersecurity expertise for enabling DIY cybersecurity assessment and capability improvement for SMBs. The study purpose was approached by using an observation strategy based on the think-aloud protocol. While the previous literature mainly studies individuals' security behaviour through several interviews [START_REF] Albrechtsen | The information security digital divide between information security managers and users[END_REF][START_REF] Menard | User Motivations in Protecting Information Security: Protection Motivation Theory Versus Self-Determination Theory[END_REF][START_REF] Pham | Information Security and People: A Conundrum for Compliance[END_REF], the empirical findings of this study are based on observing actual usage of the tool to determine those factors which facilitate or control users' behaviour. The data was qualitatively analysed based on our theoretical model derived from Self-determination Theory (SDT) [START_REF] Ryan | Self-Determination Theory and the Facilitation of Intrinsic Motivation, Social Development, and Well-Being[END_REF][START_REF] Deci | Self-determination theory: A macrotheory of human motivation, development, and health[END_REF]. Our results demonstrate that SDT can explain motivational factors for effective counselling communication, and these factors influence users' behaviour to adopt cybersecurity recommendations. Unmet psychological needs may hamper users' adoption of cybersecurity behaviours. We observed that the automated dialogue is more effective when the method offers adapted behaviour, users' self-efficacy improvement, and SMBs' confidentiality issues together.

The remainder of the paper is structured as follows. Section 2 presents the theoretical background. Section 3 describes the CYSEC method. Section 4 describes the design of the study. Section 5 presents the process of data collection in SMBs. Section 6 analyses the results and answers the research questions. Section 7 discusses the significance of the results and the threats to validity. Section 8 summarises and concludes.

Theoretical Background

Cybersecurity studies draw on a variety of theories from different disciplines [START_REF] Menard | User Motivations in Protecting Information Security: Protection Motivation Theory Versus Self-Determination Theory[END_REF][START_REF] Pham | Information Security and People: A Conundrum for Compliance[END_REF]. Self-Determination Theory (SDT) [START_REF] Ryan | Self-Determination Theory and the Facilitation of Intrinsic Motivation, Social Development, and Well-Being[END_REF] provides a rigorous theoretical framework for studying motivation and has been considered in cybersecurity [START_REF] Menard | User Motivations in Protecting Information Security: Protection Motivation Theory Versus Self-Determination Theory[END_REF][START_REF] Pham | Information Security and People: A Conundrum for Compliance[END_REF]. SDT describes and explains people's psychology of being self-motivated for adopting personal behaviours [START_REF] Ryan | Self-Determination Theory and the Facilitation of Intrinsic Motivation, Social Development, and Well-Being[END_REF]. SDT was developed and evaluated with extensive research that resulted in an in-depth understanding of the conditions under which people will develop towards being a self-motivated in pursuing what they and their community consider as being desirable. The results of the research help managers and coaches to bring meaningful norms of behaviour into use and support the concerned people in adopting the conduct. Self-motivation concerns goal-orientation, energy, and persistenceall related to producing results. If a goal is perceived to be important, the concerned person will start adapting his or her behaviour and be persistent to the extent that the behavioural change will sustain. According to SDT, a person will be self-motivated if these psychological needs have been satisfied: competence, autonomy, and relatedness. A lack of perceived competence, or self-efficacy, will lead the person to give up. Autonomy is important as the free choice determines how convinced the person is about the behaviour to be adopted. Relatedness to a person who acts as a role model for the behaviour can reinforce the self-motivation and even offer a template of how to adopt the behaviour.

Both intrinsic and extrinsic motivation leads to the adoption and internalisation of new behaviour. However, the more intrinsic the motivation is, the more effective and sustainable the adoption of the behaviour is. For each type of motivation, several forces influence how people are moved to act. People can feel motivated because they value an activity, e.g., by an abiding interest. People with such intrinsic motivation have interest, excitement, and confidence, which manifests as enhanced performance, persistence, and creativity. People under external coercion, e.g. with a bribe, fear of being surveilled, or other external pressure, are risking to be unwilling and unmotivated. Still, people can be externally motivated by a stimulating personal commitment to excel and offering role models' recognition. Table 1 shows, for the continuum from intrinsic motivation to amotivation, how behaviour may be influenced. Any method for helping users to achieve goals should operationalise these factors in the method's design.

Table 1 is pointing to the important SDT constructs that should be operationalised by a coaching method. It suggests hypotheses that can be used for evaluating whether the method supports the effectiveness of the cybersecurity knowledge communication for SMBs. The constructs concern attributes of the method user and environment with which the user interacts. The method user's attributes characterise the user's desired behaviour, self-efficacy, and autonomy. The method environment's attributes are relatedness, belonging, and connectedness offered to the user, pressure imposed through rewards, threats, and deadlines, the knowledge provided for helping the user to develop self-efficacy, and choice offered for fostering autonomy of the user. Table 1. Factors for influencing desired behaviour, based on SDT.

Motivation

How Desired Behaviour is Influenced Intrinsic motivation: a person with interested and joy in desired behaviour tends to seek out novelty and challenges, to explore, learn, and exercise one's capacities even in the absence of specific rewards.

Autonomy of choice, perceived competence or self-efficacy, and a caring environment with optimal challenges and feedback of how the person's actions lead to the outcomes enhance intrinsic motivation and performance [START_REF] Deci | The General Causality Orientations Scale: Self-determination in personality[END_REF]. Extrinsic rewards, threats, deadlines, pressured evaluations, and imposed goals diminish intrinsic motivation. Extrinsic motivation: continuum from coercion to stimulating intrinsic motivation:

With prescribed behaviours and values, new behaviour is internalised with meaningful rationales, autonomy, and relatedness [START_REF] Deci | The General Causality Orientations Scale: Self-determination in personality[END_REF]. External regulation is achieved with salient rewards or threats. Introjected regulation is achieved with the provision of belonging and connectedness, e.g. by having significant others to whom people feel attached or related prompt, model, endorse, or value the desired behaviour. Regulation through identification can only be achieved if autonomy of choice is provided. To integrate a regulation, the rules' meaning must be synthesised with respect to the person's goals and values with great autonomy in the sense of choice, volition, and freedom from excessive external pressure.

A) External regulation is associated with control or alienation, and actions are perceived imposed by external regulators B) Introjected regulation is not accepted as the one's own, but behaviours are performed to maintain a feeling of worth, e.g. to avoid guilt or anxiety or attain pride C) Regulation through identification: conscious valuing and acceptance of rules as being personally important D) Integrated regulations: fully assimilated as a result of evaluation and brought into congruence with one values and needs Amotivation: lacking the intention to act due to coercion, leading to failed goal achievement.

Amotivation is resulting from not valuing an activity, not feeling competent to do it, or not expecting the activity to yield desired outcome.

CYSEC, a DIY Cybersecurity Improvement Method

CYSEC is a method and tool allowing SMBs' Chief Information Security Officer (CISO) to improve cybersecurity in a do-it-yourself fashion. The method guides the CISO in following Deming's plan-do-check-act (PDCA) [START_REF] Deming | Elementary principles of the statistical control of quality[END_REF] cycles of selecting sensible security themes, implementing a recommended practice, checking progress, and adapting based on lessons-learned. The tool offers memory allowing the CISO to continue the PDCA work where he left off. The tool also includes design elements based on SDT that aim at offering motivation for effective results and sustainability of the improvements. Fig. 1. shows the two main interfaces offered to the user. A dashboard offers the features (1) recommendations for next improvements, (2) access to capability areas for PDCA work, (3) summary information about the company progress. Once the PDCA work for a given capability area is started, e.g. by choosing a recommendation or a capability area, the user enters the work area that offers the features (4) self-assessment, (5) access to expert knowledge, and (6) action cockpit for creating calendar entries, emails, and reminders. Table 2. describes how CYSEC operationalises SDT. Recommendations are generated based on users' answers to the self-assessment questionnaires for maturity improvement [START_REF] Ozkan | A questionnaire model for cybersecurity maturity assessment of critical infrastructures[END_REF]. For the first time, new users will see one recommendation to fill out the company coach. As an adaptation rule, the answers to the company coach affect the questions asked in the other coaches. After completing the company coach, several coaches will be active in the dashboard. The available capabilities are defined and prioritised based on the cybersecurity expert's propositions (third author). When a user selects one coach, s(he) has access to the self-assessment questions and relevant capability training content. Providing the content was based on the research into the training material [START_REF] Gardner | Building an Information Security Awareness Program: Defending Against Social Engineering and Technical Threats[END_REF], technical reports provided by Symantec and Ponemon, and meeting with experts. Technical reports provide updated cybersecurity solutions and statistics. At the end of each coach, users see summary information and are redirected to the dashboard. In the dashboard, they see the progress information, achieved scores, and new recommendations for cybersecurity practices and selection of the next coach(es).

Study Design

The study aimed at evaluating whether CYSEC is useful and effective as a method of communicating cybersecurity expertise for enabling DIY cybersecurity assessment and capability improvement for SMBs. To achieve this aim, we designed a deductive multi-case study and used observation as the main method for data collection [START_REF] Yin | Case study research:design and methods[END_REF]. Case studies are common in information systems research and cybersecurity [START_REF] Pham | Information Security and People: A Conundrum for Compliance[END_REF].

For planning the case study, a study protocol was developed and sent to the participating SMBs. Before conducting the case studies, a pilot workshop was performed for a start-up project that involved the second and third researchers and a developer. The pilot allowed to identify and resolve initial problems in the study design. The selection of the cases was based on the availability of the SMBs. It has been done in two steps. At first, data collection was based on four SMBs, and during the study (project lifetime), two more SMBs were included. Based on Yin [START_REF] Yin | Case study research:design and methods[END_REF], when using a multiple-case design, the number of case replications is essential instead of sampling logic, and the model of generalisation is analytic generalisation when we have a developed theory as a template. The selected SMBs have security resources, working in the software industry, and their CISOs have a level of expertise in security. The CISOs' behaviour was the unit of analysis. Table 3 presents our SMBs' demographics. Based on the EU Commission definition, companies with < 50 employees and annual turnover ≤ €10 million are small, and those with < 250 employees and annual turnover ≤ €50 million medium.

Research Questions and Case Selection

The following two research questions were analysed. RQ1 related the communication method to the user's motivation and adoption of cybersecurity recommendations. RQ2 reflects users' evaluations of the method and tool after the actual usage.

RQ1: How do the CYSEC dashboard and work area features influence the effectiveness of communicating cybersecurity to motivate users' adoption of desired behaviour?

To improve SMBs' cybersecurity capability, they need to adopt good cybersecurity practices. Since CYSEC provides security experts' recommendations and training content, we are studying SMBs' security adoption through CYSEC communication. The factors of the study are based ont he SDT constructs and CYSEC features in Table 2. We evaluate the effectiveness of communication by observing users' behaviour, attention, comprehension, and theoretical cause-effect relationships [START_REF] Yin | Case study research:design and methods[END_REF]. RQ2: Do the SMB human end-users perceive CYSEC to be acceptable and useful as a tool assisting DIY cybersecurity assessment and improvement? Tool acceptance and perceived usefulness are significant for us since a problem for information security is the users' resistance to accepting security tools [START_REF] West | The psychology of security[END_REF]. Therefore, in RQ2, we want to have the users' attitude.

Workshop Design and Meeting with Companies

Each workshop started with an explanation of the study, steps, and relevant objectives.

To collecting honest responses [START_REF] Bennett | Development of a measure of workplace deviance[END_REF], the researcher emphasised that the collected data would be applied anonymously for academic purposes and then obtained the subjects' consent. During the workshops, the researcher took notes about how the subjects interacted with the tool and asked them to "think aloud" [START_REF] Runeson | Case Study Research in Software Engineering: Guidelines and Examples[END_REF] and explain their expectation.

The workshops had four parts and four tasks for the CISO in the SMB. In part 1, the CISOs characterised their companies. In part 2, and to understand the main user's capabilities, the CISOs answered three questions about their level of education, experience in cybersecurity, and their roles. The responses to the questions were used to confirm the suitability of the selected case for the study. In part 3, the user applied the CYSEC. In part 4, the observation was supplemented with a post-observation quantitative questionnaire (Table 4). The result section presents the process of the workshops.

Results

In this section, we present the process of data collection in the 1-day workshops. Company 1: two people (CISO) participated in the workshop, which took 26 minutes. This workshop took a short time since the users only provided their feedback at the end of the workshop. The researcher had the lowest degree of interaction in this workshop. It seems they were familiar with the topics and questions, so they refer to the training content only two or three times.

Company 2: Two people from a team of cybersecurity participated. The workshop took one hour and forty-three minutes. The users referred to the training content several times when they were not able to understand the actual goal of the questions. The users stated that the training content for some questions is not completely correct.

Company 3: Only one person (CISO) participated. The workshop took two hours and thirty-five minutes. The user explained that their SMB had not managed any cybersecurity training courses and security awareness issues are usually sent to the employees by email. During the workshop, the user experienced several system time-outs. So, the user required to log in several times. This issue was due to a bug in the tool, and it distracted the user's attention to some extent. So, the researcher needed to interact with the user. For this SMB, confidentiality issues were very critical.

Company 4: A team of seven IT specialist participated. The workshop took two hours and a half. The users went through the coaches the same as the first workshop. The distinctive feature of this workshop was the discussion about each question between participants to find suitable answers based on the company's requirements. The users applied training content too much to understand the questions. For this SMB dynamic, and reliable training material was significant.

Company 5: Only one person (CISO) participated. The workshop took thirty-four minutes. The user stated that their SMB has no chain of management. In this workshop, the user emphasised that some of the questions have no suitable options for the answer.

Company 6: Two people from a team of cybersecurity participated. The workshop took forty minutes. People in the workshop had a language problem, and they used Google translate to understand the content. So, the researcher needed to interact with the users. The users went through some of the coaches.

In all workshops, the mechanism of the tool usage was almost the same and the users referred to the training content mostly when they had a problem to understand questions. The meaning of some of the questions was not clear for the CISOs. Also, all of them required a summary and recommendation after finishing each coach.

Analysis

For answering the research questions, we explain the researcher's observations of the tool usage based on SDT-specific features of the CYSEC, which indicated in Table 2.

Factors Influencing Cybersecurity Communication (RQ1)

According to the workshop results, the CYSEC dashboard and work area features affected the users' motivation for the adoption of desired behaviour. These features together can facilitate security management and inter-organisational connection between the CISO and the employees and support self-efficacy and capability improvement in the SMBs. The participating SMBs learned about cybersecurity and adopted practices and controls when the immediate perceived learning experience was good.

Available Expert Knowledge (CYSEC Work Area).

As suggested by SDT, we have observed that improving self-efficacy had a positive impact on the users' selfmotivation. The immediate relevance of the training material provided by the CYSEC tool affected the subjects' decision to study the training material. Still, even though the participants did not have any systematic cybersecurity course so far, none of them read the full knowledge texts provided by CYSEC. Instead, the subjects studied training material when they did not understand a question or wanted to know more about a topic to select suitable answers. Company 4: "We need practical instructions and steps to help us solve our issues and not general ideas." Company 2: "some materials are not relevant to the right topics/questions." When responding to some of the questions, they referred to the training content occasionally and only to find a specific issue. For instance, to explore how they can measure the strength of password based on a tool.

Perceived reliability, expert support, clarity, and local language support of the content were important in the sense that the lack of these quality attributes hindered participants from accepting training input. Company 4: "Parts of the content are not clear enough for us, and some materials (statistics) are not reliable since they are not covering many security experts and SMBs' opinions." Company 2: "Training content needs to present the severity of threats clearly." Company 2: "Since the coaches are in English, it might be possible for some SMBs to be unwilling to apply the tool." Company 6: "Can you please tell me what actually you mean [even after using Google translate for the training content]." The quotes here can demonstrate the users' awareness and attention to the training content with respect to the effectiveness of the communication.

Assessment Questions for Next Step Improvement (CYSEC Work Area). As suggested by SDT, choice supported autonomy and self-motivation. However, the options should always be relevant and adapted to the IT infrastructure and operations of the company. The participants looked for questions that fit their interest and perceived needs. If they could not find such questions, they explained their needs by referring to their company's characteristics (assets). Moreover, they wanted the coach to adapt the questions to the SMB's characteristics specified with preceding answers. Company 3: "here, the tool should provide a lot of questions to cover different operating systems."

Also, the users wanted each question to be answerable with options for the response that explained the situation precisely. The researcher observed that the users did not answer some questions or selected an imprecise option due to lack of suitable choices.

Company 2 about the question "Do your users use any other authentication method, such as fingerprint or 2-factor authentication, to control access to your sensitive systems:" "for some systems yes, for some systems and users no. I cannot answer properly, so I select the answer [Yes, for some systems]." Company 5: "I need an option between yes and no." The quality of the questions also influenced the efficiency of the users. Some of the questions were perceived to be confusing. When being confronted with such questions, the participants looked for training content, searched the Internet for the topic, or asked the researcher for clarification. Company 4: "some of the questions are confusing and not clear enough for us." Company 2: "I could not understand if the question is related to servers or employees' computers." The quotes here can demonstrate the users' comprehension and their ability to answer the assessment questions. Their behaviours and comments refer to the effectiveness of communication.

Action Cockpit (CYSEC Work Area). As suggested by SDT, we have observed that respect of the belonging within the organisation is important. While the CISOs answered most training and awareness questions, they communicated with their colleagues to find the answer for some of the questions. The CISO in Company 2 made a call to answer some questions. When he could not find his colleague, he highlighted the question for future consideration. Also, in Company 4, the IT specialist had a discussion to find the best answers for some questions based on their company requirements.

Recommendations (CYSEC Dashboard). As suggested by SDT, self-efficacy and relatedness had a positive impact on users' autonomous motivation. All SMBs wanted to receive feedback after finishing a coach and recommendations for next improvements. Company 1: "we need a summary and recommendation after each coach."

Access to Capability Areas (CYSEC Dashboard). As suggested by SDT, choices support users' autonomy and motivation. Still, a recommended order was appreciated by the SMBs, even though the order must not be enforced. Some of the participants selected capability areas based on reflected priorities or requirements. Company 2 on which capability do you want to select to answer? "no preference [for the capabilities]. we can answer based on the list." Other participants followed different orders, and one looked for a specific capability area that was not available in the list of capability areas.

Progress Summary (CYSEC Dashboard). None of the participants was intrinsically motivated; SDT's model of introjected regulation was best explaining the participants' adoption behaviour. The participants wanted feedback about their performance, and it was important that the feedback was credible. The gamification elements of showing progress impacted the users' motivation. All the participated CISOs in this study wanted to have a simple summary which indicated their company's progress.

Acceptance and Usefulness of CYSEC (RQ2)

The answer to RQ2 is based on the supplementary data collected at the end of each study about the users' attitudes. Users evaluated the usefulness of the tool by responding to a five-level Likert scale questions about the tool usefulness (low

Discussion

We have presented an approach for allowing SMBs to improve their cybersecurity in a DIY fashion. This result allows moving from a bespoke, consultancy-centred advisory to an automated model of communicating cybersecurity knowledge that is scalable yet individualised, hence allows to serve many SMBs with little effort. Our approach implements the self-determination theory [START_REF] Ryan | Self-Determination Theory and the Facilitation of Intrinsic Motivation, Social Development, and Well-Being[END_REF], which describes the motivation for achieving outcomes and the factors influencing such motivation. SDT is not the only relevant theory, however. Protection motivation theory [START_REF] Menard | User Motivations in Protecting Information Security: Protection Motivation Theory Versus Self-Determination Theory[END_REF] is one of the widely used theories and would offer an alternative for method and tool design, allowing us to focus on motivating the users to protect their assets and company. We have chosen to implement SDT first as, in our understanding, the improvement of cybersecurity also concerns the creation of new capabilities in the organisation: installing and configuring tools, establishing policies, and training employees beyond just protecting an asset.

In a multi-case study, we offered insights on the actual use of our designed method and tool in real-world SMB settings. Such validation goes beyond just evaluating intentions as in [START_REF] Menard | User Motivations in Protecting Information Security: Protection Motivation Theory Versus Self-Determination Theory[END_REF] or theoretical relationship as in the common survey-based studies. The presented work is the first step towards operationalising SDT and using it to achieve an impact on practice. As a result, we have discovered issues for future research that would not have been discovered otherwise. The findings of the study suggest that one challenge of motivating and supporting SMBs is the choice of knowledge that is being communicated. The wrong knowledge, extraneous security awareness details, or knowledge gaps reduce motivation and influence the adoption of security recommendations. Also, we discovered a potential barrier that should be addressed by future research: confidentiality. While SDT emphasises relatedness, we observed resistance to documenting and sharing security-related information both within and among companies. Alleviating confidentiality worries is crucial for improving the method's success.

Following Yin [START_REF] Yin | Case study research:design and methods[END_REF], our study has the following threats to validity. Construct validity: are the operational measures for the concepts being studied correct? Our choice of constructs is based on SDT (Table 1) that we implemented in the CYSEC tool (Table 2) and discussed with the study participants. We described how we had implemented the constructs and offered a chain of evidence between the answers to the research questions and the data collected in the workshops. To ensure that the results reflect not only our subjective impressions, we did member checking.

Internal validity: can the cause-effect relationships in SDT be distinguished from bogus relationships? We used pattern matching and explanation-building for addressing internal validity threats. We identified relevant observations and feedback collected in the workshops and evaluated which ones spoke for a relationship, respectively against, resulting in the reported analysis. We also asked for what could have influenced the assessment, for example, whether the participants had cybersecurity training before the workshop to rule out the influence of such expertise. A longitudinal study, e.g., based on follow-up surveys, could be a research strategy for evaluating whether and how the SMBs change their practices with extended use of the CYSEC tool.

External validity: can the study be generalised? The participating SMBs were diverse but still had similarities: all were active in the digitisation, had a CISO without deep expertise in cybersecurity but several years of experience, and did not provide any training to their employees. Since they had some knowledge in cybersecurity, they were able to answer the questions without continually referring to the training content and succeeded to implement some security controls. However, this study has not covered a) SMBs with considerable expertise in the cybersecurity b) SMBs that hardly use IT, and c) SMBs without any budget and personnel for cybersecurity. The study results may change for such SMBs because of different knowledge needs and relevance of assessment questions and improvement recommendations.

Reliability: can the study be replicated with the same results? We developed and piloted a case study protocol that we applied in the main study. The protocol ensured that the operational steps were clear and that each SMB had enough time to use the tool without distraction. All the steps were traced in a case study database. To strengthen the chain of evidence, we presented our findings to the participating SMBs' subjects and cybersecurity experts in a formal meeting for correction (member checking).

Fig. 1 .

 1 Fig. 1. Main user interfaces of the CYSEC tool and mapping of its features to SDT constructs. The content has been organised into five cybersecurity themes (Patch Management, Access Control and Audit, Malware Scans, User Training, Back up). These themes allow fast ramp-up of security capabilities with minimal effort and large impact on SMBs.Recommendations are generated based on users' answers to the self-assessment questionnaires for maturity improvement[START_REF] Ozkan | A questionnaire model for cybersecurity maturity assessment of critical infrastructures[END_REF]. For the first time, new users will see one recommendation to fill out the company coach. As an adaptation rule, the answers to the company coach affect the questions asked in the other coaches. After completing the company coach, several coaches will be active in the dashboard. The available capabilities are defined and prioritised based on the cybersecurity expert's propositions (third author). When a user selects one coach, s(he) has access to the self-assessment questions and relevant capability training content. Providing the content was based on the research into the training material[START_REF] Gardner | Building an Information Security Awareness Program: Defending Against Social Engineering and Technical Threats[END_REF], technical reports provided by Symantec and Ponemon, and meeting with experts. Technical reports provide updated cybersecurity solutions and statistics. At the end of each coach, users see summary information and are redirected to the dashboard. In the dashboard, they see the progress information, achieved scores, and new recommendations for cybersecurity practices and selection of the next coach(es).

Table 2 .

 2 Operationalisation of SDT Constructs

	SDT Construct CYSEC Function Operationalisation
	Relatedness	Dashboard: recom-	Self-adaptation of recommendations to SMB profile
		mendations	and improvement progress.
		Dashboard: progress	Continuous feedback about progress and motivation.
		summary
		Work area: steps	Self-adaptation of recommended next improvements
		Offline	Personal workshops with SMBs for reflecting about
			improvement experience.
	Belonging and	Work area: action	Fostering of personal communication between CISO
	Connectedness	cockpit	and employees.
		Offline	Personal workshops with SMBs for reflecting about
			improvement experience.
	Rewards,	Dashboard: progress	Feedback about the defence strength built and
	threats, and	summary	knowledge acquired in the company, and persistence in
	deadlines		working on cybersecurity ("fitness").
		Work area: expert	Information about the importance of improvements,
		knowledge	e.g. by referring to cyber risks that should be mitigated.
		Work area: action	Setting of calendar entries and emailing reminders to
		cockpit	employees.
	Knowledge	Dashboard: access	Access to knowledge and recommendations for build-
		to capability areas	ing cybersecurity in the SMB.
		Work area: expert	Presentation of knowledge and recommendations for
		knowledge	building cybersecurity in the SMB.
	Choice	Dashboard: recom-	Presentation of the three top recommendations, offer-
		mendations	ing choice about the next important improvements.
		Dashboard: access	Presentation of capability areas, offering choice about
		to capability areas	the type of cybersecurity to build.
		Work area: action	Choice of deferring improvements with a calendar en-
		cockpit	try or bookmark and of involving employees by email.

Table 3 .

 3 SMBs Demographics

	ID Step Size	Of-	Maturity (Some controls imple-	Structure
			fices	mented)
	1 1	Medium 3	Access control., network con-	CEO, security team, em-
				trols, backup, encryption	ployees
	2 1	Medium 3	Password mgmt., patch mgmt.,	CEO, security team, em-
				encryption, (training) security	ployees
				best practices for developers
	3 1	Small	2	Password mgmt., Code inspec-	CEO, security team, em-
				tion	ployees
	4 1	Small	1	Access control, patch mgmt.,	Professors, manager, Secu-
					rity team, users
	5 2	Small	1	Using a firewall, Access control CEO, manager, employees
	6 2	Small	1	Password mgmt.,	CEO, managers, developers

Table 4 .

 4 Moreover, this company explained that "the confidentiality issues and the lack of some relevant questions in the specific topics influence our evaluation." Company 4: "although CYSEC is easy to use, the instructions in the training content are not easy to implement and practical for us." Company 5: "CYSEC provides lots of training material in one place. However, the gamification elements of showing progress need to be more transparent." Company 6: "the logic behind the questions needs to be improved to better support adaptation." CYSEC usefulness was perceived to be high by Company 1, Company 4 and Company 6, rather high by Company 2 and Company 5, and medium by Company 3. The lowest rank (medium [M]) chosen by Company 3 put a strong emphasis on a) confidentiality before and during the study and b) the lack of relevant questions in specific advanced topics. This result indicates that a tool like CYSEC that is based on self-assessment and tailored training modules was accepted as a do-it-yourself approach allowing SMBs to manage most capabilities. Questionnaire for the workshops' part 4.

	[L], rather low [RL],

Acknowledgements

This work was made possible with funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 740787 (SMESEC) and the Swiss State Secretariat for Education' Research and Innovation (SERI) under contract number 17.00067. The opinions expressed and arguments employed herein do not necessarily reflect the official views of these funding bodies.

8

Summary and Conclusions

The paper has evaluated the actual usage of the CYSEC, a do-it-yourself (DIY) security assessment and improvement method for small and medium-sized businesses (SMBs), through an explanatory multi-case study. This study followed a deductive approach and tested constructs drawn on the Self-Determination Theory to evaluate the impact of the method on the effectiveness of cybersecurity communication to the SMBs. We applied observation and feedback questionnaires for data collection.

The results support the influence of the following features on communication effectiveness and users' motivation: expert knowledge, self-adaptating assessment question, action cockpit for connectedness in SMBs, self-adaptating recommendations, provided capability areas, and progress summary. They empower SMBs in adopting and adhering to cybersecurity. The content, including questionnaires and recommendations, need to be presented in an easy-to-understand manner to improve users' competency. The assessment questionnaires and recommendations need to adapt to each specific SMB to increase autonomy. Also, for users' acceptance and adherence, CYSEC needs to consider the company confidentiality seriously. Users are emotionally connected to the SMBs' data do not want to share their information, especially about vulnerabilities, with the tool or third parties outside the SMB. Thus, confidentiality, trust, and relatedness may influence security communication and tool acceptance positively.


Katerine Romeo
email: katerine.romeo@univ-rouen.fr

Simon Gay

Marc-Aurèle Rivière

Edwige Pissaloux

EXPLORING MAPS WITH TOUCH: AN INCLUSIVE HAPTIC DEVICE

This paper presents a preliminary case study for the accessibility of maps for Visually Impaired People (VIP) using a novel haptic interface called F2T (Force Feedback Tablet). This device allows VIP to actively explore and feel graphical content and receive feedback on the explored image properties through a combination of dynamically generated force-feedback effects. Simplified room layouts were displayed to VIP, each including an entrance, an exit, and walls with a variety of angle shapes between them. The obtained results indicate that the F2T allows VIP to recognize different types of room layouts with good accuracy (with a mean absolute error of less than 10° when identifying angles between walls), and also shows the usefulness of the "guided" exploration mode to hasten the discovery of an unknown layout.

Introduction:

In our current digital society, graphical data is becoming increasingly ubiquitous. Most information sources have been digitized, and the advent of smartphones, social media platforms and wearable smart devices have powered an ever-growing exchange of video and image content over the web. Thus, culture and education are getting increasingly reliant on pictures, schematics, videos or maps, and accessing such information is difficult for Visually Impaired People (VIP). Traditional screen readers and braille devices are not adapted to tap into this flow of information, limiting VIP's inclusion in society and lowering their quality of life.

For VIP, accessing maps and graphical content often requires specifically designed documents in relief, such as maps with magnets, thermoformed surfaces or 3D representations of objects. However, such representations are often expensive to print, represent a static set of elements with a fixed scale and level of details, and require well-thought simplifications to be intuitively understood.

During the last decades, many efforts have been made to develop interfaces allowing to dynamically display / convey graphical contents to VIP [START_REF] Ducasse | Accessible Interactive Maps for Visually Impaired Users[END_REF], [START_REF] O'modhrain | Designing Media for Visually-Impaired Users of Refreshable Touch Displays: Possibilities and Pitfalls[END_REF], using various types of interfaces such as taxel matrices [START_REF] Prescher | Touching graphical applications: bimanual tactile interaction on the HyperBraille pin-matrix display[END_REF], electro-tactile surfaces [START_REF] Biet | Implementation of tactile feedback by modifying the perceived friction[END_REF] or plain vibrators [START_REF] Pielot | PocketNavigator: vibro-tactile waypoint navigation for everyday mobile devices[END_REF]. However, despite their advantages in being able to display different types of contents and dynamic information, very few haptic devices are actively used by VIP [START_REF] Gori | Devices for visually impaired people: High technological devices with low user acceptance and no adaptability for children[END_REF]. One of the reasons for this lack of adoption is the difficulty to recognize and differentiate objects displayed through those devices. Indeed, most touch-feedback technologies either provide edge or texture-based perception, thus presenting an incomplete representation. This greatly limits their use for the comprehension of graphical information The F2T (Force-Feedback Tablet) [START_REF] Gay | Towards Haptic Surface Devices with Force Feedback for Visually Impaired People[END_REF] was developed to provide a new way for VIP to explore and intuitively interpret graphical content such as maps and images. It allows VIP to explore and feel graphical content through an interactive interface that generates haptic effects based on the underlying content of the image. Those haptic effects encode specific spatial properties of the image (such as edges or textures) depending on where the user is directing the focus of its exploration. This paper explores the usability of the F2T for assisting the discovery of 2D indoor plans. Indeed, previous research has shown that haptic displays can effectively support interpreting map-based information [START_REF] Pielot | Supporting map-based wayfinding with tactile cues[END_REF], [START_REF] Klatzky | Acquisition of Route and Survey Knowledge in the Absence of Vision[END_REF], but these haptic dynamic representation of maps are often difficult to interpret and memorize. To allow for an intuitive exploration, such devices should provide information to both localize and distinguish the various elements (i.e. objects or areas) of the image. Combining the various force-feedback effects of the F2T with the users' movements, should allow them to perceive both the edges of objects and to give an identity to those objects by linking them to different haptic "textures", thus helping VIP gain a more accurate mental images of the explored contents [START_REF] Pissaloux | A New Framework for Cognitive Mobility of Visually Impaired Users in Using Tactile Device[END_REF], [START_REF] Riviere | NAV-VIR: an audio-tactile virtual environment to assist visually impaired people*[END_REF].

The next section summarizes the main principles of the F2T and the following one presents preliminary results obtained using the F2T to explore simplified geographic maps.

F2T or an inclusive haptic device:

The F2T allows VIP to explore and feel maps (and other graphical contents) by moving a small mobile platform held by motorized axes over a virtual image (cf. Fig. 1). They guide the platform by pushing a joystick placed on it and receive dynamically generated haptic feedback based on the content of the currently explored region of the image (which is defined by where the platform is over the virtual image). The user can both freely explore the image or be guided through it by the device itself. It uses various force-feedback effects to provide information about relevant properties of the explored image, such as the nature of the currently explored section (e.g. corridor, room, wall, …), the presence of a path or of points-of-interests (PoI), etc.

Fig. 1 Model of the F2T (left) and its current prototype (right): a flat thumbstick (center of the tablet) acquires user's intended movements; the actuated support moves the thumbstick to generate a large variety of haptic effects from images

displayed on a screen to which the F2T is attached.

The F2T's control system allows a wide range of interactive haptic effects to represent the content of an image. Those effects vary by the amount of "control" exerted over the movement of the mobile support by the device itself.

On one end of the continuum, passive effects will slightly alter the final movement of the support, compared to the user's intended movement. Those effects usually apply a speed or direction correction to the intended movement. For example, a specific room could be distinguished from the neighboring area by having a high "friction" coefficient, requiring more efforts to cross (by moving the joystick through it). This resistance can be constant on the whole room, or could increase in a stepwise manner, to indicate stairs. Similarly, walls could be indicated by a "vertical step" that needs to be overcome by pushing the joystick with a certain threshold of force to be able to "move over" the wall, akin to climbing a cliff-face. Finally, those effects can be combined to create more complex ones, such as "canyons" that aim to keep the support within a specific "rivulet" by dragging it back towards its center when the user tries to move away from it, akin to trying to escape gravity well. This effect can be used to encode preferred paths, from which you can divert but to which you will always be brought back, unless you find another of those paths to "fall" into.

On the other extreme of this continuum, you have active effects, which are different types of guidance modes, where the device guides the user along a predefined path. Depending on the type of guidance, the user is either fully locked onto that path, or can slightly deviate from it, but cannot escape from it or stop its progress, akin to swimming laterally into rapids. The following experiments explore how to combine those effects in order to convey cartographic data into haptic stimulations, allowing VIP to efficiently explore and mentally represent the spatial organization of simple indoor plans.

Test protocols and results:

Previous preliminary evaluations showed that the F2T can be used to convey basic geometric shapes and movements [START_REF] Riviere | NAV-VIR: an audio-tactile virtual environment to assist visually impaired people*[END_REF]. To further extend those results to more complex shapes and tasks, we designed two simple experiments: identifying the angle between two walls and recognizing the layout of a room (composed of several walls with different types of angles between them). Twelve blindfolded sighted participants were enrolled for both studies, with 9 participants between the ages of 20 and 30, and 3 between 30 and 50 years old.

Angle perception:

To verify that the F2T allows blindfolded participants to perceive and identify various angles, we prepared six different haptic images representing acute, right and obtuse angles (c.f. Fig. 2). The angles were presented in a randomized order, and no other information on the types of angles to expect was given to the participants. Each haptic image covered the exploitable surface of the F2T (20 x 20 cm). The green areas represent virtual walls and cannot be crossed.

For each trial, the participant could freely explore the image and was given the guideline of following the edges of the virtual wall to identify the angle between the two walls as fast as possible and give its approximate value orally. Participants could express angles greater than 180° by giving the complementary angle if they felt more fluent with salient angles. The exploration time needed to give an answer was also recorded. Fig. 3 shows the average exploration times (in seconds) and the Mean Absolute Error (MAE, in degrees) when identifying the angle for each angle value. The average exploration time was 58.5 seconds with a standard deviation of 12.8 seconds. The exploration times were longer for the angles greater than 180°. Such results are probably due to larger surface (black) which had to be explored, and the increased facility of "loosing" the edge when sliding against it. Indeed, it was observed that the user's finger moving too fast could lose the edge of angles greater than 180°, making participants loose time during their exploration.

Fig. 3 Average Exploration Times (in seconds) and Mean Absolute Error (in degrees) for the six angles

The highest MAE (of 9.5°) was observed for 45° and 315° angles, while the MAE is around 8.2° for 135° and 225° angles. Right angles (90° and 270°) were the most easily recognized ones, with a MAE of 0° and 3.33° respectively.

Layout perception:

The following experiment consisted of haptic images combining several walls (impossible to cross) at different angles, into four basic room layouts (c.f. fig 4), each with an entrance and an exit, indicated by a specific passive friction effect. Each layout was presented with the entrance facing the user, at the bottom of the layout, to give the participant the feeling of entering the room.

The same 12 participants were asked to explore and memorize each layout and then draw it, including the position of the exit door. Participants were divided in two groups: half of the participants explored the layout freely until they felt comfortable enough to draw it, while the other half was first guided around the virtual room through a path showing the exit door, before being allowed to freely explore the room until they felt confident in drawing its shape. Each of the 4 virtual rooms was presented in ascending order of topological complexity. They were told that those 4 rooms were part of an apartment, each room connected to the next by its exit.

P1 P2 P3 P4

Fig. 4 Each of the 4 virtual rooms, in order of complexity.

Fig. 5 shows two sets of the collected drawings for each of the 4 layouts. Each participant was able to easily find the location of the exit door and to correctly reproduce the layout. The 2 rooms with diagonal walls (P3 and P4) were generally more confusing, with some participants pointing out the difficulty to remember the position and angles of all walls. The average exploration times are shown in Fig. 6. The free exploration time in the non-guided condition were longer (μ = 95.4s) than in the guided one (μ = 53s). This means that the guided exploration allows users to understand (and mentally represent) the structure of the layout while they are guided, thus reducing the time they need to freely explore it before being comfortable drawing it. Interestingly, the last 2 layouts generally required longer explorations times in the non-guided condition (due to the non-straight walls and angles), but this difference wasn't observed in the guided condition. The greater difficulty in mentally representing the last 2 layouts could be partially explained by the thumbstick producing non-smooth and sometimes slightly curved diagonal movements due to the current prototype's imperfections.

Similarly, participants took more time exploring the first room due to the novelty of the task, but only in the non-guided condition. The participants found that the guidance was very useful to better and faster apprehend the explored layout and confirmed that a free exploration phase was required afterwards to consolidate their understanding of the room's layout. Some participants also reported that the used guiding speed was sometimes too high;

These preliminary results show the F2T's potential to allow the comprehension of haptic images of spatial data such as maps. And despite a lack of quantitative results to validate its usefulness, participants highlighted the usefulness of the guided exploration to rapidly give them an overview of the whole layout, allowing them to explore it more efficiently after.

Mental Representation of the whole apartment:

The final task the participants were given was to draw the whole apartment by linking the four interconnected rooms they previously explored. This task required them to mentally rotate some of the rooms in order to connect the exit of a room with the entrance of the next in a coherent manner. Fig. 7 presents the expected result and two examples of the collected drawings for this task, which was correctly accomplished by all the participants.

Conclusions:

This communication introduces a potential use case for the Force-Feedback Tablet, a novel haptic interface allowing VIP to intuitively explore and interpret images such as cartographic data through a combination of haptic effects. Simple experiments were designed to evaluate the spatial cognition of blindfolded participants (such as the mental rotation of layouts) using the device to explore cartographic data. The results obtained are encouraging but will need to be confirmed with more robust protocols to more reliably test specific hypothesis on the relative importance of specific haptic effects for representing relevant elements of cartographic data (such as points of interests, elevators…). The possibility of adding localized audio cues to identify "noisy" elements of the map (such as fountains, coffee shops…) is also being studied.

Fig. 2

 2 Fig. 2 Angles of 45°-90°-135° (top row) and 315°-270°-225° (bottom row) presented in a random order during the test.

Fig. 5

 5 Fig. 5 Two sets (upper and lower lines) of drawings of the 4 virtual rooms.

Fig. 6

 6 Fig. 6 Average exploration time of the rooms.

Fig. 7

 7 Fig. 7 Four interconnecting virtual rooms and two examples of drawings of the mental representation of the connectingrooms.