Denis Besnard
email: denis.besnard@ncl.ac.ukl.b.arief@ncl.ac.uk

Budi Arief

Computer Security Impaired by Legitimate Users

Keywords: Computer security, cognitive psychology, cost-benefit trade-offs, work practices, risk 1

Computer security has traditionally been assessed from a technical point of view. One other view is about the role played by legitimate users of systems in impairing the level of protection. In order to address this issue, we wish to adopt a multidisciplinary standpoint and investigate some of the human aspects involved in computer security. From research in psychology, it is known that people make biased decisions. They sometimes overlook rules in order to gain maximum benefits for the cost of a given action. This situation leads to insidious security lapses whereby the level of protection is traded-off against usability. In this paper, we highlight the cognitive processes underlying such security impairments. At the end of the paper, we propose a short usability-centered set of recommendations.

INTRODUCTION

Our society is becoming more and more dependent on computer systems, which nowadays are used in everyday life, from business to banking, from entertainment to healthcare. Most of these systems are interconnected through the internet, which inherently is very open and vulnerable to cyber-attacks. Attacks on these systems cause a wide variety of disruptions, ranging from losses in service to financial or safety consequences. The threats that these attacks constitute over the mere use and survival of IT systems have led to wide quantitative surveys (e.g. [START_REF]Computer crime and security survey[END_REF][START_REF]Information Security Breaches Survey 2002[END_REF]).

Because a single attack can freeze an entire sector within hours, securing computer systems has become a very important part of system design, development and deployment. However, the measures implemented are not always as efficient as required. More research and better tools are therefore needed in order to understand, block and anticipate security threats. A novelty may be the growing acknowledgement from the research community that technical solutions alone are not enough any more. Historically, security has been very often addressed from the attackers' side. From this angle, the emphasis has classically been on the motivations and means used to break into systems [START_REF] Denning | Information Warfare and Security[END_REF][START_REF] Gordon | Cyberterrorism?[END_REF][START_REF]Honeynet-Project, Know Your Enemy: Revealing the Security Tools, Tactics, and Motives of the Blackhat Community[END_REF][START_REF] Mcclure | Hacking Exposed: Network Security Secrets & Solutions[END_REF][START_REF] Taylor | Hackers: Crime in the Digital Sublime[END_REF]. However productive this research area has been and still is, it tends to blur the exact role of the legitimate users (e.g. end-users, security officers, managers, designers) who are also actively involved in computer security impairments. It seems to the authors that this other angle is worth exploring as well. Moreover, as part of the DIRC 1 research, we are interested in interdisciplinary aspects of computing. For these reasons, some aspects of the role played by legitimate users with regard to security are addressed in this paper.

Computer security is an area that cognitive scientists have not investigated as deeply as humancomputer interaction or problem solving. It nonetheless offers an interesting aspect in the sense that there are conflicting objectives held by some of the actors of a single system, namely attackers and legitimate users. It follows that depending on the goal that an actor is pursuing (attack or legal use), the use of a given computer system will differ dramatically. Whereas the roles of attackers are pretty clear (e.g. intrusion, denial of service), those of legitimate users regarding security are more subtle. Stemming from this assumption, we will examine some of the latter's practices and shed some light on the mental processes involved. We will try to assess the extent to which computer security can be interpreted in terms of an intuitive cost-benefit tradeoff.

The rest of the paper is laid out as follows. The next section (section 2) provides some background about trade-offs in the workplace. We then investigate the cognitive aspects of tradeoffs (section 3) and expose some examples of insecure computing practices (section 4). The paper then discusses risk issues, the antagonism among some of the security actors, as well as organisational policies (section 5). This is followed by a set of recommendations (section 6), bearing in mind some limitations (section 7). The article concludes with some brief reflections on the status of computing in modern society.

TRADE-OFFS IN THE WILD

Since Simon [START_REF] Simon | Models of Man[END_REF] and his concept of bounded rationality, it is accepted that human actions do not reach perfection but instead seek an acceptable level of performance with respect to their goals and what the cognitive resources allow. The fact that the cognitive system never aims at handling all the data available in the environment is a central aspect of the cognitive resources saving strategy. As a consequence, cognitive acts are an intuitive and implicit trade-off which balances cost and efficiency [START_REF] Bainbridge | Difficulties in complex dynamic tasks[END_REF][START_REF] Todd | The Influence of Decision Aids on Choice Strategies Under Conditions of High Cognitive Load[END_REF]. This strategy is put in place for the majority of human actions and therefore applies to an extremely wide class of situations, e.g. troubleshooting [START_REF] Bhandari | Optimal probe selection in diagnosis search[END_REF], medical prescriptions [START_REF] Evans | General practitioners' tacit and stated policies in the prescription of lipid lowering agents[END_REF], control of dynamic situations [START_REF] Amalberti | La conduite des systèmes à risques[END_REF]. Just like in other activities, trade-offs introduce a risk (see for instance [START_REF] Hoc | Diagnostic et prise de décision dans les situations dynamiques[END_REF]) by not taking into account some possible consequences deriving from the decided actions. In the case of IT security, trade-offs and risk can thus combine themselves and implement a threat. Therefore, our purpose will be to assess the relevance of trade-off mechanisms regarding security impairments. Before we consider computer security, it can be useful to have a look at a field example. Although the latter is quite remote from computing, we think it puts things clearly and shows how the parameters of a trade-off are handled by humans.

On December 30, 1999, in Tokaimura (Japan), an accident occurred at the JCO nuclear fuel processing plant, causing the death of two workers (see [START_REF] Furuta | Human factor analysis of JCO criticality accident[END_REF]). The immediate cause of the accident was the pouring of approximately 15kg of uranium into a precipitation tank. Since there is a limited amount of uranium that can be put together without initiating fission, this procedure required mass and volume control. As the critical mass was exceeded, a chain reaction occurred, generating lethal radiations. The workers' task was to process seven batches of uranium in order to produce a uranium solution. The tank required to process this solution is called a buffer column. At JCO, its dimensions were 17.5 cm in diameter and 2.2 m in depth, a geometry permitting a better control of fission reactions. The inside of this tank was known to be difficult to clean. In addition, it was positioned only 10 cm above the floor, making it difficult to collect the uranium solution from the bottom of the column. Thus, workers illegally opted for using another (larger) tank called precipitation tank. Due to its dimensions, this latter tank was not geometrically safe but it was positioned 1 m above the floor. Moreover, it was equipped with a stir propeller making it easier to use for homogenising the uranium solution. The pouring of the 15kg of uranium at once triggered the criticality accident. Its causes were rooted in a complex combination of deviant organisational practices. Among these, pressures from the managerial team to increase the production without enough regard to safety implications and lack of crew training played a significant role.

In hindsight, we speculate that the operators have traded-off productivity and practicality against risk. As their knowledge about critical uranium masses was poor, they were unaware that they were crossing a safety boundary. This case is an instance of how trade-offs can go wrong. With this example, we want to highlight the workarounds that operators often implement in order to perform daily actions in a less constrained manner (see [START_REF] Gasser | The integration of computing and routine work[END_REF]). These workarounds can be put in place in a wild way, and depending on the level of knowledge and perceived risk, getting the work done sometimes overrides security concerns. Also, we wish to highlight the role of the managerial team at JCO who played an active goal in the triggering of the accident [START_REF] Furuta | Human factor analysis of JCO criticality accident[END_REF]. This latter point is of relevance to our paper and will be addressed later.

Following a cognitive approach, we believe that virtually every decision is a matter of trade-off. Humans do not try to produce perfect responses to the environment. Instead, they tend to accept good enough solutions. We think that this conception of human cognitive activities applies in computer security, for both attackers and legitimate users. The former attempt to design effective worms or denials of service, for instance. The latter, in turn, try to protect themselves as effectively as possible. But in both cases, there are not infinite amounts of resources (e.g. time, money or effort) to allocate to attacking or protecting. This is where human flexibility comes into play: people perform intuitive trade-offs between (some form of) cost and (some form of) benefits. We will consider some concrete computer examples after having briefly explained how the concept of trade-off translates in security.

TRADE-OFFS FROM A COGNITIVE PERSPECTIVE

To better illustrate how we use the concept of trade-off, we represent it graphically in Figure 1.

The dark area at the lower right-hand corner represents the maximum efficiency where one reaches high benefits for low costs. The top left-hand corner, on the contrary, represents a poor efficiency where one spends a lot to gain little. Between these two extremities, there is clearly an entire continuum. The theoretical trade-off line represents a frontier between costs and benefits. Any activity above this line will cost more than it rewards. Conversely, any activity below this line will reward more than it costs.

Having said this, humans do not always obey logic but seek cheap actions with maximum expected benefits. Therefore, the least-effort trade-off line may be a more realistic one. This view is derived from a least effort rule whereby humans attempt to reach an acceptable level of performance with the minimal mental effort [START_REF] Bastien | Les connaissances de l'enfant a l'adulte : organisation et mise en oeuvre[END_REF]. As a consequence, decision making can become a biased benefits-driven process. When applied to a security-usability trade-off, usability may come first, hence turning security into a side-issue. This will be further discussed in section 5.2.

Let us now apply the graph to the simple example of a user considering adding a button to a toolbar in order to access a function more quickly. If the button is going to be used only one time, the time cost of adding it may be higher than the expected time saved during the task. Therefore, it is likely that the button will not be added. On the other hand, if this function is to be used repeatedly, the expected benefits may be worth the time spent in configuring the system. With this simple example, we wish to recall that humans intuitively, though implicitly, evaluate the efficiency of their decisions before they implement them. There are cases where human actions are given explicit limits: decisions can be benefit-driven or cost-driven (see Figure 2). In the first case, a course of actions is interrupted when some objective is met. In the other case, the target is set in terms of cost (money, time, etc.) and actions will stop when the limit is reached. In both cases, the course of actions never follows the straight trade-off line. Instead, we believe it fluctuates with time depending on the given phases of the work. For instance, one may be prepared to temporarily carry out a costly action if high benefits are expected from it later. Classically, attackers are said to exploit security holes left open because of a poor design and/or insecure practices. In other words, the malicious intentions of the attackers are, to some extent, facilitated by the behaviour of some legitimate users. We obviously do not put the blame on them. Neither do we believe that the motives that some attackers promote (e.g. learning, curiosity, challenge, etc.) will ever justify any sort of damage caused to someone's data, tool or service. Having said that, security is a two-way issue. Merely assessing it from the attacker's point of view only captures half of the problem (see [START_REF] Arief | Technical and Human Issues in Computer-Based Systems Security[END_REF] for a survey on attackers' techniques and motivations). The other half is about how we (legitimate users) use our computers.

SECURITY TRADE-OFFS BY LEGITIMATE USERS

From our cognitive standpoint, administrators as well as end-users consider their actions from an economic point of view and trade-off security against usability. This practice, as highlighted in the following sub-sections, introduces threats in systems that attackers exploit. It is not the case that attacks can be easily eliminated, but understanding where trade-offs lie may allow system designers to think more about the interest of making security products and policies compatible with some intuitive notion of usability. This is not only an issue about "comfort of use" but, as we will see in the following sub-sections, is a problem that directly impacts security.

Passwords: a memory issue

Although new approaches towards authentication have been proposed [START_REF] Brostoff | Are passfaces more usable than passwords?[END_REF][START_REF] Brostoff | Ten strikes and you're out: Increasing the number of login attempts can improve password usability[END_REF][START_REF] Jermyn | The design and analysis of graphical passwords[END_REF], passwords still remain a widespread security mechanism. A number of modern software products still tend to force passwords of minimum eight characters long. This tendency probably originates from a desire to control accesses more tightly with the hidden assumption that it will increase privacy of data. Although they are harder to crack, long passwords are not totally secure [START_REF] Nielsen | Security and Human Factors[END_REF]. When one actually looks at what happens at the workplace, human cognitive limitations become obvious: users cannot remember their passwords and need external memories (e.g. sticky notes on monitors). The use of passwords raises several usability problems [START_REF] Adams | Making passwords secure and usable[END_REF]. Security faces a nice paradox where by increasing the complexity and number of passwords, the level of protection could actually decrease [START_REF] Weirich | Pretty Good Persuasion: A First Step Towards Effective Password Security in the Real World[END_REF]. User login and passwords to computer accounts are used very often and are the main method to get access to systems. In this case, frequency compensates for complexity: the password is used often enough to be remembered [START_REF] Sasse | Transforming the weakest link -a human computer interaction approach to usable effective security[END_REF]. But how many counter-examples are there where people have to write down passwords? To cope with this problem, some systems (most notably ecommerce web sites) offer to remember them. Again, for the sake of usability, a user may be tempted to use such storage features (cookies). It is a useful feature but it comes down to the user's judgement as to whether a service or a piece of data is trivial enough so that its password can be stored on a computer. Another drawback is that users may not remember their password if somehow the cookies are emptied (e.g. when the system is rebuilt). The same kind of problem applies to BIOS (Basic Input/Output System) password. Administrators sometimes keep the default password, information that can then be found by anyone on the internet (see for instance [START_REF]Default Password List[END_REF]).

Anti-virus software updates: a risk issue

Anti-virus protections are useful barriers but only when they are up-to-date. They need some attention in this respect. But maintaining, updating and upgrading them has a cost that can conflict with end-user's main task, thereby impacting security. Therefore anti-virus protections potentially leave a hole open, the size of which depending, among others, on the frequency of updates and reactivity to patches availability [START_REF] Rescorla | Security holes... Who cares?[END_REF]. Hence risk, which is typically perceived inaccurately by humans [START_REF] Redmill | Some Dimensions of Risk Not Often Considered by Engineers[END_REF], comes into the equation at this level. End-users or security officers have to accept a certain level of (perceived) vulnerability regarding their system. Automatic updates have been felt to tackle this problem by lowering the likelihood of holes in the anti-virus protection. It seems to be a reasonable belief and is indeed a widespread feature. Unfortunately, the update process can be corrupted by an attacker. Although this is not a trivial task, it has been reported that centralised distribution of software could be tampered [START_REF]Gnuftp Compromise[END_REF][START_REF] Geek | Major Open Source code repository hacked for months, says FSF[END_REF]. This puts high threats on IT systems since it can offer an attacker to automate the installation of backdoors or the downloading of harmful contents on the end-user's machine. For this reason, automatic updates are not a panacea. Despite this negative state of facts, large organisations use this feature extensively. They may assume quite reasonably that the gain in usability and the regularity of updates together will provide benefits that are felt to overweigh risk.

Email attachments: a trust issue

Email attachments have been used very widely for spreading malicious code [START_REF] Denning | Information Warfare and Security[END_REF][START_REF] Zetter | Viruses: The Next Generation[END_REF]. Typically, the code is added as an attachment to a seemingly benign email. When the attachment is opened, the code is executed on the machine, exploiting security holes in the email program. Harmful email attachments pose two problems. First, they very often come from trusted senders who were infected themselves. Thus, due to this trust relationship, the degree of suspicion regarding the decision to open the document is already low. Second, email attachments are used so widely for legitimate purposes that opening them has become as automatic as picking up the phone [START_REF] Armstrong | Viruses: Preparing for the Onslaught[END_REF]. Of course, a rule such as "do not open attachments you are not expecting or from people you do not know" is unworkable since it generates too many false positives: many valid attachments would have to be left unread. Again, automation has been felt to tackle this problem: many mail servers now include anti-virus scanners. However, this is not the optimum solution since these scanners a) may not be up-to-date, b) sometimes detect false positives and c) open a discussion on whether or not scanning might invade privacy.

Files sharing: a practicality issue

On Windows operating systems, there is a feature that allows users to share files on their computer with other users. This is a very useful feature, especially for collaborative work among several users. It facilitates an easy and quick way to access or modify (potentially big) files from multiple computers. On the down side, this service (running on port 445) is vulnerable to denial of service attack [START_REF] Middleton | DoS attack storms port 445[END_REF] or to worms such as W32/Deloder [START_REF]W32/Deloder.worm[END_REF]. For everyday users, the practicality of sharing file of folders may outweigh security concerns. As in most cases, the threats can be minimised by applying security patches. However, the existence of such patches is not known to everyone. Moreover, the installation of the patch itself consumes work time and causes a distraction, which can be perceived altogether as factors of resistance to securing the system. Lastly, users may simply not be aware of the risks associated with the default settings in file sharing and they may "share with everyone" without knowing how broadly they disclose their data.

DISCUSSION

After having considered some concrete examples based on the use of computers, it seems necessary to adopt a broader view and address some more general issues. Among these, accepted losses and risks have to be mentioned as security policies are not meant to protect every single piece of data or service. Furthermore, threats can be discussed from the standpoint of an antagonism between the roles of attackers and legitimate users. The discrepancy in the motives of these actors is where security holes lie. Lastly, we will quickly evoke organisational issues by describing a multi-layered view of systems' security.

Accepted losses, risk perception and systems' protection

Although we have reasoned so far under the reductive assumption that all the data have to be protected, we now want to highlight a somewhat different picture according to which there exist some acceptable losses that humans implicitly take into account in setting up protections. The trade-off here involves the cost of protection and the cost of loss (see [START_REF] Flechais | Developing secure and usable software[END_REF]). Data or services that can be easily replaced, disclosed or lost without serious consequences will probably have a relatively low level of protection. The underlying evaluation of the required level of protection is believed to be done in an intuitive manner most of the time. We also think it guides, to some extent, the security policies adopted by organisations. As each single piece of data cannot be equally protected, some of these data are inevitably left vulnerable to attacks. This may be a sensible decision if, as aforementioned, loss or disclosure of data is accepted. In this view, it seems important to highlight that protecting a system is an implicit dialogue between security officers and attackers. We believe security policies define the nature of this dialogue before the occurrence of any attack. To some extent, this conception goes against the widespread belief according to which "attackers play first".

The following point may be perceived as a side-issue in this paper but the information that is intentionally left unprotected can cause indirect damages. A category of attackers called social engineers are specialised in gathering this kind of data by the means of psychological manipulation. They seek contact with a legitimate insider of the target system and trick that person into revealing passwords or other information that compromises the target system's security. The attackers usually conduct their deception through the phone in order to minimise the risk of being caught or recognised. See [START_REF] Hafner | Cyberpunk : outlaws and hackers on the computer frontier[END_REF][START_REF] Hatch | Hacking Linux Exposed: Linux Security Secrets & Solutions[END_REF][START_REF] Mitnick | The Art of Deception: Controlling the Human Element of Security[END_REF] for more information on social engineering.

The cost of losing valuable data or service may be one of the obvious drivers for designing and applying security protections. But benign or seemingly trivial pieces of information, although not directly security-critical, can be damaging as well, especially at the hand of malicious social engineers.

IT security shares some similarities with many domains. Risk taking is one of them and its management can be both unavoidable and tacit (see [START_REF] Evans | General practitioners' tacit and stated policies in the prescription of lipid lowering agents[END_REF] about general practitioners prescriptions). Let us take the following example. A car is safer when it is immobile than when one is driving it. But for a car to deliver its service (transporting people and goods), the driver and the passengers are forced to expose themselves to risks. These may be reduced down to some acceptable level if the driver is careful and experienced. But there will always be a number of factors he or she will not be able to influence (other drivers, mechanical incidents, etc.) that will impact the level of safety of this situation. The same argument holds with, for instance, a server. Not plugging it into a network is a relatively secure condition but the service will not be delivered. Therefore, some risk has to be accepted for virtually any piece of equipment to fulfil its function.

Another problematic and risky situation is one where the benefits expected from some programming decision outweigh protection measures (see [START_REF] Redmill | The COTS question is one of evidence[END_REF], about programming with COTS). Saving time and cost is common practice within the community of programmers [START_REF] Richards | The Reuse of Knowledge: a User-Centered Approach[END_REF] and may lead to biased benefits-driven decisions [START_REF] Burkardt | La réutilisation en génie logiciel : une définition d'un cadre de recherche en ergonomie cognitive[END_REF]. This applies to security in the sense that a threat can be identified by e.g. a software developer but found too costly to fix or thought unlikely to be exploited. This behaviour extends to an extremely wide range of cases. For example, in everyday's life, we tend not to wear our safety belt when driving on very short distances (e.g. parking our car in the driveway). In this situation, we perceive risks as being very low and we implicitly adapt our protection level accordingly. The smaller the perceived risk, the lower the level of protection. However, humans are typically biased at perceiving actual levels of risk [START_REF] Redmill | Some Dimensions of Risk Not Often Considered by Engineers[END_REF] and rarely have an exhaustive knowledge of the systems they interact with. It follows that the impact of a given practice over the security of a system is unlikely to be accurately assessed by an end-user. Thus intuitive, heuristic risk assessments, although acceptable for everyday's life, do not always accurately capture the criticality of certain threats. This inaccuracy therefore degrades the identification and compensation of security breaches, which in the end can depend on subjective decisions.

Last but not least, there is a human tendency to "slide on the risk slope". Large security incidents or industrial accidents are not caused by a sudden change in security or safety policy. Departure from a reasonable level of risk does not happen in one day. It is an accumulation of a number of small insecure increments that progressively deteriorate the level of protection, each of which being seen as acceptable per se. This is a classic situation in large industrial system's safety: largescale accidents are made of a concatenation of small failures [START_REF] Mancini | Commentary: Models of the decision maker in unforeseen accidents[END_REF].

Antagonism among security actors

It seems plausible that attackers, just as legitimate users do, perform trade-offs in the way they use their own computers. They may tend to intuitively and implicitly compare the costs of their actions (e.g. time) to the expected benefits and then take decisions on the basis of this evaluation.

The rule-of-thumb states that if costs are perceived as worth the expected benefits, then some action is likely to be performed. However, because attacker's and legitimate users' motivations are fundamentally different, we think that their respective trade-offs are different in nature. Attackers attack because they get a reward of some sort (self-satisfaction, peer-recognition, money, etc.). Legitimate users protect themselves because they need to. As far as trade-offs are concerned, these motives bring a consequence that attackers may care less about costs than legitimate users do. This discrepancy of motivations is perhaps where threats originate.

In the case where they have identified a target, attackers may be more focussed on the damages expected from their attack than on the costs involved. On the other hand, legitimate users may prioritise usability with little concern about security. This is a common case of usability-driven behaviour. We represent this discrepancy as a gap between attackers' and legitimate users' tradeoff strategies (Figure 3). In our conception, this gap gives some advantage to attackers. The larger the gap, the most successful the attack could be.

3: Graphical representations of two different trade-off strategies leading to a security gap.

From our point of view, attackers' trade-off involves expected damages against cost of actions whereas legitimate users trade-off usability against security. Having said this, it is not the case that an action making a system more usable will systematically degrade security. Instead, the point is that legitimate users, sometimes without being aware of it, prioritise usability at the detriment of security. In our opinion, this creates a security gap. Therefore, a successful attack can be described in terms of a malicious action whose degree of refinement is higher than the degree of protection of the target system.

Beyond the individual picture…

So far, we have been concentrating on an individual perspective where cognitive factors are thought to play a determinant role. Beyond this picture, we want to acknowledge the collective dimension of security in large distributed computer-based systems. More precisely, we think that Reason's model [START_REF] Reason | Human Error[END_REF] (see Figure 4) adopts a useful view on organisations in the sense that they are described in terms of multi-layered systems. Applied to the field of security, this view can help describe a computer-based system as one composed of threats, actors and protection layers. With this model, security is described as a multi-layered process where a variety of users (e.g. developers, security officers, end-users…) have a role to play. Each of these users impact on security. Administrators and/or end-users, for instance, by not making updates for their antivirus software, leave holes open for attacks. This type of local failure may exist at any given layer of the organisation, for any role. It creates latent security breaches that, combined with each other, can defeat an entire system's protections. In the context of this paper, these breaches are interpreted in terms of trade-offs whereby users simply wish to reach good enough solutions. When applied to security, Reason's model can describe, from a system point of view, the impairments made to security by legitimate users and attackers. The latter attempt to propagate attacks through security holes in order to reach an objective such as data, a service or to cause disruption in the functioning of the system.

Figure 4: Successful attacks propagate through several protection layers (adapted from [START_REF] Brostoff | Safe and sound: a safety-critical approach to security[END_REF]).

How people perceive IT security [START_REF] Dourish | Security as a practical problem : Some preliminary observations of everyday mental models[END_REF][START_REF] Friedman | Users' conceptions of web security: A comparative study[END_REF] and privacy [START_REF] Adams | Privacy issues in ubiquitous multimedia environments: Wake sleeping dogs or let them lie?[END_REF][START_REF] Cranor | Beyond concern: Understanding net users' attitudes about online privacy[END_REF] is a useful approach to assess individual contributions or impairments to security. However, these factors have to be brought back into a broader picture where security breaches are caused, facilitated or maintained by the combination of a variety of causes rather than by mere, isolated end-users' actions. By quoting Reason's model, our intention is to highlight the combination of factors needed for an attack to succeed. According to the popular belief, attacks occur because some malicious people exploit security holes. We wish to promote a somewhat different view according to which successful attacks are a combination of weak protections and malicious intentions. This idea can be stretched even further. As we cannot eliminate attacks altogether, the most productive approach may be to regard attacks as the outcomes of flawed policies and/or practices. Their origins are SUCCESSFUL ATTACK

Previous security issues left unaddressed

Weak login password

Unusable authentication

Security given low priority ATTACKER deeply rooted within early design assumptions or within managerial decisions. For instance, due to productivity constraints, the manager of a small company may misjudge the importance of protecting IT activities. This can take the form of a backlog of security actions waiting to be done. Such a laissez-faire policy may lead to the adoption of a poor security culture. The latter may propagate through the various stakeholders of the organisation, leading to e.g. unprotected data or weak passwords. There could obviously be an infinite number of examples that would follow the same pattern of a multiple, intricate set of causes (see [START_REF] Brostoff | Safe and sound: a safety-critical approach to security[END_REF] for more complete on Reason's model application to security).

Summary

Here are the points that we have laid out in this paper:

• Trade-offs are sometimes implemented in a wild, uncontrolled manner. Legitimate users sometimes prioritise immediate benefits to the detriment of long-term security. • Passwords, anti-virus updates, email attachments and shared folders respectively raise such issues as memory limitations, risk, and practicality. • Security does not imply protecting everything since some losses are acceptable. However, because risk perception by humans is highly biased, valuable data could be under threats. • Trade-offs by legitimate users differ in nature from the ones performed by attackers. The gap creates or maintains security breaches. • Computer security is an organisational matter.

WHAT CAN WE DO?

Telling people what to do about security is one option. But one lesson that can be drawn from in systems is that one should not expect humans to always act as prescribed. Within industrial settings, procedures themselves do not rule the human behaviour [START_REF] Fujita | Actualities need to be captured[END_REF] and there are many ways in which humans can configure a system and use it in unexpected and/or unprotected modes, even if it implies implementing a violation [START_REF] Adams | Users are not the enemy[END_REF]. This seems to be a universal pattern and to this respect, at least, IT security is similar to virtually any other field of activity. The motivation for diverging from recommended practice may be based on an intuitive cost-benefit evaluation where potential negative consequences of one's act are overweighed by expected benefits. This is typical for passwords that are written down or passed on to colleagues. It is also true for harmful email attachments that happen to hit computer-aware staff in academic departments every now and then. Generally speaking, if the perceived risk attached to an illegal action (e.g. lending a password) is seen as lower than the expected benefits (e.g. gain in time), then a violation will be put in place. This is extremely common practice and goes well beyond computer security. In this trade-off, factors such as security culture and risk perception are key notions. And whether or not the user has a relevant knowledge of the potential consequences of his/her actions is what partly determines the level of risk involved and the final security of the system.

Recommendations

To put things simply, humans obey least-effort rules because they are cognitive machines that attempt to cheaply reach flexible objectives rather than to act perfectly towards fixed targets. As a consequence, each time an opportunity to do so arises, efforts are avoided. This rule applies even to the detriment of performance or security. From our point of view, this leads to some simple recommendations concerning both end-users and administrators.

• Educate staff. Education will not solve all the problems but will at least allow users to be aware of the consequences of their actions. Contrarily to safety at work which is regulated and trained for, IT security still seems to be poorly addressed (as reported in [START_REF] Briney | Does size matter? 2002 Survey[END_REF] and in [START_REF]Information Security Breaches Survey 2002[END_REF]). This may be caused by the fact that most computers in organisations are used as clerical or editing tools that contain documents that are not felt to be security critical.

However, it is a very risky assumption to believe that because one is not holding or processing sensitive data, attacks do not have to be cared about. Nowadays, the reality is that being plugged into the internet is enough to be a target. Therefore, any member of staff interacting with computers should be aware of the damages caused by insecure practices. It is far from being the case. The reason may have to do with the intangible nature of electronic data flows, making most of IT security problems obvious only when attacks have succeeded. Because of the poor visibility of insecure settings, it is necessary to explain to staff that e.g. email attachments can be harmful, how intrusions are performed and how to choose and use passwords. • Procedures do not rule human behaviour. Humans have an extreme ability for tweaking rules and procedures. Thus, IT administrators should not assume that staff members will follow rules to the letter. Instead, it seems more reasonable to assume that people will always find a way to do what they want, via a violation if needed. It does not mean that rules and procedures are useless. But just as obedience to the rules per se does not automatically increase safety at work [START_REF] Fujita | Actualities need to be captured[END_REF], it does not increase security either. Instead, as Dekker [START_REF] Dekker | Failure to adapt or adaptations that fail: contrasting models on procedures and safety[END_REF] suggests, procedures should be seen as resources for action instead of an expectation about human behaviour. Procedures must be understood. Their efficiency relies more on the knowledge they require than on their blind acceptance. • Security must be user-centred [START_REF] Zurko | User-Centred Security[END_REF]. Generally speaking, the design of security products and policies should rely more on the rules of human-computer interaction, as suggested in [START_REF] Grinter | Three challenges for embedding security into applications[END_REF][START_REF] Patrick | HCI and security systems[END_REF][START_REF] Sasse | Computer security: Anatomy of a usability disaster, and a plan for recovery[END_REF]. Also, products should be designed in such a way that users can make sense of their properties [START_REF] Holmström | User-centered design of secure software[END_REF][START_REF] Yee | User interaction design for secure systems[END_REF]. At a finer-grained level, passwords must be, at least, easy to remember and reduced in number as much as possible. As far as end-users are concerned, the ideal number of passwords is zero. It may seem an unworkable view to security but the reason why security policies have to be enforced to humans is because these policies require an effort from them. And rules that are felt too costly to follow are simply not respected [START_REF] Veyrac | Modèle de l'opérateur et modèle du prescripteur. Le cas des consignes de résolution de situations incidentelles pour les conducteurs de trains[END_REF]. On the usability front, studies revealed holes caused by security products that are difficult to use [START_REF] Whitten | Usability security: A case study[END_REF][START_REF] Whitten | Why Johnny can't encrypt: A usability evaluation of PGP 5.0[END_REF]. Therefore, any measure getting closer to an effortless security policy is a step forward. People should not have to remember about IT security or even think about it. The entire workplace should be designed according to this principle. User agents as described by [START_REF] Ackerman | Privacy critics: UI components to safeguard users' privacy[END_REF] are an instance of such an approach. Also, retina control and fingerprints, although not a panacea, are pure effortless authentication items. They are both unique and virtually impossible to share with others. Purists of IT security will object that they can be falsified or that they may not be usable in all physical environments (e.g. dusty, dark places, etc.). It is true, but how good is the situation right now?

• Security is not end-users' task. How secure a system is partly depends on how high security is set on the scale of an organisation's objectives. Security might be a relatively obvious goal for a system administrator. This it is not the case for an end-user. Solutions have to be thought of in order to make security transparent for whom it is not a primary objective. For instance, it should not be expected from staff members to report security problems, update virus protections or remember half a dozen passwords. These expectations are rarely met in the real world. Security is administrators' task. End-users should not be expected to always collaborate. • Be aware of contradictory objectives. Asking staff to carry out their duty and spend time on updates and/or scanning files cannot be done at the same time and have to be traded-off against each other. Contradictory objectives, which are often inevitable, must be compensated for: security does not come first in end-users' mind (see [START_REF] Sasse | Transforming the weakest link -a human computer interaction approach to usable effective security[END_REF]).

End-users will always have something else to do other than thinking about security. It seems to us that the idea of a user-centred security for end-users is a useful policy driver. Any measure going in this direction may improve systems' security.

LIMITS

We have explained how, in our opinion, trade-offs between e.g. usability and security could impair the level of protection of a system. This surely accounts for the success of some intrusions. But this aspect of human functioning can be seen in a more positive way as not complying to the rules can also generate beneficial behaviours [START_REF] Besnard | A cognitive approach to safe violations[END_REF]. According to this view, violations are reconsidered under the angle of ad-hoc contributions to security, happening under exceptional circumstances and outside the frame of any clearly identified procedure. An example is unplugging the network cable from a connected machine when a suspicious behaviour is detected. It may not preclude any damage on this specific computer but it will prevent the attack to spread to other machines. This is the type of actions that designers probably do not expect users to take but that can nonetheless be implemented on-the-fly, thanks to human's intrinsic flexibility. This kind of unexpected contribution to security is hardly ever addressed in computer security but nevertheless deserves some attention.

Here is an angle that we have not considered in this paper. When attacks or intrusions fail, it may be that attackers faced problems that would have been too long to surmount given their level of competence, available time, or expected reward. Thus, the cognitive approach may also be fruitful for the study of attackers' failures. Obviously, the major challenge here is getting the data.

CONCLUSION

Legitimate users who are not security-aware (e.g. researchers, clerical staff, managers) have other tasks to perform than spending their work time on securing their system. When the task of protecting a machine is felt to get in the way to the completion of their main tasks, users will probably overlook security if this allows them to ease their work. Harmful, usability-driven tradeoffs are then put in place and create holes in systems' protections.

Understanding where trade-offs lie can allow a better understanding of the mental processes involved in security practices. In the case of legitimate users, we defended the idea that security is impaired because it is traded-off against usability or efficiency. Now, looking at the big picture, it may be that past engineering experiences have something to teach us. As Leveson [START_REF] Leveson | High pressure steam engines and computer software[END_REF] reports, the introduction of high-pressure boilers aboard steamers caused a myriad of accidents. Different people took different positions regarding this problem. Instead of banning the new boilers, it was suggested that risks could be limited by adopting simple designs. This way, a more careful implementation of new steam engines would leave time for scientific knowledge to build up. Ideally, this policy would lead to a safer technological evolution, based on another strategy than blind trial and error. It seems to the authors that the situation in IT security today is not so different from what it was in the steam engines era. We are trying to prevent security breaches within systems that sometimes exceed our level of understanding. There is an uncountable number of examples of this. For instance, all major software development companies are continuously issuing security patches for their products. The reason is that nobody can detect all the flaws in a large program. Nor can anyone foresee the creativity of malicious people in exploiting these flaws. The consequences are that a) the arsenal of currently available protection tools (anti-virus software, firewalls, access control, intrusion detection systems, etc.) are no guarantee against attacks and b) financial losses persist [START_REF]Computer crime and security survey[END_REF] and [START_REF]Information Security Breaches Survey 2002[END_REF].

In the authors' opinion, the way computers are used by legitimate users accounts for a number of security breaches. Since there is no evidence that we will step back from the pervasive use of information technology in the near future, understanding and compensating individual insecure practices is still of immense interest. Until this happens, the security challenges that our society is continuously facing and the financial costs involved will remind us that we have brought IT systems beyond end-users' control.

9.

Figure 1 :

 1 Figure 1: Graphical representation of a costs/benefits trade-off.

Figure 2 :

 2 Figure 2: Graphical representations of benefits-driven (left) and costs-driven (right) strategies.

  Theoretical trade-off lineArea of high benefits for low costs Area of high costs for low benefits COSTS BENEFITSLeast-effort trade-off line

DIRC (Dependability: an Interdisciplinary Research Collaboration) is a UK-based interdisciplinary research project on the dependability of computer-based systems. Visit DIRC at http://www.dirc.org.uk.

ACKNOWLEDGEMENTS

This paper was written at the University of Newcastle upon Tyne within the DIRC project (http://www.dirc.org.uk) on dependability of computer-based systems. The authors wish to thank Peter Ryan and Jeremy Bryans (University of Newcastle) and Lorenzo Strigini (City University) as well as anonymous reviewers for useful comments. The authors are also grateful to the sponsor EPSRC for funding this research.


Hue Nguyen

Thi Minh

Philippe Dantigny

Jean-Marie Perrier-Cornet

Patrick Gervais

Germination and inactivation of Bacillus subtilis spores induced by moderate hydrostatic pressure

Keywords: bacterial spores, Bacillus subtilis, high pressure, germination, inactivation

In this study, we investigated the mechanisms of spore inactivation by high pressure at moderate temperatures to optimize the sterilization efficiency of high-pressure treatments.

Bacillus subtilis spores were first subjected to different pressure treatments ranging from 90 to 350 MPa at 40 °C, with holding times from 10 min to 4 h. These treatments alone caused slight inactivation, which was related to the pressure-induced germination of the spores. After this pressure treatment, the sensitivity of these processed spores to heat (80 °C/10 min) or to high pressure (350 MPa/40 °C/10 min) was tested to determine the pressure-induced germination rate and the advancement of the spores in the germination process. The subsequent heat or pressure treatments were applied immediately after decompression from the first pressure treatment or after a holding time at atmospheric pressure. Our results show that high pressure was necessary and very efficient in inducing spore germination. However, it seemed to slow the enzymatic digestion of the cortex, which is required for germinated spores to be inactivated by pressure. Although these results indicate that high-pressure treatments are more efficient when the two treatments are combined, a small spore population still remained dormant and was not inactivated with any holding time or pressure level.

Introduction

Under starvation conditions, Bacillus species can form endospores, which are metabolically dormant and physically very resistant. Bacterial spores exhibit a multilayer structure in which each layer plays an important role in protecting the spore against environmental perturbations. Bacterial spores are considered to be the most resistant life form among biological models and can survive for millions of years [START_REF] Vreeland | Isolation of a 250 million-year-old halotolerant bacterium from a primary salt crystal[END_REF]. The extreme resistance of bacterial spores to many stresses has been reported, including to external desiccation [START_REF] Dose | DNA stability and survival of Bacillus subtilis spores in extreme dryness[END_REF], very high pressure [START_REF] Margosch | Pressure inactivation of Bacillus endospores[END_REF], UV radiation, heat, and chemical agents [START_REF] Setlow | Spores of Bacillus subtilis: their resistance to and killing by radiation, heat and chemicals[END_REF], and this resistance is therefore an important obstacle to food preservation. The only reliable industrial method of spore inactivation is heat treatment for about 20 min at 120 °C, which is widely used for food sterilization in the industry. However, this thermal process has some drawbacks insofar as it modifies not only the sensory qualities (color, flavor, texture) but also the nutrient content of foodstuffs. High-pressure treatments have stimulated considerable interest in the food industry because they not only preserve the nutritional and organoleptic food qualities, but also reduce the energy and time required for processing [START_REF] Tewari | High pressure processing of foods: an overview[END_REF]. However, this alternative technology fails to achieve the efficient destruction of bacterial spores. In fact, spore inactivation by high pressure at ambient temperature is not sufficiently efficient and some spores are even reported to survive after a treatment at 1034 MPa for 90 min at 35 °C [START_REF] Timson | Resistance of microorganisms to hydrostatic pressure[END_REF]. Combining high pressures with moderate temperatures [START_REF] Clery-Barraud | Combined effects of high hydrostatic pressure and temperature for inactivation of Bacillus anthracis spores[END_REF] or pressure cycling [START_REF] Furukawa | Mechanism of the inactivation of bacterial spores by reciprocal pressurization treatment[END_REF] could improve spore inactivation but the complete destruction of bacterial spores at moderate temperatures has not so far been achieved.

The phenomena involved in the spore inactivation induced by high pressure differ from those identified in vegetative cells. It has been reported that pressure induces cell inactivation by cell permeabilization, the subsequent leakage of internal solutes, and cell shrinkage [START_REF] Perrier-Cornet | A new design intended to relate high pressure treatment to yeast cell mass transfer[END_REF], 1999) or by protein denaturation [START_REF] Alpas | Evaluation of high hydrostatic pressure sensitivity of Staphylococcus aureus and Escherichia coli O157:H7 by differential scanning calorimetry[END_REF]. These phenomena are normally reinforced by the increased pressure. On the contrary, [START_REF] Sale | Inactivation of bacterial spores by hydrostatic pressure[END_REF] found an optimal pressure for Bacillus subtilis spore destruction at about 250 MPa, in the pressure zone ranging from 100 to 800 MPa at 25 °C, with a 1 h holding time [START_REF] Sale | Inactivation of bacterial spores by hydrostatic pressure[END_REF]. This atypical inactivation curve seems to be the result of spore germination, which is intimately involved in spore inactivation by pressure. In fact, hydrostatic pressure triggers the spore germination phenomenon and during this process, spores progressively lose their typical resistance and become more readily inactivated [START_REF] Moir | How do spores germinate?[END_REF][START_REF] Setlow | Spore germination[END_REF], like vegetative cells.

The germination phenomenon can also be induced by other factors (nutrients or abrasion) [START_REF] Jones | Effect of mechanical abrasion on the viability, disruption and germination of spores of Bacillus subtilis[END_REF]Paidhungat et al., 2002;[START_REF] Rode | Mechanical germination of bacterial spores[END_REF][START_REF] Setlow | Germination of spores of Bacillus subtilis with dodecylamine[END_REF]. Spore germination is generally divided into different stages but the distinction and the quantification of those germination stages are not clear. The release of dipicolinic acid (DPA) may only be useful in studying the onset of the germination process [START_REF] Moir | How do spores germinate?[END_REF], whereas visualization of protein mobility [START_REF] Cowan | Lipids in the inner membrane of dormant spores of Bacillus species are largely immobile[END_REF][START_REF] Moir | Bacterial spore germination and protein mobility[END_REF], the drop in optical density, or increased spore permeation to fluorescent substances only occur in the late stages. The use of flow cytometry coupled to fluorescent probes has recently been reported to differentiate different spore populations after pressure treatments, but the identification of these populations is complex [START_REF] Mathys | Flow cytometric assessment of Bacillus spore response to high pressure and heat[END_REF]. In this study, we tried to differentiate the different stages in the germination process by identifying the spore sensitivity to heat and high pressure, as shown in Figure 1.

In the first stage, spores partially lose their impermeability to water, leading to water influx (with a slight increase in volume) and solute (DPA, Ca 2+ ) leakage. Consequently, they become sensitive to wet heat [START_REF] Setlow | Spore germination[END_REF]. During the second stage, the cortex is enzymatically digested, leading to full core rehydration, greater hydration of the core macromolecules and a greater loss of spore-specific resistance (to high pressure, for example; [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF]. It has already been reported that pressure (600 MPa)-germinated spores, which were sensitive to heat but still resistant to high pressure [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF], had characteristics similar to those of spores genetically blocked at stage I, and were induced by nutrients [START_REF] Setlow | Properties of spores of Bacillus subtilis blocked at an intermediate stage in spore germination[END_REF].

At the end of stage II, the small acid-soluble spore proteins (sasP) are hydrolyzed to amino acids, which are subsequently used in protein synthesis by the growing cell [START_REF] Moir | How do spores germinate?[END_REF][START_REF] Setlow | Spore germination[END_REF]. Protein synthesis and spore metabolism only occur in the outgrowth phase, in which the germinated spore is converted into a growing cell. However, the small endogenous energy reserves (3-phosphoglyceric acid constitutes 0.3% of the spore dry weight and sasP constitute 3.5% of the spore dry weight) do not allow spore outgrowth without external nutrients. In fact, spores lack some enzymes, which require external substrates for their synthesis (Paidhungat and Setlow, 2002). After the germination and outgrowth phases, and under favorable conditions, bacterial cells can undergo a multiplication process and colonize the medium. They may even produce toxins in foodstuffs. Without control, the spore germination induced by high pressure can be a risk to foods.

The aim of this work was to study the germination and inactivation of bacterial spores induced by moderately high pressures and the effects of different factors on these two processes to gain insight into the mechanisms of spore inactivation by high pressure. Our results might help to optimize the barosterilization process.

Materials and methods

Bacterial strains and growth conditions

The strain used was Bacillus subtilis ATCC 31324 (DSMz 704) obtained from Deutsche Sammlung von Mikroorganismen und Zellkulturen (Braunschweig, Germany). The sporulation of B. subtilis was induced in a reactor in a complex medium at 37 °C, pH 8.0, with an air flow of 4 L min -1 and with agitation (450 rpm min -1 ) [START_REF] Nguyen | Effect of the osmotic conditions during sporulation on the subsequent resistance of bacterial spores[END_REF].

Sporulation was estimated by counting the spores before and after a heat treatment at 80 °C for 10 min. Bacillus subtilis spores were harvested when sporulation reached more than 95% of the cell population (about 48 h). The spores were washed three times with sterile distilled water and spray-dried.

High-pressure treatment

Sample preparation

Spore powder was suspended in sterile distilled water at a final concentration of approximately 10 9 spores mL -1 . Samples of about 1 mL of the spore suspension were transferred to sterile polyethylene bags, which were aseptically heat-sealed and stored at room temperature until treatment.

High-pressure treatments

High-pressure treatments were applied using a 1.5 L vessel (GEC Alsthom ACB, France), which was maintained at a constant temperature (40 ± 3 °C) and was capable of operating at up to 600 MPa. Hydrostatic pressure was generated with a hydraulic high-pressure pump (Hydro Process, France) connected to the vessel. The pressure and temperature inside the vessel were controlled by a pressure gauge (Sedeme, France) and a K-type thermocouple (Top Industrie, France), respectively. High-pressure treatments were applied at 90-450 MPa, with holding times ranging from 0 min to 4 h. All high-pressure treatments were applied at 40 °C in this study. Pressure loading and unloading were performed at approximately 12 MPa s -1 .

For treatments with a holding time of 0 min, decompression was initiated immediately after compression.

Heat treatment

Spore samples, prepared as previously described, were maintained at 80 °C in a water bath for 10 min. The heat-treated samples were cooled by immersion in a water bath maintained at room temperature.

Viability measurements

Viability measurements were made according to the colony-forming-unit method. After dilution in physiological water (9‰ NaCl w/w), the microbial suspensions were manually spread over Columbia agar medium (Biokar Diagnostics, France) and incubated at 37 C for 24 h.

Quantification of different spore populations during germination

In this study, the germination process was expected to stop in the early phase of stage II because in the absence of nutrients, spores cannot establish the active processes necessary for the recovery of the vegetative state. This fact was verified by microscopic observations. After the pressure treatment, the initial population of native spores (NS) was partially replaced by germinated spores at different stages (stage I [GI] and stage II [GII]) in the suspension, as shown in Figure 1. Each population exhibits corresponding morphological changes and is associated with the loss of specific resistance [START_REF] Setlow | Spore germination[END_REF]. Including a heat treatment (80 °C/10 min) after the initial pressure treatment allowed us to distinguish each population of germinating spores, as summarized in Table I. Because spontaneous germination was rare, all heat-sensitive spores must have been induced by pressure and achieved at least stage I of the germination process. We observed that the number of spores sensitive to heat increased progressively during maintenance at atmospheric pressure for 4 h and remained constant thereafter (up to 24 h). Therefore, all the heat-resistant spores observed after this delay were assumed to have remained native spores and their germination was not induced by pressure.

In the absence of vegetative and outgrowing cells, the spores inactivated by pressure were in stage II (GII) of the germination process. The number of native spores (NS) was calculated by subtracting the total number of germinated spores from the initial concentration of spores (10 9 spores mL -1 ).

Results

Germination and inactivation of B. subtilis spores immediately after pressure treatment at 350 MPa and 40 °C

The spore germination and inactivation induced by pressure treatment at 350 MPa and 40 °C, with various holding times, were first studied (Figure 2). Before treatment, we observed that the spores were not inactivated by heat, which means that only native spores were present in the samples. A pressure treatment consisting of a 10 min holding time at 350 MPa (see arrow, Figure 2) directly induced about 1 log of spore destruction. With reference to Table I, this result means that after only 10 min, at least 90% of the initial population had germinated, had reached stage II of germination (GII), and had become sensitive to pressure. At the same time, the destruction rate achieved with a subsequent heat treatment after a 4 h holding period at atmospheric pressure was about 4 log (see arrow, Figure 2). Thus, 4 h after treatment, almost the whole population had already germinated and had reached at least stage I of germination (GI + GII). Because the initial concentration was about 10 9 spores mL -1 and the heat destruction rate was 4 log, only 10 5 spores mL -1 still remained native after the 10 min holding period at 350 MPa.

Increasing the holding time at 350 MPa to 60 min significantly increased the number of pressure-induced germinated spores (GI + GII). In fact, the heat-inactivation rate was about 6.5 log for 60 min at 350 MPa. However, only 2 log were directly inactivated (GII) after such a high-pressure treatment. Germination was induced in the main part of the resistant spore population after treatment with 350 MPa for 60 min, however stage II of germination was not achieved. Because the initial concentration was about 10 9 spores mL -1 and 6.5 log of spores had already been heat inactivated, only a small population (about 10 3 spores mL -1 ) still remained native under these conditions.

A further increase in the holding time had little effect on pressure-induced germination (GI + GII) or on pressure-induced inactivation (GII). As shown by the second arrow in Figure 2, the direct inactivation of the spores by a pressure treatment of 350 MPa for 4 h was about 2.5 log, whereas the pressure-induced germination of heat-sensitive spores was 6.5 log. A small population of native spores was always observed, even when the holding time was prolonged to 24 h (data not shown). Therefore, pressure appears to rapidly induce spore germination (in the first 30 min). It has been reported that it took about 20-30 min to achieve stage II of germination when spores were induced to germinate by nutrients [START_REF] Setlow | Spores and their significance[END_REF].

However, pressure-induced germination was incomplete and the resistant native spores could germinate in the presence of nutrients.

We observed a great difference between pressure-induced inactivation (GII) and pressureinduced germination (GI + GII). Moreover, a long holding time (4 h) at 350 MPa was less efficient in terms of spore destruction (about 2.5 log) than a holding time of equivalent length at atmospheric pressure after a minimum induction of 10 min at 350 MPa and a subsequent thermal treatment (more than 4 log). In the next section, we compare the germination and inactivation that occurred during treatment at 350 MPa with those of previously pressureinduced spores that occurred at atmospheric pressure.

Comparison of spore germination during high-pressure treatment and after pressure treatment at atmospheric pressure

Spore germination was first induced by a pressure treatment of 350 MPa at 40 °C for 60 min, and after decompression, the spore suspension was held at atmospheric pressure. After different holding times at atmospheric pressure, the spore suspension was subjected to a heat treatment at 80 °C for 10 min to identify the development of the pressure-induced germination population (GI + GII). The pressure-inactivated population (GII) was estimated by subjecting the previously pressure-induced germinated spores to a pressure treatment of 350 MPa/40 °C/10 min. The results are presented in Figure 3, and compared with those for spore germination and inactivation at 350 MPa for different holding times.

The induction of spore germination after 60 min under pressure, as shown by the GI and GII inactivation curves, did not seem to change, regardless of whether or not the spores were further maintained under pressure. However, germination advancement, as described by the GII inactivation curves, seemed to be more favored when the spores were held at atmospheric pressure than when they were maintained at the same high pressure. After the first pressure treatment for 60 min at 350 MPa, followed by a 60 min holding period at atmospheric pressure, about 5 log of spores were inactivated by a second pressure treatment, compared with the 2 log of spores that were destroyed after a pressure treatment at 350 MPa with a 120 min holding period. The germination process of the GII spores occurred during the first 60 min after decompression and did not increase significantly thereafter (Figure 3). Therefore, pressure seems to have two opposite effects on spore germination: the rapid induction but slow completion of the spore germination process. High pressure, which was very efficient in inducing spore germination, seemed to slow the latter stage of the germination process, more particularly the passage from stage I to stage II. In the next step, we focused on the effects of the pressure level on these two events.

Effects of high pressure levels on pressure-induced germination and inactivation

The effects of high pressure levels on spore germination and inactivation were studied as a function of the pressure level (90-550 MPa). All the experiments were performed with a holding time of 60 min because this time had been observed to be optimal for the induction of spore germination at 350 MPa (cf. Figure 2). In Figure 4, our results for the inactivation of B. subtilis spores after 60 min of pressurization graphed against the pressure levels are compared with the results of [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF] for the inactivation of B. subtilis PS832 spores at 40 °C for 30 min in the same pressure range [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF].

As shown in this figure, [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF] found the optimal pressure for spore inactivation near 200 MPa (2 log) [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF]. Interestingly, in the present study, when B. subtilis spores were treated for 60 min under pressure, pressure inactivation (GII) was optimal (about 1.82 log) at roughly the same pressure. Therefore, our results agree with those of [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF] in that the inactivation of B. subtilis spores by pressures below 600 MPa at 40 °C is relatively weak and is not directly proportional to the pressure. Optimal inactivation was observed at moderate pressures (about 250 MPa), which have little effect on the inactivation of vegetative cells [START_REF] Gao | Optimization of process conditions to inactivate Bacillus subtilis by high hydrostatic pressure and mild heat using response surface methodology[END_REF].

On the contrary, pressure-induced germination depended on high pressures of up to 400 MPa.

For example, the destruction rate of the total germinated spores (GI + GII) was less than 3 log at 90 MPa compared with 6 log at 350 MPa. Further increases in pressure did not result in greater spore induction. Moreover, a pressure of 550 MPa even slightly reduced the spore population induced by pressure. Therefore, the optimal pressure for spore inactivation (about 200 MPa) is less than the optimal pressure necessary for the induction of spore germination (about 400 MPa) with a holding time of 60 min. Although pressure inactivation was related to the pressure induction of spore germination, these two phenomena do not have the same optima. This observation supports the hypothesis that high pressure inhibits the achievement of stage II of germination.

Discussion

The germination phenomena that occur during the high-pressure process are best characterized using the spores' sensitivity to heat and high-pressure treatments and by comparing these phenomena with and without pressure. The effects of high pressure seem to differ greatly depending on the germination stage. This observation could be related to the cellular phenomena involved during germination, which are detailed in the following sections.

How does pressure induce the germination process?

The mechanisms underlying the high-pressure induction of spore germination seem to depend on the pressure level used. Moderately high pressures (between 50 to 400 MPa) have been reported to induce germination through nutrient receptors, and the subsequent events are processed via the nutrient-triggered germination pathway [START_REF] Black | Factors influencing germination of Bacillus subtilis spores via activation of nutrient receptors by high pressure[END_REF][START_REF] Pelczar | Role of GerD in germination of Bacillus subtilis spores[END_REF]. Very high pressures (above 400 MPa) do not activate nutrient receptors but possibly trigger the release of Ca-DPA and the subsequent events of germination [START_REF] Black | Analysis of factors influencing the rate of germination of spores of Bacillus subtilis by very high pressure[END_REF]Paidhungat et al., 2002). Our experiments did not show two separate phenomena as a function of the pressure range, and the rate of total spore induction by pressure increased continuously up to 400 MPa (cf. Figure 4). However, the two mechanisms of spore induction could operate together in a certain pressure range. At pressures above 400 MPa, the induction phenomenon seemed to be optimal and even decreased slightly with further increases in pressure. A small part of the population (1 per 10 7 spores) did not appear to be induced by high pressure.

After the decompression of the first germination-inducing treatment, the number of stage II germinated spores continued to increase, even at atmospheric pressure (cf. Figure 3). Because the spores were suspended in distilled water without nutrients, these results seem to demonstrate that spore germination induced by high pressure is an irreversible process in the absence of nutrients. Thus, high hydrostatic pressure, which is a physical factor like heat, has a very different effect on the induction of spore germination from the effect of heat. It has been reported that, in the absence of nutrients, spore germination can also be induced by sublethal heating (about 80 °C for 10 min), but this induction is reversible because the induced spores return to the dormant state without the addition of nutrients after some time in storage [START_REF] Keynan | Activation of bacterial endospores[END_REF].

Moreover, pressure-induced germination is rather rapid and efficient. In fact, about 10 5 spores mL -1 were already induced to germinate after a pressure treatment of 350 MPa at 40 °C for 30 min, compared with the initial concentration of 10 9 spores mL -1 . This short period may be attributable to the fact that the first events of the germination process are passive and do not require enzymatic reactions. Because moderately high pressure induces spore germination by activating the spore's nutrient receptors, increasing the pressure to 400 MPa probably supplies more energy to change the conformation of these receptors and consequently enhances spore induction, as shown by the results presented in Figure 4. [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF] found no significant differences in the induction of germination by 100 and 400 MPa at 40 °C [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF]. However, their experiments were performed with a shorter holding time (30 min), so the germination rates were low and may not have allowed the observation of differences under these conditions.

We also observed a spore fraction (see the gray area in Figure 5) that was not sensitive to heat immediately after the pressure treatment but germinated later. This spore fraction has some similarities to the activated spores induced by heat and could be called "pressure-activated spores". However, this pressure-activated process was irreversible and the cells proceeded through the next germination stages, even after the pressure was released. These spores are probably at the very first stage of activation and are not sensitive to heat. Otherwise, they are perhaps activated after the high-pressure treatment by a substance excreted from the germinating spores (DPA, Ca 2+ …).

Finally, the induction of spore germination by pressure was incomplete because a very small spore population (about 1 per 10 6 spores) still remained in their native state in the suspension.

However, these spores could germinate in the presence of nutrients after the pressure treatment. Therefore, their nutrient receptors still remained active but were perhaps not sensitive to pressure. This saturation effect could be attributable to the "superdormancy" phenomenon under these conditions but our results did not allow us to confirm this hypothesis. Specific mutants could be useful in evaluating this possibility. Nevertheless, the spore germination induced by moderately high pressure seems slightly different from nutrientinduced germination.

How can pressure affect the progression from stage I to stage II of germination?

Stage II of germination is related to the hydrolysis of the cortex, the full hydration of the spore core, the restoration of protein mobility and enzyme activity, and the loss of most sporespecific resistance [START_REF] Cowan | A soluble protein is immobile in dormant spores of Bacillus subtilis but is mobile in germinated spores: Implications for spore dormancy[END_REF]Paidhungat et al., 2002). This germination stage requires the activity of enzymes and normally takes longer than the first stage. Because the progression from stage I (GI) to stage II (GII) is effectively faster at atmospheric pressure than under high pressure (Figure 3), a pressure of 350 MPa ought to slow the transition from GI to GII, probably by lowering the activities of the cortical lytic enzymes and some core enzymes involved in this stage. It has also been reported that germinating spores induced by very high pressures can complete the germination process, but very slowly [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF]. Pressure can affect enzyme structures and functionality as well as the kinetics and specificity of the catalyzed reaction. Indeed, the activities of proteolytic and glycolytic enzymes are significantly reduced at pressures higher than 300 MPa [START_REF] Malone | High pressure effects on proteolytic and glycolytic enzymes involved in cheese manufacturing[END_REF].

Similarly, changes in the treatment temperature or pH can accelerate this progression from stage I to stage II of germination [START_REF] Stewart | Sensitivity of spores of Bacillus subtilis and Clostridium sporogenes PA 3679 to combinations of high hydrostatic pressure and other processing parameters[END_REF]. The passage from stage I to stage II of the germinated spores seems to be the limiting step in the germination process under pressure.

Hypothetical mechanisms of spore inactivation under high pressure

In summary, the effect of the pressure level on the different stages of spore germination and inactivation are shown in Figure 6. Here, we have reported the variations of spore numbers that correspond to each phenomenon as a function of pressure levels.

As shown in Figure 4, pressure-induced germination increased with increasing pressure up to 400 MPa. On the contrary, the numbers of spores that proceeded from stage I to stage II of germination decreased with increasing pressure levels. Moreover, as shown previously, stage II germinated spores (GII) lost their specific resistance and the number of GII spores destroyed by pressure increased with increasing pressure, like vegetative cells. The destruction of spores, as influenced by the three processes, is shown in Figure 6. Below 300 MPa, pressure only weakly inhibited the progression from stage I (GI) to stage II (GII) of germination, but because pressure had little effect on spore induction or the destruction of GII spores, the spore inactivation rate was not high. Pressures above 300 MPa induced the germination of considerable spores, but because the progression from GI to GII was very limited under pressure, the spore inactivation rate was also low. Spore inactivation by high pressure, which is a combination of these three processes, may be optimal at about 250 MPa [START_REF] Wuytack | Comparative study of pressure-induced germination of Bacillus subtilis spores at low and high pressures[END_REF].

To optimize spore destruction by hydrostatic pressure, different solutions were used, predominantly with a combination of pressure and temperature or with pressure cycling. On the one hand, the higher spore inactivation rate at high temperatures can be explained by the acceleration of enzymatic reactions during the progression from stage I to stage II of germination but also by the fact that stage I germinated spores are directly inactivated by temperatures above 70 °C. On the other hand, the application of pressure cycling is more efficient than a single pressure treatment, when the total exposure is equivalent [START_REF] Hayakawa | Oscillatory compared with continuous high pressure sterilization on Bacillus stearothermophilus spores[END_REF]. One explanation of this phenomenon is that the repeated rapid decompression causes injury to and disruption and inactivation of the germinated spores [START_REF] Furukawa | Mechanism of the inactivation of bacterial spores by reciprocal pressurization treatment[END_REF]. Our results suggest that after the induction of spore germination by the first pressure treatment, the decompression between the pressure cycles favors the progression from stage I to stage II of the germinated spores. The stage II germinated spores are then inactivated by the subsequent pressure cycles, which would explain the greater spore destruction by pressure cycling. Some authors have observed only small differences in spore inactivation between pressure cycling and continuous pressure, probably because the germinated spores were exposed for a very short period to atmospheric pressure and could not proceed further to stage II of germination. The use of pressure cycling with a precise exposure time could significantly enhance spore inactivation by high pressure. For example, a first pressure treatment for 30 min at 350 MPa and 40 °C, maintenance at atmospheric pressure for 30 min, and a second pressure treatment at 350 MPa and 40 °C for 10 min can induce spore destruction of about 5 log.

Conclusion

The initiation of the germination process is the only way to inactivate spores at pressures below 600 MPa and a moderate temperature (40 °C). Germinated spores were inactivated when they reached stage II of germination. Pressure has two opposite effects on the induction of spore germination and spore inactivation. Pressure is necessary for the induction of spore germination but it slows the progression from stage I germinated spores to stage II germinated spores, and consequently spore inactivation. The completion of spore germination and inactivation by high pressure remains challenging because a small proportion of the spore population (about 1 per 10 6 spores) is not activated by these pressures. These results allow a better comprehension of the effects of pressure on spore germination and inactivation.

However, further work is required to better control spore inactivation when applying highpressure processing for food preservation.

Figure captions

Figure 1. Different stages of spore germination [START_REF] Setlow | Spore germination[END_REF].

Figure 2 .

 2 Figure 2. Spore germination (♦) and inactivation (▲) immediately after a pressure treatment

Figure 3 .

 3 Figure 3. Comparison of the germination and inactivation of B. subtilis spores immediately

Figure 4 .

 4 Figure 4. Effects of the pressure level on the inactivation (*) and germination (♦) of B. subtilis

Figure 5 .

 5 Figure 5. Pressure inactivation (▲) and pressure-induced germination (♦) as a function of

Figure 6 .Figure 3 .

 63 Figure 6. Schematic diagram of the effects of the pressure level on the different stages of

Figure 4 .

 4 Figure 4. Effects of the pressure level on the inactivation (*) and germination (♦) of B. subtilis spores induced by high-pressure treatments at 40 °C for 60 min observed in this study and the inactivation results for B. subtilis spores after high-pressure treatments at 40 °C for 30 min (▲) observed by Wuytack et al. (1998). (P) pressure treatment; and (H) heat treatment.