Alireza Shojaifar
email: a.shojaifar@uu.nl

Samuel A Fricker
email: samuel.fricker@bth.se

Keywords: Cybersecurity, Small and medium-sized enterprises, Online consent, Confidentiality concerns, Information sharing

Small and medium-sized enterprises (SME) are considered an essential part of the EU economy; however, highly vulnerable to cyber-attacks. SMEs have specific characteristics which separate them from large companies and influence their adoption of good cybersecurity practices. To mitigate the SMEs' cybersecurity adoption issues and raise their awareness of cyber threats, we have designed a self-paced security assessment and capability improvement method, CYSEC. CYSEC is a security awareness and training method that utilises selfreporting questionnaires to collect companies' information about cybersecurity awareness, practices, and vulnerabilities to generate automated recommendations for counselling. However, confidentiality concerns about cybersecurity information have an impact on companies' willingness to share their information. Security information sharing decreases the risk of incidents and increases users' self-efficacy in security awareness programs. This paper presents the results of semi-structured interviews with seven chief information security officers (CISOs) of SMEs to evaluate the impact of online consent communication on motivation for information sharing. The results were analysed in respect of the Self-Determination Theory (SDT). The findings demonstrate that online consent with multiple options for indicating a suitable level of agreement improved motivation for information sharing. This allows many SMEs to participate in security information sharing activities and supports security experts to have a better overview of common vulnerabilities.

SMEs' Confidentiality Concerns for Security Information Sharing 1 Introduction

Small and medium-sized enterprises (SMEs) have a considerable diversity and form the backbone of the EU's economy [START_REF] Muller | Annual report on European SMEs 2016/2017: Focus on self-employment[END_REF]. However, although they need to deal with a similar level of cybersecurity risk as large companies, information security is not always a priority [START_REF] Kurpjuhn | The SME security challenge[END_REF][START_REF] Osborn | Business versus technology: Sources of the perceived lack of cyber security in SMEs[END_REF]. Moreover, the lack of written security policy, financial resources, and security expertise are other operational constraints and make SMEs more vulnerable [START_REF] Furnell | A prototype tool for information security awareness and training[END_REF][START_REF] Gupta | Information systems security issues and decisions for small businesses[END_REF]. To having an effective understanding of security policy and fostering a security culture, providing appropriate training and awareness tools specifically for small enterprises is necessary [START_REF] Furnell | A prototype tool for information security awareness and training[END_REF].

Training and awareness programs are the most commonly suggested approaches in the literature for security policy compliance, and they can alleviate employees' limited knowledge of cybersecurity [START_REF] Puhakainen | Improving employees' compliance through information systems security training: an action research study[END_REF]. Systematic training programs are a good means of facilitating continuous information security communication in organisations. Information security training should apply content and approaches that enable and motivate learners to systematic cognitive processing of information they receive in training [START_REF] Puhakainen | Improving employees' compliance through information systems security training: an action research study[END_REF].

CYSEC is a self-paced SME-specific training and awareness method that provides training by automating the elements of security communication between employees and a security expert [START_REF] Shojaifar | Elicitation of SME requirements for cybersecurity solutions by studying adherence to recommendations[END_REF]. Since there is a resistance to changing cybersecurity behaviour and adopting security tools by employees [START_REF] West | The psychology of security[END_REF], the method implements the motivational constructs-namely, the needs for autonomy, competence, and relatedness-in the selfdetermination theory (SDT) [START_REF] Ryan | Self-determination theory and the facilitation of intrinsic motivation, social development, and well-being[END_REF][START_REF] Deci | The General Causality Orientations Scale: Self-determination in personality[END_REF] to motivate learners to adopt advice. CYSEC provides training, recommendations, and relevant hands-on skills based on SMEs' answers to the self-assessment questions to enable them to become more self-determined.

Security information sharing is a challenge for companies, and they are reluctant to share their information and report their incidents [START_REF] Robinson | Incentives and Challenges for Information Sharing in the Context of Network and Information Security[END_REF][START_REF] Choo | The cyber threat landscape: Challenges and future research directions[END_REF][START_REF] Geer | Information security: Why the future belongs to the quants[END_REF]. Fear of negative publicity and competitive disadvantage, believing that the chance of a successful prosecution is not high, believing that the cyber incident was not severe enough to be reported, and a lack of motivation and trust are some of the major hindrance to information sharing activities [START_REF] Choo | The cyber threat landscape: Challenges and future research directions[END_REF][START_REF] Geer | Information security: Why the future belongs to the quants[END_REF]. However, security information sharing is a significant measure to reduce the risks of similar incidents and develop a better understanding of the risks facing a community [START_REF] Bedrijfsrevisoren | Cyber security information sharing: An overview of regulatory and non-regulatory approaches[END_REF][START_REF] Geer | Information security: Why the future belongs to the quants[END_REF]. The European Network and Information Security Agency (ENISA) [START_REF] Bedrijfsrevisoren | Cyber security information sharing: An overview of regulatory and non-regulatory approaches[END_REF] explains that the nature of cyber incidents and attacks is borderless. To support the management of threats and vulnerabilities in the community of cybersecurity, the exchange of data and cross-border cooperation is necessary [START_REF] Bedrijfsrevisoren | Cyber security information sharing: An overview of regulatory and non-regulatory approaches[END_REF]. ENISA indicates that trust is the critical element to enhance security information sharing. Therefore, the actual usage of CYSEC requires further investigation. The current study aims to evaluate the impact of online consent communicating on SME's chief information security officers (CISOs) motivation for security information sharing. Taking approaches that motivate users to adopt security recommendations can support the effectiveness of cybersecurity communication [START_REF] Cranor | A framework for reasoning about the human in the loop[END_REF]. The semi-structured interview method was selected for data collection about behavioural motivation. The data was qualitatively analysed based on a proposed theoretical model by Yoon and Rolland [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF] for explaining knowledge-sharing behaviours in virtual communities. The model studies the effect of basic psychological needs in SDT (autonomy, competence, and relatedness) and two antecedents of the basic needs: familiarity and anonymity. Familiarity refers to an individual's understanding of the environment and increases the trust of other people [START_REF] Gefen | E-Commerce: the role of familiarity and trust[END_REF]. Anonymity refers to the inability of others to identify an individual or for others to identify one's self [START_REF] Christopherson | The positive and negative implications of anonymity in Internet social interactions: ''On the Internet, Nobody Knows You're a Dog[END_REF] and may influence individuals' knowledge sharing behaviour in a virtual community [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF].

Our study results indicate that SDT and two antecedents (familiarity and anonymity) account for motivation for security information-sharing behaviour, and online consent has a positive impact on CISOs' motivation. The online consent increased users' trust and provided value for SMEs to make choices and decisions about the suitable level of relatedness for sharing information.

The remainder of the paper is organised as follows. Section 2 presents the research background, the theoretical model, and the research prototype. Section 3 describes the design of our study. Section 4 presents the analysis approach and the answer to the research question. Section 5 discusses the significance of the results and the threats to validity. Section 6 summarises and concludes.

Research Background

Security information sharing has been identified to increase end-users' self-efficacy in security awareness programs [START_REF] Robinson | Incentives and Challenges for Information Sharing in the Context of Network and Information Security[END_REF][START_REF] Rhee | Self-efficacy in information security: it's influence on end users' information security practice behavior[END_REF]. Security information sharing means the exchange of network and information security-related information such as risks, vulnerabilities, threats, internal security issues, and good practice [START_REF] Bedrijfsrevisoren | Cyber security information sharing: An overview of regulatory and non-regulatory approaches[END_REF]. Security information should be shared to understand the risks facing the community and any related significant information infrastructure and reduce the risk of incidents. Confidentiality concerns and the lack of incentives prevent companies to share security information [START_REF] Robinson | Incentives and Challenges for Information Sharing in the Context of Network and Information Security[END_REF][START_REF] Geer | Information security: Why the future belongs to the quants[END_REF]. Geer et al. [START_REF] Geer | Information security: Why the future belongs to the quants[END_REF] state individual companies might have some rudimentary understanding of their own information security health, but we have no aggregate basis for public policy because organisations do not share their data. The companies' confidentiality concerns include worries about reputation, losing customers, fears of misuse of the information, and strong emotional relatedness to the organisational data. These concerns exist even if security information is anonymised.

Trust influences a user's willingness to share knowledge [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF][START_REF] Chang | Social capital and individual motivations on knowledge sharing: Participant involvement as a moderator[END_REF] and security information [START_REF] Bedrijfsrevisoren | Cyber security information sharing: An overview of regulatory and non-regulatory approaches[END_REF]. Hosmer [START_REF] Hosmer | Trust: The connecting link between organisational theory and philosophical ethics[END_REF] defines trust as the expectation by one person, group, or firm of ethically justifiable behaviour on the part of the other person, group, or firm in a joint endeavour or economic exchange. Some arrangements could mitigate confidentiality concerns relevant to trust issues. The arrangements include to [START_REF] Cranor | A framework for reasoning about the human in the loop[END_REF] give control of information to the company which shared it, (2) agree about how to use and protect shared information, (3) preserve data anonymity, and (4) develop standard terms for communicating information [START_REF] Robinson | Incentives and Challenges for Information Sharing in the Context of Network and Information Security[END_REF]. Deci et al. [START_REF] Deci | Self-determination in a work organisation[END_REF] explain that also autonomy support, including the offering of choice and relevant information, impacts trust.

The Self-Determination Theory (SDT) has been proposed as a theoretical framework to study humans' motivational dynamics and consequent behaviours [START_REF] Ryan | Self-determination theory and the facilitation of intrinsic motivation, social development, and well-being[END_REF][START_REF] Deci | Self-determination in a work organisation[END_REF][START_REF] Deci | The General Causality Orientations Scale: Self-determination in personality[END_REF]. People have different levels and orientations of motivation. Self-determination in SDT is defined as: the capacity to choose and to have those choices, rather than reinforcement contingencies, drives, or any other forces or pressures, to be the determinants of one's actions. But self-determination is more than capacity. It is also a need. Deci and Ryan [START_REF] Deci | Intrinsic motivation and self-determination in human behaviour[END_REF] have hypothesised a basic, innate aptitude to be self-determining that leads humans and organisations to engage in desirable behaviours.

SDT assumes that the satisfaction of humans' basic psychological needs -autonomy, competence, and relatednessleads to self-motivation and positive outcomes [START_REF] Vallerand | Toward a hierarchical model of intrinsic and extrinsic motivation[END_REF]. Autonomy refers to a desire to engage in activities with a choice of freedom. Competence implies that individuals have a desire to interact effectively with the environment for producing desired outcomes and preventing undesired events. Relatedness reflects a sense of belongingness and connectedness to others or a social environment.

To explain knowledge-sharing behaviours, Yoon and Rolland [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF] extended SDT with two antecedents, familiarity and anonymity. Familiarity refers to an individual's understanding of an environment based on the prior experience and learning of the what, who, how, and when of what is happening [START_REF] Gefen | E-Commerce: the role of familiarity and trust[END_REF]. Familiarity may improve perceived competence, the feeling of relatedness [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF]. Anonymity refers to the inability of others to identify a person or for others to identify one's self [START_REF] Christopherson | The positive and negative implications of anonymity in Internet social interactions: ''On the Internet, Nobody Knows You're a Dog[END_REF]. It can reduce social barriers and allow group members to contribute their opinions [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF]. Anonymity may impact on autonomy and the feeling of relatedness. Fig. 1 shows the complete model. We applied Yoon and Rolland [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF] model to evaluate the impact of the motivational factors in online consent on the security information-sharing activities of SME CISOs. We asked SMEs to use self-assessment questionnaires to collect security information and share with a community of security experts and other SMEs. The consent provides choices and the opportunity for CISOs to exert control over information sharing. Through the choices, CISOs can define their relatedness to the tool and the community. Each choice gives information and explains how and where the shared information will be used to increase users' familiarity with the data usage environment. The consent emphasises that the shared information will be used anonymously.

The consent form included three choices based on three levels of relatedness and agreement. 1) disagreement to share security information. 2) agreement to automated processing of security information for recommendations of cybersecurity improvements in their company. 3) agreement to share security information for cybersecurity research. The form includes the choice of anonymity. It supports familiarity by elaborating on the usage of security information to reduce the complexity for new users and enhance the users' competence. Fig. 2 shows the consent form Replying to questionnaires is a part of your self-evaluation approach. However, you can improve adherence to good cybersecurity practices in the CYSEC community.

I use the tool for testing purposes or my personal training (my answers may be not accurate).

By choosing this item, you are using the tool only for the training and awareness purposes, such as reading the training and awareness content and using the embedded training links. And your answers will be removed from the tool.

I use the tool to improve the cybersecurity in my SME with the automated feedback and recommendations it generates (I confirm that my answers are correct).

By choosing this item, the stored answers are used to generate recommendations, feedback, and KPIs.

My anonymised answers may be used in the CYSEC community for further research.

By choosing this item, the stored data is used: [START_REF] Cranor | A framework for reasoning about the human in the loop[END_REF] for your SME cybersecurity improvement and (2) anonymously for conducting research in FHNW University for the CYSEC community to improve the cybersecurity coping mechanisms, for instance, generating recommendations based on all CYSEC partners' capability to make a backup.

Agree

Method

This study aims at finding out the impact of online consent communicating on SME's CISOs motivation for sensitive information sharing behaviour. Semi-structured interviews [START_REF] Yin | Case study research: design and methods[END_REF] were applied to conduct the empirical part of this study. The interview is one of the most frequently used methods and the most significant sources of data in empirical studies in software engineering. Interviews provide researchers with important insights into the quality and usability of artefacts since much of the knowledge that is of interest is only available in the minds of users [START_REF] Runeson | Case Study Research in Software Engineering -Guidelines and Examples[END_REF]. The same method (interview with CISOs, and key informants who are Network and Information Security experts) has already been used in the context of cybersecurity [START_REF] Beebe | Examination of Organizational Information Security Strategy: A Pilot Study[END_REF] and security information sharing [START_REF] Robinson | Incentives and Challenges for Information Sharing in the Context of Network and Information Security[END_REF].

A theoretical model based on SDT (Fig. 1) was chosen to analyse the CISOs' information-sharing motivation and whether online consent can motivate them. When we have a developed theory as a template, the model of generalisation is the analytic generalisation [START_REF] Yin | Case study research: design and methods[END_REF]. The study seeks answers to this research question: Do the choice of anonymity and the elaboration of how shared information will be used motivate CISOs of SMEs to share security information? Security information sharing is a necessary measure in the context of cybersecurity [START_REF] Gal-Or | The economic incentives for sharing security information[END_REF][START_REF] Bedrijfsrevisoren | Cyber security information sharing: An overview of regulatory and non-regulatory approaches[END_REF] and for SMEs [START_REF] Lewis | Cybersecurity information sharing: a framework for sustainable information security management in UK SME supply chains[END_REF][START_REF] Birkás | EISAS-European Information Sharing and Alerting System[END_REF]. We are studying how motivational constructs, controlling over data through choices, online agreement, and familiarity with the usage of shared information, can impact information-sharing behaviour. Recorded interviews were analysed based on content analysis (interviewees' argumentations) and theoretical cause-effect relationships [START_REF] Yin | Case study research: design and methods[END_REF].

At first, a pilot study, including three interviews with three SMEs' CISOs (project partners), has been conducted-the pilot study allowed to identify and resolve initial problems in the interview questions and the online consent design. The selection of the subjects was based on the availability of the SMEs. There were twelve SMEs (four project partners and eight open call partners), and seven of them participated in the interviews. The participating SMEs came from five EU countries, and all were active in the IT industry. All of them implemented some security controls, including password management, basic approaches for privacy protection, using firewalls, two-factor authentication, cloud security features, and anti-virus installation. One person from each SME was interviewed. The people interviewed were chosen because they all were CISOs or senior managers, and all have been involved in cybersecurity tasks within their companies. All were college graduates and had several years of experience in security. One of the interviewed people was a cybersecurity expert and provided a more in-depth perspective on the importance of security information sharing, the necessity for an agreement, and anonymity. Table 1 presents the SMEs' demographics. In the European Union, companies are considered to be SMEs if they have fewer than 250 employees and an annual turnover of less than € 50 million [START_REF]What is an SME?[END_REF].

Interviews were conducted face-to-face when possible. For four SMEs, a request for the online interview has been sent. All interviewees had the possibility to find a suitable time. In the online interviews, the screen of the interviewer's computer was shared, and the interviewees were able to see and read the content and had enough time to think about the answers. All the interviews were conducted without distraction. Each interview started with an explanation of the study. Then we presented each interviewee with a screenshot of the online consent and asked them about their understanding of it. All interviewees understood the idea and content. To collecting honest responses, the researcher emphasised that the collected data would be applied anonymously for academic purposes and then obtained the subjects' consent. In the end, a summary of the key findings and answers presented to the interviewees. All interviews were recorded and transcribed.

Analysis of the Interview Results

For answering the research question, we studied the impact of anonymity choice and elaboration of data use on SME CISOs' motivation for security information sharing. The interview transcripts showed that both design elements of the online consent form affected the CISOs' motivation for security information sharing. They supported relatedness, autonomy, and competence, and enhanced the CISOs' trust perception. The study participants were motivated to share security information when they perceived that they had control of the communication, and the information was securely stored. Security information sharing behaviour. Through the interviews, it became clear that the agreement form encouraged the CISOs' information sharing with the tool. ID7 emphasised that the agreement was not only useful but also legally necessary. ID3 and ID7 stated that the agreement positively affected their trust. ID3: "it has a positive effect on trust because it shows that you take care of the data process and make it clear." ID7: "the online consent impacts on trust and shows me that there are thoughts, conditions, and efforts to provide different options and approaches for disclosure." ID1: "with this agreement, I feel safer."

Role of autonomy through choice. The analysis of the study participants' arguments showed that the autonomy offered by the choice of sharing security information influenced their information-sharing intention. ID7: "providing options show me that these people know what they are asking for and give you options." All interviewees recognised the importance of security information sharing for receiving better advice; however, some of them selected the third choice (sharing information for research). ID1: "I may change my answer later." ID7: "I need to check with my boss. Do I still have the ability to edit my selection? I can decide and let you use the answers, but until the end of the duration of the project." The respondents were asked whether they wanted to add a new option to the online consent, but no new option was suggested.

Role of familiarity through elaboration of security information use. Improving the CISOs' familiarity with how security information would be used positively affected competence and relatedness. All except ID6 wanted to have a clear description of how their information would be used. ID6 stated: "the text is clear and understandable, and it improves my awareness." IDs 1, 3, 4, 7 emphasised that the agreement has not provided sufficient information. When asked why, ID1 stated: "I do not know how my company information is stored; also, it should be stated if we can change our answer later." ID3: "I assumed that after generating recommendations, the data should be destroyed." ID7: "it should be clearly stated if the data will be used in the future and after the project." ID4 also wanted to know more about the security information recipient "FHNW" indicated on the consent form. The interviewees were also asked to state if they wanted to know how the information is processed. Most interviewees stated that their organisations only wanted to have the results of the analysis, i.e. the tool's recommendations. ID2: "I do not care how and when my data will be used for the research. I just want to have the results." ID5 and ID6 wanted to know, however, how their information would be processed.

The content of the agreement was perceived to be confusing for some of the subjects. Some of the interviewees suggested modifications to the content. ID2: "the second option should be rephrased: [try to answer the questionnaires to the best of your knowledge to help us give you more accurate recommendations]." "Options should be re-arranged: Options #2 and #3 should be separated from option #1." "Option #3 should be rephrased, something like [if you allow us to collect your answer, we will be able to improve the tool, provide you better analysis, and better help you in the future. (Yes or No)]?" ID4: "rephrasing can clarify the message because I do not know if I select option #1, I will receive a recommendation." ID7: "I think giving an option to SMEs that indicates my answer may or may not be accurate can demote the whole."

Role of anonymity through security information anonymisation. Anonymising the security information could influence perceived relatedness and autonomy and, in turn, encourage security information sharing. The analysis of the interviewees' arguments showed that all believed that anonymity would reduce the risks of sharing information. They felt more secure when the tool support anonymity. ID2: "if my data is anonymised, I don't care how my data will be used." ID1: "anonymised data sharing shows that it is safe." ID7: "I presume that when you put stress on anonymity in the third option, it can imply that the second option is not anonymised. I assume that even for other usages (KPI, recommendations), SMEs should not be recognisable."

The interviewees would not share security information that would expose details about their organisation, hence would break their anonymity. ID3: "consent cannot change my opinion; I am not answering the textbox questions." ID7: "I know that Yes/No or multi-choice questions can be used for the statistical analysis; however, any question that refers more to deterministic answers, I don't want to answer."

Discussion

Security information sharing

Security information sharing is widely acknowledged [START_REF] Robinson | Incentives and Challenges for Information Sharing in the Context of Network and Information Security[END_REF][START_REF] Bedrijfsrevisoren | Cyber security information sharing: An overview of regulatory and non-regulatory approaches[END_REF][START_REF] Geer | Information security: Why the future belongs to the quants[END_REF]; however, confidentiality worries, lack of incentives, and lack of trust lead the companies to avoid sharing information and reporting vulnerabilities [START_REF] Robinson | Incentives and Challenges for Information Sharing in the Context of Network and Information Security[END_REF][START_REF] Geer | Information security: Why the future belongs to the quants[END_REF]. To motivating companies to share their security information, attention to arrangements such as giving control of information to the company which shared information, having an agreement, and preserving data anonymity is necessary [START_REF] Robinson | Incentives and Challenges for Information Sharing in the Context of Network and Information Security[END_REF]. In this study, based on a theoretical model for knowledge-sharing behaviour in virtual communities [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF], we have evaluated the impact of online consent communicating on SME CISOs' motivation for information sharing. The model [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF] extended the selfdetermination theory and included two antecedents (familiarity and anonymity) on basic psychological needs (perceived autonomy, perceived competence, and perceived relatedness). Yoon and Rolland [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF] study indicates that perceived autonomy does not influence knowledge-sharing behaviours in virtual communities since a virtual community is a voluntary environment that is not controlled by anyone else. However, our findings show that in the context of security information sharing, users' perception of controlling over information sharing increased their motivation, and providing choices enabled users to have selective permission controls. This finding is consistent with the previous study [START_REF] Robinson | Incentives and Challenges for Information Sharing in the Context of Network and Information Security[END_REF]. Moreover, Yoon and Rolland [START_REF] Yoon | Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory[END_REF] study shows that anonymity has a negative impact on knowledge-sharing activities since the anonymity in a virtual community can be used to attack the opinions of other people, and in a highly anonymous environment, individuals may think about other people's reactions to their opinion. In our study, users emphasised that preserving anonymity is essential. Although our study is based only on qualitative findings and a small sample, we can explain the anonymity based on the perception of altruism [START_REF] Chang | Social capital and individual motivations on knowledge sharing: Participant involvement as a moderator[END_REF] and the risk of information misuse [START_REF] Lewis | Cybersecurity information sharing: a framework for sustainable information security management in UK SME supply chains[END_REF].

In CYSEC, the self-assessment questionnaires are used to collect security information (including cybersecurity awareness, practices, and vulnerabilities) and share with a community of security experts and other SMEs. The results demonstrated that online consent with the choice of anonymity and the elaboration of how shared information is used motivated CISOs of the SMEs to share their information. Also, we discovered that CISOs would not share security information that would expose details. For future research, the other legal and economic incentives [START_REF] Gal-Or | The economic incentives for sharing security information[END_REF] should be considered, and not only CISOs opinions but also employees' viewpoints should be studied.

Study Limitation

This study has some limitations. One criterion influencing the sufficiency of the interviews was saturation. The saturation point is reached when no new information is gathered, or the subjects' viewpoints are repeated [START_REF] Runeson | Case Study Research in Software Engineering -Guidelines and Examples[END_REF]. Due to the small sample size, we could not reliably validate saturation and implement a statistical analysis in our study.

The study is based on seven interviewed persons from seven SMEs that were active in the IT industry, which limits generalizability. Further research with a larger sample and a diversity of SMEs could reveal more robust results and provide more insights into the influence of the industry type on the SME engagement in security information sharing. Second, since the study is based on the CISOs and senior managers' viewpoints of security information sharing, our study lacks the view of SMEs' employees. To having a wider perspective, the views of SMEs' employees are needed.

Summary Conclusions

The paper has evaluated the impact of online consent communicating on motivating CISOs of SMEs for security information sharing. This study followed a deductive approach and tested constructs drawn on the Self-Determination Theory (SDT) as well as two antecedents of SDT constructs (familiarity and anonymity) to evaluate the impact of the online consent on the security information sharing motivation. We applied semistructured interviews with seven CISOs from seven SMEs for data collection. The study results indicate that online consent increased CISOs' trust and had a positive impact on security information sharing intention. The consent supports familiarity with the environment through the elaboration of security information usage. Moreover, online consent considers the role of anonymity and autonomy through security information anonymisation and the choice of sharing information.

Fig. 1 .

 1 Fig. 1. Research model (Yoon and Rolland [26])

Fig. 2 .

 2 Fig. 2. Screenshot of the Online Consent prototype

Table 1 .

 1 SMEs' Demographics

	ID	Org. size	Offices Maturity	Structure
	1	Small	2	Some controls implemented CEO, security team, employees
	2	Small 1	1	Some controls implemented Professors, manager, security team, users
	3	Medium	3	Some controls implemented CEO, security team, employees
	4	Small	2	Some controls implemented CEO, security manager, employees, be-
					havioural scientist
	5	Small	2	Some controls implemented CEO, employees
	6	Small	1	Some controls implemented CEO, employees
	7	Small	2	Some controls implemented CEO, security team, employees

The organisation

was a university-hosted start-up.

Acknowledgments

This work has received funding from the European Union's Horizon 2020 research and innovation programme under grant agreements No. 740787 (SMESEC), No. 883588 (GEIGER), and the Swiss State Secretariat for Education' Research and Innovation (SERI) under contract number 17.00067. The opinions expressed and arguments employed herein do not necessarily reflect the official views of these funding bodies.


Jan Freudenreich
email: jan.freudenreich@tum.dejens.grossklags@in.tum.de

Jake Weidman
email: jakeweidman@google.com

Jens Grossklags

Responding to KRACK: Wi-Fi Security Awareness in Private Households

Keywords: WPA/Wi-Fi Security, KRACK Attack, Interview Study

In this paper, we study the update and security practices of individuals in private households with an exploratory interview study. In particular, we investigate participants' awareness regarding KRACK, a patched key vulnerability in the WPA/WPA2 protocol, and similar vulnerabilities in the context of usage and management scenarios in Wi-Fi networks. We show that while most people are aware of certain dangers, they struggle to address Wi-Fi related vulnerabilities. The findings could prove to be beneficial in identifying not only the current security status of average users regarding Wi-Fi security, but also to improve update and information propagation to mitigate related threats in the future.

Introduction

Today, Wi-Fi devices are used in nearly every household with an installed base reaching 13 billion devices in 2019 [START_REF]Wi-Fi Alliance: Wi-Fi in[END_REF], while Wi-Fi Protected Access (WPA and WPA2) serves as the most commonly used encryption protocol [START_REF] Wigle | Statistics[END_REF].

While WPA2 was widely believed to be secure against direct attacks on the protocol, Vanhoef and Piessens described a practical attack against both WPA and WPA2 networks, allowing for decryption and manipulation of data sent in these networks. The so-called Key Reinstallation Attack (KRACK) [START_REF] Vanhoef | Key reinstallation attacks: Forcing nonce reuse in WPA2[END_REF] was the first non-vendor-specific attack described to allow full decryption of data sent through the Wi-Fi stream.

KRACK makes use of flaws in cryptographic handshakes used to authenticate clients in wireless networks secured by WPA and WPA2. Most importantly, the 4-Way Handshake and the Group Handshake can be attacked. In an attack scenario, a victim is 'tricked' to reinstall an already used session key, severely undermining the security of the wireless network. A successful attack on the 4-Way Handshake allows for replay attacks and decryption of the data stream in Jake Weidman is now with Google. The work was partially completed while being a visiting scholar at the Technical University of Munich.

networks secured by the TKIP and CCMP protocols. In TKIP-secured networks, the attacker is also able to forge the traffic between client and access point. The attack settings are not restricted to certain scenarios, and could, therefore, be used in private, commercial, and policy settings.

The newly developed WPA3 standard replaces the 4-Way Handshake with Simultaneous Authentication of Equals (SAE) and thereby mitigates the previously described KRACK attack vector. However, recently discovered vulnerabilities, including Denial-of-Service (DoS) and downgrade attacks, may allow an attacker to force access points to revert back to the WPA2 protocol and effectively circumvent the stronger protection of WPA3 [START_REF] Vanhoef | Dragonblood: Analyzing the Dragonfly handshake of WPA3 and EAP-pwd[END_REF]. Such vulnerabilities could possibly slow down the adoption of WPA3. Further, in early 2020, related flaws were discovered in common Wi-Fi chips, affecting an estimated number of one billion devices [START_REF] Cermak | Serious vulnerability deep inside your Wi-Fi encryption[END_REF].

In addition, older devices, which are not provided with security updates anymore (or slow update behavior by users) could leave large numbers of devices unpatched even after corrective updates are introduced. This is especially true for operating systems on mobile devices -smartphones and tablets -which often have a far shorter support life cycle than desktop devices [START_REF] Farhang | Take it or leave it: A survey study on operating system upgrade practices[END_REF][START_REF] Google | Learn when you'll get Android updates on Pixel phones & Nexus devices[END_REF][START_REF]Windows lifecycle fact sheet[END_REF].

The main goal of this work is to analyze the awareness and security measures taken in a sample of private households concerning KRACK and, more generally, Wi-Fi security via an exploratory interview study. Our work aims to help better understand and tackle the existing problems in Wi-Fi security and to outline possible ways for improvements of update and information propagation practices in this problem domain.

Related Work

Relevant to our study are the update support practices by vendors, which vary substantially. Microsoft offers support for their Windows desktop products for five to ten years [START_REF]Windows lifecycle fact sheet[END_REF]. For Apple, the average time of support for OS X 10 variants is around 40 months [12]. Apple's iPhone products receive updates generally for a period of three to five years [START_REF] Richter | How long does Apple support older iPhone models[END_REF]. Updates for Android -a more open ecosystem -depend heavily on the vendor [START_REF] Farhang | An empirical study of Android security bulletins in different vendors[END_REF]. Google's Nexus and Pixel devices are supported with updates for about three years [START_REF] Google | Learn when you'll get Android updates on Pixel phones & Nexus devices[END_REF].

How Wi-Fi-related security vulnerabilities can create high risk scenarios for the user has been previously shown, for example, by Petters [START_REF] Wischnjak | Immer Ärger mit der Easybox[END_REF]. In 2012, he presented a flaw in routers manufactured by Arcadyan, including so-called Easy-Boxes distributed by Vodafone. The patents of Arcadyan revealed how the factory WPA key was calculated using the publicly broadcasted BSSID of the router. This allowed an attacker to gain complete access to a secured network by only recording the public MAC-address of the router. In 2013, Viehböck showed that through a similar flaw in the WPS algorithm it was possible to hack affected routers, even if the device password had been changed [START_REF] Viehboeck | Vodafone Easybox default WPS PIN algorithm weakness[END_REF].

For the user perspective, a series of AOL/NCSA Online Safety Studies (see, for example, the 2004 version [1]) used an approach (partly exemplary for our study) where security perceptions of participants were directly correlated with the factual security status of the devices in their own homes. Poole et al. [START_REF] Poole | Computer help at home: Methods and motivations for informal technical support[END_REF] further elaborated on the high need for IT support in private households and the problems arising as the result of using different providers and vendors, as well as having different sources of user knowledge.

Methodology and Participant Data

The research topic was approached in a qualitative way by performing exploratory semi-structured interviews in interviewees' own homes. Prior to the interview, a short questionnaire was given to the participants, which included questions about demographics and participants' Wi-Fi usage and management as well as their network topology. During the interview, more in-depth questions were provided; structurally divided in five segments. The objective of the first three segments was to provide a deepening structural tree from more broad Wi-Fi and security questions before focusing on the topic of KRACK. The questions in the fourth segment were focused on a broader understanding of security and update-related issues, aiming to find possible mitigations for challenges regarding security updates and insufficient information propagation (to learn about security problems and mitigations). The final part consisted of three questions, tracking possible behavioral changes and reactions to the interview process itself. Following the interview, an additional survey was provided to the participants, allowing us to gather information about update practices and to further evaluate participants' security assessments.

Participants were recruited (in March 2018) through snowball sampling with a focus on achieving a relatively diverse distribution of participants from different social environments and anticipated technological backgrounds to allow the gathering of insights from different perspectives. They were required to be living in a multi-person household and to have their own Wi-Fi network. The interviews were recorded, and subsequently transcribed and anonymized such that no personally identifiable information was present during the analysis process. During the design and execution of the study, we followed recommended community practices for running security usability studies [START_REF] Schechter | Common pitfalls in writing about security and privacy human subjects experiments, and how to avoid them[END_REF].

The study was conducted in the Munich area, Germany. Of the 16 participants, 2 were female, and 14 were male. Nine of the participants were students from different universities and fields of study. Other occupations included a nurse, a pensioner, an unemployed and a self-employed individual. All participants had reached matriculation standard in their education. Two, additionally, had completed vocational education, one a bachelor's degree, and two held a diploma. The average age of the participants was 28.75 years (min = 20; max = 61). Laptops were present in every household; only one household did not have smartphones present. Desktop and tablet devices were used in about half of the households.

Results

Wi-Fi usage and sensitive data. Questions about Wi-Fi usage (from the survey) allowed for gathering of information about general Wi-Fi practices and the possibility of (sensitive) data leakage. On a scale from 1 (rarely used) and 5 (always used), browing ranked highest (4.0) followed by streaming (3.8), office work (3.6), social media (2.7) and eventually gaming (2.1). Every person in our sample was using their Wi-Fi for office work and media streaming at least sometimes, whereas some people never used it to play games or to access social media platforms. All of these scenarios could possibly leak private data, which should not be publicly available. Higher level encryption not ensured. Since the KRACK attack is performed through intercepting data in transmission, securing the transfer layer could be one possible mitigation; also for similar forms of attack. When asked whether participants pay attention to Transport Layer Security (TLS) and to the Hypertext Transfer Protocol Secure (HTTPS), the answers were rather ambiguous. The evaluation shows that there was no clear tendency in this sample group. The statement from Participant 3 is transferable to most others: "It depends on the context. If I do some unimportant activities no, but if it is concerned with user or banking data yes."

The data also shows, that 10 participants (62.5%) had never used a VPN before. Only one participant used a VPN service most of the time to achieve a higher level of security. Others used the technology for work or study purposes; mostly to get access to remote file locations. We found that 13 participants (81.25%) had never used TOR, or a similar onion routing technique, before. Most of them did not recall ever hearing about this way of anonymization. Only one participant did use TOR on a regular basis. Is your Wi-Fi safe? Even though every participant used their Wi-Fi on a daily basis with several devices, half of them perceived their Wi-Fi network as insecure (50.0%). In contrast, only 6 participants (37.5%) believed their Wi-Fi network to be secure, while two individuals considered their networks partly secure (12.5%). Most argued that the lack of security comes from their own actions, mostly from choosing and handling their respective Wi-Fi passwords in an insecure fashion. One example included giving the password to outside parties, like Participant 2: "No [...] because my password is [***]. 3 It is really weak. Why else? Probably, because everyone in the house knows my password." Another reported practice was taking pictures of the factory settings and sending them using messenger apps to other individuals.

Another rather peculiar case was Participant 8 (and a flatmate), who wrote the factory password on a sheet of paper and put it on a kitchen cabinet. This alone would be problematic, because it would empower anyone having access to the kitchen to attain the password. However, their password is also visible for people outside passing by their flat, since it is hung directly beside a window: "We have it hanging there. [...] This would be such a critical point. If you look through the window, you can see our Wi-Fi password." Factory Settings. Another potential vulnerability for home networks is not changing the default password and continuing using the factory setting. Indeed, many participants still use their routers with the implemented factory settings, although every manufacturer should have instructed them to change these settings. Awareness of the potential threat through an unchanged factory password differed widely across the interviewed participants. Whereas some were aware of a potential vulnerability and changed their password accordingly, like Participant 15, who when asked about why he believes his Wi-Fi network to be secure, said: "Because of the password. Which was not the original password." Others did not show such awareness at all (Participant 14): "No. I trust it." Interestingly, some participants were aware of this possible threat, and even recognized it as an attack vector, but still did not change their password.

Perceived risks. A possible explanation for such observed behavior may be related to the perceived threat model. Most of the participants see similar hazards concerning Wi-Fi networks. A commonly stated risk was the leakage of personal or sensitive data and the possibility of someone getting access to the network and thereby allowing the attacker to use the internet under the resident's identity. The possibility of attackers gaining access to personal and private data was described, for example, by Participants 10 and 13. Such data could then also be leaked to be publicly available. Participant 10 stated: "That everything I do is accessible to others -which websites I use." Participant 13 mentioned: "Getting your personal data hacked and having it presented to the whole public." Participant 1 remarked the possibility of gaining further access to other devices and the possibility of identity theft: "He could get in my home network, see my hard drives, and surely could get remote access to my computer -at least I could imagine. And of course he could take my identity by using my network." Similarly, Participant 8 stated: "Or he could do some strange internet stuff with our IP. Doing something illegal and stuff like that with our IP."

When taking a deeper look into what participants see as sensitive data, it was firstly defined as connected to information related to financial holdings. Among these were passwords for online banking or credit card PINs. Participant 2 remarked: "Banking information. Everything directly connected to money." Secondly, more sophisticated and indirect attacks to gain access to privacyconcerning data were also mentioned. Indeed, several participants identified data as sensitive which would make themselves or others victims of blackmail and extortion. Participant 2 stated: "Or pornos and stuff which would allow for blackmailing. Maybe if you Google for medical or embarrassing stuff. Or drug related things." The listed information could pose a high risk for the victim when leaked publicly. Perceived risks could be the loss of their job, or being shamed in public or by family or friends.

Victims. Most participants were certain that they would not be the target of cyberattacks. Some argued this based on the environment they were living in, like Participant 11 who resides in a small village: "If I would be living in a bigger city or something like that, I would be more concerned." Others, like Participant 8 noted: "There are many old people in our neighborhood. They are happy if their computer is starting."

However, most argued that their own data or information would be irrelevant to others. As an example, Participant 14 stated: "If I had sensitive data, I would be more concerned." Likewise, as participant 15 put it: "It is exactly like your smartphone: When you type something into Google or when Google tracks you regardless whether your location is on or off. It is the same -it is as bad as if someone would get your data through such an attack." These sentiments represent a potential hindrance for further investments in security. Many participants had a "Not Me" mindset, meaning that they do not see themselves as possible victims. The present culture of data collection and data privacy invasions further appears to feed such mindsets as the quotes indicate [START_REF] Solove | I've got nothing to hide and other misunderstandings of privacy[END_REF].

Through the linking of sensitive data with money and the potential for extortion, certain other classes of possible victims were named. Among these were politicians, prominent figures and, interestingly, professors. As Participant 2 stated, when asked if he does see himself as a possible victim: "No. Celebrities maybe or professors. People who are more important than me." Different to these mostly general assumptions about possible victims, Participant 14 was able to describe an example from his work-related situation: "One of my clients is an interior architect and among other things deals with alarm systems. That's very important data. Knowing that she has designed a certain house, she explicitly could be attacked."

The responses show that participants were able to connect sensitive data and attack scenarios. But, interestingly, they do not see such a connection given their own situation or personal environments. Attackers. The description of possible attackers, which could make use of flaws in Wi-Fi networks or IT vulnerabilities in general, differed between participants. Nevertheless, three basic types can be extracted from the answers given in the interviews: intelligence agencies, monetary interests and corporate and economic espionage, and miscreants.

One quote (by Participant 4), in particular, highlights the perceptions regarding information gathering or extortion and thereby gaining political power: "There are people -spies -which are interested in what people do or say. Everyone knows that government surveillance agencies -keyword Trojan 4 -have the possibilities. And they use them, too." The motives of blackhat hackers are either described as being about gathering money, or like Participant 13 noted, as wanting to cause destruction: "People who do this as some kind of hobby. They don't get anything from it, but do it solely to harm others." This point outlines a problem with the "Not Me" mindset: Someone without a well-defined agenda is not prone to economically rational modes of operations, since his benefits do not lay in gaining money or political power, but are solely hedonistic -in this case causing mayhem. Such scenarios do not offer a clear distinction between non-victims and victims and are thereby potentially dangerous for everyone.

The presented descriptions of dangers and pictorials of victims and attackers quite possible indicate the cause of participants' lack of secure behavior; especially their feelings of unimportance and the presence of a "Not Me" mindset. Knowledge about KRACK. From all participants in this study, only two did recall hearing about KRACK beforehand (12.5%). However, most participants previously stated that they felt informed about security and technology in general -some would even try to gather specific information and news concerning IT and computer security. Interestingly, most of them did not recall the media reports connected to the KRACK Attack and the underlying WPA flaws, even though the attack was covered by major German mainstream media, like the Süddeutsche Zeitung [START_REF] Tanriverdi | Forscher durchlöchern Wlan-Sicherheit[END_REF] and the Handelsblatt [4]. This missing knowledge by itself could be problematic, but it also clearly shows a problem in information propagation.

In our sample, only 6 participants (37.5%) were concerned about attacks like KRACK. When going into detail, it became clear that again most did not see themselves among the potential victims. Nearly all agreed, that the possible dangers for others could be quite high, which is consistent with findings from above: Assessing a vulnerability as problematic, but not counting themselves among the likely victims. Security assessment. No participant in this group reported to have checked the security status with respect to KRACK. Our analysis revealed that 43.75% of the participants believed their devices to be secure. Only two participants believed their devices to be likely insecure.

We found that 37.5% of Android devices (6/16) and 62.5% of iOS devices (5/8) in this sample were still vulnerable to KRACK. It appears that the rather short overall update period for smartphones, mostly between two and four years, does not suit the longer usage period of such devices. Most vulnerable devices were indeed not applicable for security updates anymore, only two iOS devices, which could have been updated, were not updated by the user. Desktop and Notebook Devices: No macOS (0/2) or Linux devices (0/7) were still vulnerable, and only a minority of Windows PCs (18.75%, 3/16) were still vulnerable. It should be noted that the only affected Windows PCs were either older XP models, or in one case a Windows 10 PC were the user used a registry hack to prohibit the operating system from updating. All others were running Windows 7 or 10 and had the appropriate security updates installed.

In our sample, mobile devices were far more often vulnerable to the KRACK Attack. Further, nearly all affected devices were outside of the respective support time frame, which for mobile devices is usually far shorter than for desktop devices. Taken together, in this sample, 10 out of the 16 households (62.5%) had at least one vulnerable device present, and several had multiple vulnerable devices.

Further, a significant difference between the assessment of security and the actual security was present. Only five participants did assess their security status correctly, whereas seven did not. Out of these seven, six overestimated their security status. Four participants were not able to assess their status at all. Most households had vulnerable devices present -even though the attack and first updates were presented more than half a year before.

Communication. One question covered the widely discussed topic of enforcing updates without direct user consent. Most participants were clearly against this kind of enforcement. They mostly cited a loss of independence and the fear of losing functionality.

Participant 9: "I dont want any enforcement. They should know that an update is available, but they shouldn't be pressured."

Therefore, a suitable way achieve a higher level of security, and not in opposition to the participants, would be improving the communication between the users and the providers. Several communication channels should be implemented simultaneously. These should be both direct channels (e.g. email) and indirect channels (newspapers, websites). Most participants want providers and the media to inform them directly. In contrast, government, and in particular intelligence agencies seem to have created a widespread mistrust in governmental institutions.

Participant 7: "I would say better by news or public media. Instead of the government, which would make me feel like my mobile phone is monitored by the government. Any message from them could mean they monitor this."

Discussion and Concluding Remarks

Update Supply and Propagation. When updates are provided, participants seem to perform them on a regular basis. However, our data suggests that desktop devices are far better secured against such attacks than mobile devices. Desktop devices are usually supported with updates over a longer period of time. In opposition to that, support cycles for smartphones are far shorter. Nearly all mobile devices are highly dependent on the manufacturer of these devices. When the support period expires, a switching of operating systems is usually impossible.

The widespread usage of proprietary software and firmware -in this case contrary to open source software -extends the manufacturers' field of responsibility, since it is impossible for non-expert users, even with some technical knowledge and abilities, to control these software parts. Such software and the subordination to specific providers are prone to be problematic, since they further increase the dependence on these providers and hinder other parties from taking care of flaws or insufficient update provision.

Lack of Wi-FI Security and Wi-Fi Security Consciousness. Participants often do not engage in secure practices when using or managing their Wi-Fi infrastructure. Most prominently, many do not change factory settings, do not choose or handle passwords appropriately, and do not concern themselves with security updates for these devices (in contrast to computers and phones).

In contrast, nearly all participants seem to be generally aware that a variety of security threats and attack scenarios may exist. But they do not apply these dangers to themselves. Users often do not see themselves as potential victims, because of a perception of lack of importance of their devices and data, and an overall missing consciousness regarding data privacy. Knowledge and Information Propagation. Judging from the presented findings, participants seem not to be informed about security flaws and vulnerabilities regarding their devices or the underlying techniques in general. The same applies for dangers associated with insecure devices or data leakages, both in personal and social settings.

How these issues could be addressed cannot be satisfactorily discussed in this short work. the somewhat variable findings suggest that multiple ways should be present simultaneously. These ways include direct and indirect communication. For specific persons and vulnerability situations, a direct approach, in which households are contacted through mail or other direct communication channels, seems to be fitting. This form of information should be done by the manufacturers or providers themselves. However, this direct communication cannot fully substitute public announcements -especially in scenarios where high portions of the deployed devices are affected, like in the example of KRACK. However, the preferences for ways of informing about security flaws and dangers were very diverse necessitating a flexible approach using different ways of communication. Update Without Consent. Users want to keep sovereignty over their owned devices, meaning that almost all of the participants in this sample did not want their devices to update without direct consent. In addition to the possible loss of functionality, most are concerned with a general loss of control over their device. However, in today's complex setting of connected devices, this desire can only be securely satisfied if people are generally able to fulfill the underlying responsibilities; likely in conjunction with adequate novel tools. On the one hand, we have the individuals' wish for sovereignty and control; on the other hand, the need for ensuring a secure collective infrastructure.

The password was given without any questioning and despite we asked the participant not to tell passwords or similar compromising information.

Participant refers to the so-called "Bundestrojaner", a controversial German state sponsored Trojan access tool used to secretly examine IT devices[START_REF] Buermeyer | Gutachterliche Stellungnahme zur öffentlichen Anhörung zur Formulierungshilfe des BMJV zur Einführung von Rechtsgrundlagen für Online-Durchsuchung und Quellen-TKUe im Strafprozess -Ausschussdrucksache[END_REF].

Acknowledgements: We thank the anonymous reviewers for their constructive feedback.


Bilge Yigit Ozkan✉
email: b.yigitozkan@uu.nl

Marco Spruit
email: m.r.spruit@uu.nl

Addressing SME Characteristics for Designing Information Security Maturity Models

Keywords: Information Security, Maturity Model, Assessment, Process Improvement, Organisational Learning, SME

This paper identifies the effects of small and medium-sized enterprises' (SME) characteristics on the general design principles for maturity models in the information security domain. The purpose is to guide the research on information security maturity modelling for SMEs that will fit in form and function for their capability assessment and development purposes, and promote organizational learning and development. This study reviews the established frameworks of general design principles for maturity models and projects the design requirements of our envisioned information security maturity model for SMEs. Maturity models have different purposes of uses (descriptive, prescriptive and comparative) and design principles with respect to these purposes of uses. The mapping of SME characteristics and design principles facilitates the development of an information security maturity model that systematically integrates the desired qualities and components addressing SME characteristics and requirements.

Introduction

Small and medium-sized enterprises (SMEs), which are the predominant form of enterprise and make up 99.8% of European enterprises in the Organisation for Economic Co-operation and Development (OECD) area [START_REF]Position Paper on European Cybersecurity Strategy: Fostering the SME ecosystem[END_REF], are ill-prepared for cyberattacks [START_REF] Bilge Yigit Ozkan | Modelling adaptive information security for SMEs in a cluster[END_REF]. One way of tackling the challenges of managing and implementing information security is through the use of maturity models [START_REF] Bilge Yigit Ozkan | Modelling adaptive information security for SMEs in a cluster[END_REF]. Originating from software engineering, maturity modelling is a method for representing domain specific knowledge in a structured way in order to provide organizations with an evolutionary process for assessment and improvement [START_REF] Yigit Ozkan | A Questionnaire Model for Cybersecurity Maturity Assessment of Critical Infrastructures[END_REF] [START_REF] Becker | Developing Maturity Models for IT Management[END_REF].

Previous research shows that maturity models promote greater levels of organisational learning [START_REF] Bititci | Value of maturity models in performance measurement[END_REF]. Organisational capabilities are developed through organisational learning processes [START_REF] Curado | Organisational learning and organisational design[END_REF]. From a socio-technical perspective, since information security domain is quite complex [START_REF] Tisdale | Architecting a Cybersecurity Management Framework: Navigating and Traversing Complexity, Ambiguity, and Agility -ProQuest[END_REF], the value of maturity models is indisputable for developing the necessary information security capabilities. Addressing the characteristics and the requirements of the target organisation will yield to more effective individual and organizational learning and development.

From the perspective of information security maturity models (ISMM), there is a need to facilitate SMEs with tailor-made models that are more situation aware and that can adapt to their specific needs [START_REF] Mijnhardt | Organizational Characteristics Influencing SME Information Security Maturity[END_REF]. In a recent study for adaptive information security modelling for SMEs, the authors state that utilisation of maturity models for self-assessing information security capabilities can be a remedy for SMEs [START_REF] Bilge Yigit Ozkan | Modelling adaptive information security for SMEs in a cluster[END_REF].

There have been studies conducted on the development and design of maturity models. Mettler [START_REF] Mettler | A Design Science Research Perspective on Maturity Models in Information Systems -Alexandria[END_REF] investigated maturity models as a subject of design science. Becker et al. considering maturity models as design science artifacts, propose a procedure model that distinguishes eight phases in the development of maturity models [START_REF] Becker | Developing Maturity Models for IT Management[END_REF]. De Bruin et al. propose a methodology to generalize the phases of developing a maturity model and outlined the main phases of generic model development [START_REF] De Bruin | Understanding the Main Phases of Developing a Maturity Assessment Model[END_REF]. Pöppelbuß and Röglinger propose a framework of general design principles for maturity models [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF].

The utilisation of maturity models in different organisational structures has been another aspect that has been studied in the literature. Mettler and Rohner present a first design proposition of a situational maturity model [START_REF] Mettler | Situational Maturity Models As Instrumental Artifacts for Organizational Design[END_REF]. In the information security domain, there have been several studies addressing the effect of organisational characteristics. Mijnhardt et al. investigated organisational characteristics influencing SME information security maturity [START_REF] Mijnhardt | Organizational Characteristics Influencing SME Information Security Maturity[END_REF]. In this study, they focused on four different categories of characteristics (General, in and out sourcing, IT dependency and IT complexity). These categories include 11 characteristics such as size, revenue, number of employees, time an organization can run without IT support.

Baars et al. conclude that a maturity framework should consider the differences between the characteristics of their target organizations [START_REF] Baars | An analytics approach to adaptive maturity models using organizational characteristics[END_REF]. There have also been cluster based approaches to SME information security [START_REF] Mayer | A Cluster Approach to Security Improvement according to ISO/IEC 27001[END_REF] [START_REF] Bilge Yigit Ozkan | Modelling adaptive information security for SMEs in a cluster[END_REF].

The design principles applied during the development and design of the maturity models affect their applicability in several ways. For example, designing a situational-aware maturity model enables its adaption to different organisational contexts. Being inspired by the studies investigating the maturity models as design artifacts [START_REF] Becker | Developing Maturity Models for IT Management[END_REF] [START_REF] Mettler | A Design Science Research Perspective on Maturity Models in Information Systems -Alexandria[END_REF] and those providing guidance on the design and development of maturity models [START_REF] De Bruin | Understanding the Main Phases of Developing a Maturity Assessment Model[END_REF] [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF], the research question this paper addresses is formulated as follows.

"How can SME characteristics be addressed for designing information security maturity models?"

The purpose is to support the development of SME aware ISMMs as design artifacts that will promote greater levels of individual and organisational learning.

To answer this research question, we used the SME characteristics resulting from a literature review [START_REF] Cocca | SMEs' Three-step Pyramid: A new Performance Measurement Framework for SMEs[END_REF]. These characteristics guided us to identify the "boundary/context" as discussed by Cronholm & Göbel in their study on guidelines supporting the formulation of design principles [START_REF] Cronholm | Guidelines Supporting the Formulation of Design Principles[END_REF]. We discuss the effects of the SME characteristics' [START_REF] Cocca | SMEs' Three-step Pyramid: A new Performance Measurement Framework for SMEs[END_REF] on the general design principles [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] and propose 16 design requirements for an ISMM for SMEs.

The rest of the paper is organised as follows. First, background and related research are presented. Second, the general design principles for maturity models [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] are investigated with respect to SME characteristics and the findings are presented. Third, the associations between the SME characteristics and the design principles are presented by including the proposed design principles as a summary. Finally, conclusions are drawn.

2

Background and Related Research

Design Principles

To date, several studies have investigated the phenomenon of "Design Principles". According to Hevner and Chatterjee, a principle is a clear statement of truth that guides or constrains action. A principle can also be formed as a rule or a standard of conduct [START_REF] Hevner | A Science of Design for Software-Intensive Systems[END_REF]. Jones and Gregor state that design principles "… define the structure, organization, and functioning of the design product or design method" [START_REF] Jones | The Anatomy of a Design Theory[END_REF]. Chandra et al. focused on the characteristics of effective design principle formulation [START_REF] Chandra | Prescriptive Knowledge in IS Research: Conceptualizing Design Principles in Terms of Materiality, Action, and Boundary Conditions[END_REF]. A recent study by Cronholm & Göbel proposed guidelines supporting the formulation of design principles [START_REF] Cronholm | Guidelines Supporting the Formulation of Design Principles[END_REF].

Design Principles for Maturity Models

In the literature, the maturity models are distinguished by their purpose of use as descriptive, prescriptive and comparative. The maturity models for descriptive purpose of use focus on the assessment of the as-is capabilities of an organisation. The maturity models for prescriptive purpose of use provide guidance on how to proceed on the evolutionary path of the maturity levels. The maturity models for comparative purpose of use enables internal and external benchmarking through the assessment results [START_REF] Becker | Developing Maturity Models for IT Management[END_REF][START_REF] De Bruin | Understanding the Main Phases of Developing a Maturity Assessment Model[END_REF][START_REF] Maier | Assessing Organizational Capabilities: Reviewing and Guiding the Development of Maturity Grids[END_REF]. De Bruin et.al. argue that even though maturity model types (descriptive, prescriptive and comparative) can be seen as distinct types, they actually represent evolutionary phases of a model's lifecycle. In the final phase of this lifecycle, to be used comparatively the model must be applied in a wide range of organizations in order to attain sufficient data to enable valid comparison [START_REF] De Bruin | Understanding the Main Phases of Developing a Maturity Assessment Model[END_REF].

Pöppelbuß and Röglinger proposed general design principles (DPs) for maturity models grouped according to typical purposes of use and justified on the foundation of maturity modelling literature [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF]. It is important to note that Pöppelbuß and Röglinger states that they deliberately omitted the comparative purpose of use as the fact of whether corresponding DPs can be met largely depends on external factors [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF].

SME Characteristics

Several studies in the literature suggest that SMEs may be differentiated from larger companies by a number of key characteristics [START_REF] Cocca | SMEs' Three-step Pyramid: A new Performance Measurement Framework for SMEs[END_REF] [21] [START_REF] Hudson | Introducing integrated performance measurement into small and medium sized enterprises[END_REF]. Different approaches to the phenomena of organisational characteristics were taken in the literature. Yu et al. abstract organisations as organic entities similar to humans and investigate organisational characteristics in categories theoretically rooted in psychology [START_REF] Yu | The Dimensions of Organizational Character and Its Impacts on Organizational Performance in Chinese Context[END_REF]. Mijnhardt et al. use an indicator-based approach to distinguish between a wide variety of different organizations [START_REF] Mijnhardt | Organizational Characteristics Influencing SME Information Security Maturity[END_REF].

In this paper, we focus on the characteristics present in the literature related to SME research. Cocca and Alberti conducted a literature review and analysed many papers focusing on SMEs in different fields of science [START_REF] Cocca | SMEs' Three-step Pyramid: A new Performance Measurement Framework for SMEs[END_REF]. Their findings were grouped into two main categories: external and internal. The factors related to external environment are typically outside the control of organisation [START_REF] Cronholm | Guidelines Supporting the Formulation of Design Principles[END_REF]. As the implementation of maturity models (MM) is often considered as part of improvement initiatives [START_REF] Helgesson | A review of methods for evaluation of maturity models for process improvement[END_REF], they primarily depend on the internal environment of the organisations [START_REF] Rainer | Key success factors for implementing software process improvement: a maturity-based analysis[END_REF].

In Table 1, we present the internal characteristics that we investigated in regard to their effects to general design principles proposed by Pöppelbuß and Röglinger [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF]. To increase the readability and to enable more comprehensible referral, the third column in Table 1 presents the keywords used for the corresponding internal characteristics. Internal characteristics are related to resources, structure, and management practices. The keywords were selected in a way that we consider they represent the characteristic in a recallable manner.

Addressing SME Characteristics for Designing Information Security Maturity Models

In order to answer the research question, we investigated each design principle proposed by Pöppelbuß and Röglinger [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] and analysed the effect of the internal SME characteristics proposed by Cocca and Alberti [START_REF] Cocca | SMEs' Three-step Pyramid: A new Performance Measurement Framework for SMEs[END_REF] on the design principles. The authors of the paper did this analysis thus the findings need to be validated. We further elaborate on the constraints of validity in the conclusion section.

In this section, we present descriptive and prescriptive design principles proposed by Pöppelbuß and Röglinger [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] and we discuss the effect of SME characteristics, requirements and needs on these design principles. Additionally, we present our insights for the comparative type maturity models. For each design principle, we discuss the SME characteristics' effect on the design principle and we propose design requirements for an ISMM for SMEs. Table 2, Table 3 and Table 4 present basic, descriptive and prescriptive design principles respectively. To increase the readability and to enable a more comprehensible referral, the third column in these tables presents the keywords used for the corresponding design principles. The keywords were selected in a way that we consider they represent the characteristic in a recallable manner.

Basic Design Principles

The basic design principles proposed by Pöppelbuß and Röglinger [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] are given in Table 2.

Table 2. Basic design principles [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] # Principle Keyword For an information security model for SMEs, we elaborate on the basic design principles given in Table 2 as follows.

Regarding Information (DP1.1), the domain coverage and prerequisites for applicability of the maturity model should be provided by possibly referring SMEs to some resources. The prerequisites for applications might be confusing for SMEs who have skill shortages (Skills-IC3), lack of organisational capabilities (Capabilities-IC7) and lack of management expertise (Management-IC4). Regarding the target group, in the case of SMEs, the employees or managers who have the most experience in the information security domain should be addressed (Knowledge-IC8) but poor human resources management might make this difficult to accomplish (HRM-IC17). The results should be reported in an easily understandable way. Since SMEs have short-term vision and orientation (Short-term-IC15) and information security is a continuous initiative, it should be made clear to the target group how the ISMM would be beneficial for their business in the long term (Strategic-IC9). SMEs that are aiming at using the ISMM might not have heard of any other maturity models (Skills-IC3, Capabilities-IC7, Reactive-IC12). Therefore, the differences in the ISMM at hand from the other models available should be made clear. The differences might occur in the domain coverage, the purpose of use, target group, design process and the extent of empirical validation.

DR1 -The information on security domain coverage and prerequisites for applicability of the ISMM should be accompanied by extra resources for SMEs.

DR2 -The long-term benefits of utilising the ISMM should be made clear. DR3 -The differences in the ISMM at hand from the other models available should be made clear.

Regarding Maturity (DP1.2), as information security is a complex domain [START_REF] Tisdale | Architecting a Cybersecurity Management Framework: Navigating and Traversing Complexity, Ambiguity, and Agility -ProQuest[END_REF], a low level of abstraction would provide more granularity and help better realisation of improvement steps to be taken by the SMEs. This design principle is related to IC14, "Learning-by-doing processes", IC16, "Incremental improvements and adjustments" and IC18 "Focus on technical aspects and production". Having these characteristics in nature, SMEs will benefit from a low-level granularity in an ISMM.

DR4 -Low-level granularity should be provided to help better realisation of improvement steps to be taken by the SMEs.

Regarding Domain (DP1.3), it is needed to provide the definitions of central constructs related to the information security domain. The utilisation of any well-known frameworks in the information security domain will increase the understandability of the maturity model [START_REF] Hudson | Introducing integrated performance measurement into small and medium sized enterprises[END_REF]. Well-known standards published by Standard Developing Organisations (SDOs) in the information security domain (e.g. ISO/IEC 27002 [START_REF]Information technology --Security techniques --Code of practice for information security controls[END_REF]) might be a good reference to facilitate the usage of adequate language and understandability of the maturity model. This design principle is related to Skills-IC3, Resources-IC6, and Capabilities-IC7. SMEs having these internal characteristics will benefit by being provided with central constructs that are recognised and well-perceived by their stakeholders.

DR5 -The central constructs that are recognised and well-perceived by SMEs' stakeholders (i.e. standards) should be provided to facilitate the usage of adequate language and understandability of the maturity model.

Regarding Users (DP1.4), given the complexity of information security and the internal characteristics of SMEs (Skills-IC3, Capabilities-IC7, Learning-by-doing-IC14, Improvements-IC16), the documentation of the ISMM should be self-explanatory and easy to understand. Poor human resources management (HRM-IC17) should be considered here as a factor. The risk of Personal Assets (IC5) increases the importance of the ISMM for SMEs. Managing the information security risks reduces the risk of assets which is a direct positive effect for the target group. Providing SMEs with some guidance on how to estimate the cost of efforts with respect to capabilities and maturity levels should be considered (Performance-IC10).

DR6 -The documentation of the ISMM should be self-explanatory and easy to understand. DR7 -The benefit of using the ISMM for protecting the assets should be made explicit. DR8 -The documentation of the ISMM should include guidance on how to estimate the cost of efforts with respect to capabilities and maturity levels.

Design Principles for a Descriptive Purpose of Use

The design principles for a descriptive purpose of use are proposed by Pöppelbuß and Röglinger [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] as follows (Table 3). Regarding Criteria (DP2.1), assessment criteria should be concise, precise and clear as defined by [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] as a general principle, specifically for information security maturity modelling for SMEs, the information source [START_REF] Maier | Assessing Organizational Capabilities: Reviewing and Guiding the Development of Maturity Grids[END_REF] for the criteria should be also be provided. The SME characteristics Skills-IC3, Capabilities-IC7, Learning-by-doing-IC14 and Improvements-IC16 are related to this principle. SMEs would benefit from well-founded assessment criteria as they rather plan for small steps of improvements (Learning-by-doing-IC14 and Improvements-IC16) and they have a lack of expertise and capabilities.

DR9 -The assessment criteria should be concise, precise and clear and the information source for the assessment criteria should be provided.

As a consequence of several SME characteristics related to lack of expertise and skills (Skills-IC3, Resources-IC6, Capabilities-IC7), SMEs might prefer to outsource the management and implementation of information security. Outsourcing information technology infrastructure is also an identifier in the decision to outsource the security of this infrastructure. Regarding Assessment (DP2.2), outsourcing decisions should be one of the parameters to consider for the applicability of assessment criteria.

DR10 -The assessment methodology should enable the configuration of the criteria according to SMEs' outsourcing decisions.

The European Digital SME Alliance has recently published a position paper on the EU Cybersecurity Act and the role of standards for SMEs [START_REF]The European Digital SME Alliance: The EU Cybersecurity Act and the Role of Standards for SMEs[END_REF]. In this paper, the need for distinction between different types of SMEs is emphasized. The reason of this differentiation is presented as to make sure that cybersecurity solutions and standards are tailored to them. Regarding Assessment (DP2.2), the SME categories proposed by the Digital SME Alliance can be considered to configure the assessment criteria provided by the maturity model (Knowledge-IC8).

DR11 -The assessment methodology should enable the configuration of the criteria according to different categories of SMEs' according to their role in the digital ecosystem.

The assessment methodology should be reusable to allow multiple assessments and comparisons over the time of the assessment results to present and observe the improvement [START_REF] Cholez | Maturity assessment and process improvement for information security management in small and medium enterprises[END_REF].

Design Principles for a Prescriptive Purpose of Use

The design principles for a prescriptive purpose of use are proposed by Pöppelbuß and Röglinger [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] as follows (Table 4). Table 4. DPs for a prescriptive purpose of use [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF] # Principle Keyword Regarding I-Measures (DP3.1), prescriptive maturity models must include improvement measures that enable the development of a road-map for improvement [11] [10]. In consideration of information security as the application domain and SMEs as the target group for maturity modelling, the improvement measures should be organised in small and achievable steps which could be facilitated by lack of bureaucracy (Structure-IC2, Learning-by-doing-IC14, Improvements-IC16). DR12 -The improvement measures should be organised in small and achievable steps. DR13 -The improvements required to progress to the next maturity level should be explicit.

D-Calculus (DP3.2) is related to decision alternatives and prioritization for improvement planning. Improvement objectives may stem from different sources e.g. internal (management) or external (customers). Given the limited skills, resources, capabilities and management expertise of SMEs (Skills-IC3, Management-IC4, Resources-IC6 and Capabilities-IC7), the decisions for choosing amongst different improvement road-maps is more critical and needs to be justified thus should be further supported to be clear and rational.

DR14 -Clear and rational guidelines should be provided for selecting the improvement measures.

In addition to providing a well-grounded decision for improvement, regarding D-Methodology (DP3.3), a maturity model should also provide SMEs with the tailored advice for adapting the improvement measures considering their role in the digital ecosystem [START_REF]The European Digital SME Alliance: The EU Cybersecurity Act and the Role of Standards for SMEs[END_REF], flexibility, control and decision-making mechanisms (Flexibility-IC1, Knowledge-IC8, Control-IC11, Decision-IC13).

DR15 -Tailored advice for adapting the improvement measures should be provided for different categories of SMEs.

Design Principles for a Comparative Purpose of Use (CPoU)

As stated earlier, our reference study for the general design principles, Pöppelbuß and Röglinger deliberately omitted the principles for the comparative purpose of use [START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF]. De Bruin et al. states that for a model to be used comparatively it must be applied in a wide range of organizations in order to attain sufficient data to enable valid comparison. Cholez and Girard presented a framework that allows multiple assessments and successive comparisons over the time of the assessment results in their study on information security maturity assessment in SMEs. The exemplar assessment result in this study presents a radar graphic depicting the enterprise profile [START_REF] Cholez | Maturity assessment and process improvement for information security management in small and medium enterprises[END_REF]. We recognize that the utilisation of this kind of visuals to present the assessment results for comparative purposes can assist SMEs for better understanding and presenting their as-is and to-be positions. This will help to reduce "Misconception of performance measurement" in regards to Performance-IC19 (Table 1). As stated in Section 3.1, SMEs may gain strategic advantage by comparatively using the assessment results (Strategic-IC9). DR16 -Visual presentation of the assessment results for comparative purposes should be utilized to assist SMEs to better understand and present their as-is and to-be positions.

Mapping of SME Characteristics and Design Principles

In this section, the mapping of internal characteristics given in Table 1 and design principles given in respective tables (Table 2, Table 3, Table 4) are presented here as a summary in Table 5. This table shows the associations between the SME characteristics and the design principles by specifying the corresponding design requirements as discussed in this paper.

Conclusion

In this paper, we investigated the SME characteristics [START_REF] Cocca | SMEs' Three-step Pyramid: A new Performance Measurement Framework for SMEs[END_REF] that may affect the general design principles of maturity models for SMEs [10] [11]. We discuss the possible effect of the SME characteristics on the general design principles and propose 16 design requirements for an ISMM for SMEs.

We present the mapping of the internal SME characteristics and the design principles by specifying the corresponding design requirements as a summary. Since the mapping of the internal SME characteristics and the design principles was done by the authors, it is important to bear in mind the possible bias in these. This limitation stimulates further research to assess the validity of the proposed design requirements by means such as evaluation by SMEs and maturity model developers. Another possibility for future research is a review of a set of existing ISMMs concerning the proposed design principles.

We believe that if the proposed design principles are taken into account from the very start of ISMM development for SMEs, one can systematically account for diverse SME characteristics profiles, thereby significantly increasing the potential usability and applicability of the resulting maturity model. This will yield a better individual and organisational learning with respect to information security.

1. 1

 1 Basic Information Information 1.2 Definition of central constructs related to maturity and maturation Maturity 1.3 Definition of central constructs related to the application domain Domain 1.4 Target group-oriented documentation Users

3. 1

 1 Improvement measures for each maturity level and level of granularity I-Measures 3.2 Decision calculus for selecting improvement measures D-Calculus 3.3 Target group-oriented decision methodology D-Methodology

Table 1 .

 1 Internal characteristics and whether they affect the design of information security MMs for SMEs[START_REF] Cocca | SMEs' Three-step Pyramid: A new Performance Measurement Framework for SMEs[END_REF].

	# Internal Characteristics (IC)	Keyword
	Flexible and adaptable to changes, innovative	Flexible
	Loose and flat structure, lack of bureaucracy	Structure
	Skills shortages	Skills
	Lack of management expertise	Management
	Risk of personal assets	Personal Assets
	Limited resources: time, human, financial	Resources
	Lack of organizational capabilities	Capabilities
	Specialist and tacit knowledge	Knowledge
	Poor strategic planning	Strategic
	Reliance on financially based performance measures	Performance
	Control and decision-making rest primarily with one or a few people	Control
	Reactive, fire-fighting strategy	Reactive
	Intuition-based decision making	Decision
	Learning-by-doing processes	Learning-by-doing
	Short term vision and orientation	Short-term
	Incremental improvements and adjustments	Improvements
	Poor human resource management	HRM
	Focus on technical aspects and production	Technical
	Misconception of performance measurement	Performance

Table 3 .

 3 DPs for a Descriptive Purpose of Use[START_REF] Pöppelbuß | What makes a useful maturity model? a framework of general design principles for maturity models and its demonstration in business process management[END_REF]

	# Principle

Table 5 .

 5 Mapping of SME characteristics and design principles.

	Internal									Design Principles
	Characteristics	Information	DP1.1	Maturity	DP1.2	Domain	DP1.3	Users	DP1.4	Criteria	DP2.1	Assessment	DP2.2	I-Measures	DP3.1	D-Calculus	DP3.2	D-Methodol-	ogy DP3.3	CPoU
	Flexibility (IC1)																	DR15
	Structure (IC2)