text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: . This publication does not necessarily represent state-of the-art and it might be updated from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for educational and information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. ©European Network and Information Security Agency (ENISA), 2011

text: Homepage of FISHA project, http://fisha-project.eu/

text: See the EISAS Roadmap, https://www.enisa.europa.eu/act/cert/other-work/eisas_folder/eisas_roadmap

text: Sternberg, Greg, ‘The Psychology behind Security’, ISSA Journal, April 2010; West, Ryan, ‘The Psychology of Security. Why do good users make bad decisions?’, Communications of the ACM, April 2008.

text: See Ajzen, Icek; Fishbein, Martin, ‘Understanding Attitudes and Predicting Social Behavior’, Prentice Hall 1980, for an elaboration on the connection between attitudes and behaviour.

text: Regarding SMEs, among which the actual target group is the owner/managing director in that very capacity, it is recognised that this approach is not directly applicable. It is, however, with regards to employees of SMEs.

text: See the section ‘Overview of the information material provided’ for a description of the contents of the website and the emergency button.

text: For a more detailed description see section 6.2 Respondents

text: ow kn

text: 't on /d

text: in 40%

text: la xp

text: t e Before 30%

text: an c

text: at 20%

text: th %

text: 0% Botnet Worm Phishing Trojan Spyware Virus SPAM Before 65,3 35 32,9 16 10,3 5,4 1,80 After 7,7 14,3 13,2 6,6 7,9 1,1 0

text: Enhanced home PC security 1=yes 6=no

text: 1=yes Intended to enhance security 1=yes 6=no 2 3 4 Learned a lot about home PC security 1=yes 6=no 5 6=no

text: Learned a lot about Internet threats 1=yes 6=no

text: 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Figure 5 What effect did the ‘Introduction to Botnets’ have on you personally?

text: M Grand mean 2,5 Low competency Medium competency 2 High competency

text: Learned a lot Learned a lot Intended to Enhanced home about Internet about home PC enhance security PC security threats security

text: s 50

text: nt de

text: Total on 38,3% 40 sp Internet secure

text: f re

text: Internet insecure % o 30

text: Before EISAS Toolset After EISAS Toolset

text: nt de

text: on sp

text: f re Total % o 30 Male 20 Female 10 0

text: See Aspray, William, Haynes, Barbara M. (eds), ‘Everyday information. The evolution of information seeking in America’, MIT Press 2011.

text: There are many other possibilities to get closer to the user at home and his/her needs, of course, and there are many surrounding conditions (legal, political, technical, ethical, security) that determine what would work. The crucial point, however, is that home users need a trusted source that can connect the problem at hand to their operational and task environment and offer help within the skillset and timing requirements of the user.

text: … easily understood

text: Fully agree … easily accessible 2 3 4 … include home computers 5 6 Not at all

text: … are known

text: 4,5 4 3,5 3 ean 2,5 Danger

text: PC Secure 1,5 Difference 1 0,5 0

text: http://www.schneier.com/essay-155.html, ‘The psychology of security’.

text: SPAM fraud. email Malware Human error Tech. error Harm Problem Fraud No problem Privacy Data theft Hacker Botnet 0% 20% 40% 60% 80% 100%

text: 1st danger ean 2 2nd danger

text: difference 1

text: -1 Figure 12 Change in perceived dangers of the Internet Also, the fear of hackers – who are presented as the originators of botnets – grows significantly from the first wave to the second wave of the survey. In the same way, the fear of human and technical errors is greater in the second wave. The fear of SPAM is lower, probably because it is eclipsed by

text: 1st PC secure ean 2 2nd PC secure

text: Difference 1

text: -1 Figure 13 Change in perceived security of the home PC

text: ra %

text: User Internet IT industry Internet access The Law content provider government enforcement provider

text: ENISA, ‘Botnets: Measurement, Detection, Disinfection and Defence’, p. 130. https://www.enisa.europa.eu/act/res/botnets/botnets-measurement-detection-disinfection-and-defence

text: This outcome can be typical for German and Danish populations, of course. Whether home users in other Member States share this opinion is left to further inquiry.

text: 90 80 s 70

text: de 60

text: f re 40 % o Before 30 20 After 10 0

text: Action % level before % change after EISAS

text: Use any security software on my PC at home 88.8 6.3 Update my security software to the latest version and patch 82.0 10.7

text: Operating system is on the latest patch level 60.8 9.9 Browser is on the latest patch level 72.0 15.8 Adobe Flash is on the latest patch level 68.1 19.7 MS Office is on the latest update 48.7 17.2 Backup always or often 36.6 7.3 Table 1 Change in security behaviour after being exposed to the EISAS Basic Toolset For producers of security software it could be of interest that only one out of five respondents (16.9%) actually bought a security package; 10% installed a solution offered by the employer and 10% used a pre-installed package. All other respondents (more than 60%) state that they used some package available on the Internet free of charge.

text: 89% 90 80 67,7% 70 60 50 Yes No 40 32,3% 30 20 11% 10 0 Work with office data at home Employer should provide security at home

text: s nt

text: de 25

text: on sp

text: f re Very good or Good

text: Security policies Policies include Policies are easily Policies are easily known computers at accessible understood home

text: 3,00 2,80 2,60 2,40 2,20 ean 2,00 Grand mean

text: 1,80 Low competence Medium competence 1,60 High competence 1,40 1,20 1,00

text: 2,8 2,6 2,4 2,2 ean 2 grand mean

text: 1,8 low competence 1,6 medium competence 1,4 high competence 1,2 1

text: Initials Name Description

text: LRZ Leibniz-Rechenzentrum Large provider of network access and computing for academic institutions in the Munich area

text: TUM Inf Technical University Munich Technical University of Munich, Department of Informatics

text: LMU F11 LMU Munich University of Munich, Department of Psychology and Educational Sciences

text: LHM Landeshauptstadt München Several units of the public administration of Munich

text: Other ‘snowballing’ Employees of the above institutions gave the link to the survey to interested colleagues in the same and other institutions, friends and relatives

text: VKB Versicherungskammer Bayern Large insurance company

text: Initials Name Description

text: AxD Alexandra Institute An institute under the Aarhus University focusing on IT and IT security, totalling 300 employees DF Danfoss An international manufacturer of heating products in Denmark, totalling 6,500 employees

text: Germany Denmark

text: Organisation # of Employees Organisation # of Employees

text: LRZ 170 DF 6,500 TUM Inf 150 AxD 300 LMU F11 630 LHM 370 Other 900 VKB (6,500)

text: Demographic Germany Denmark

text: Count Column (%) Count Column (%)

text: Age ≤20 14 6.0% 1 1.0% 21 - 30 152 65.5% 10 10.1% 31 - 40 27 11.6% 22 22.2% 41 - 50 18 7.8% 34 34.3% 51 - 60 13 5.6% 23 23.2% 61 and older 8 3.4% 9 9.1% Sex Male 101 43.5% 83 83.8% Female 131 56.5% 16 16.2%

text: Demographic Germany Denmark

text: Count Column (%) Count Column (%)

text: How secure is Green (secure) 10 4.3% 23 23.2%

text: the Internet in

text: Yellow (moderately secure) 147 63.4% 66 66.7%

text: Red (insecure) 75 32.3% 10 10.1%

text: Computer High 111 47.8% 59 59.6%

text: Medium 106 45.7% 38 38.4%

text: Low 15 6.5% 2 2.0%

text: Survey 1 Germany Denmark Total Completion

text: DE DK

text: Invited 2,220 Unknown N/A N/A N/A Accessed questionnaire 524 205 729 23% Completed questionnaire 232 99 331 44% 48% Table 6 Response report from Survey 1

text: Survey 2 Germany Denmark Total Completion

text: DE DK

text: Invited 232 99 N/A N/A Accessed questionnaire 95 36 131 41% 36% Completed questionnaire 85 23 108 89% 64% Table 7 Response report from Survey 2

text: See http://www2.computercheck24.com/visor_server/coronic2/de/audit-start.page

text: http://www.kablink.org/teaming was used for reasons of availability and convenience; every other Web 2.0 platform hosting a web-services interface would do as well. Teaming was chosen primarily because of its workflow capabilities which the project needed for tailoring and packaging IT help information.

text: See http://otrs.org/

text: An example for solutions like this can be found at http://www.core-competence.com/en/

identifier: EISAS Basic toolset

nummer: eisas-basic-toolset

title: EISAS Basic toolset

text: EISAS Basic Toolset 1.0

text: October 2011 Feasibility Study of Home Users’ IT Security

text: EISAS Basic Toolset 1.0

text: Feasibility Study of Home Users’ IT Security

text: EISAS Basic Toolset 1.0

text: Credits

text: This study was commissioned by ENISA to the Ludwig-Maximilians-Universität München in Munich, Germany (LMU Munich, http://www.lmu.de/). The editor wishes to thank the author of the study, Dr Werner Degenhardt, LMU Munich, and co-researcher Mr Klaus Tingholm Kristensen, i-Trust, for their work. The researchers wish to express their gratitude to the participating organisations for their great support in conducting this study, especially Dr Ernst Bötsch of Leibniz-Rechenzentrum (http://www.lrz.de ) and Mr Joachim Wolff of Versicherungskammer Bayern (http://www.vkb.de ) for their extensive support.

text: About ENISA

text: The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard of information for good practices. Moreover, the agency facilitates contacts between the European institutions, the Member States and private business and industry actors.

text: Contact details

text: The study was edited by Mr Kjell Kalmelid, Expert, ENISA. For questions related to this study, EISAS or for general enquiries on CERT cooperation, please use the following contact details:

text: E-mail: CERT-Relations@enisa.europa.eu

text: Internet: http://www.enisa.europa.eu/act/cert/

text: EISAS Basic Toolset 1.0

text: 1 Executive summary

text: This study is part of the activities taken under the European Information Sharing and Alert System (EISAS) framework and looks into the problem of information technology (IT) security awareness programmes and IT security education of citizens at home. Citizens and small and medium enterprises (SMEs), constitute the largest group of Internet users in the European Union. IT systems owned and operated by those users are more exposed to the risk of becoming infected by malware and, in particular, of becoming part of a botnet – a network of compromised computers under malicious remote control.

text: The reason is that the computers of those end-users are generally less protected than those in large organisations and companies. Among other things, botnets are used for initiating DDoS attacks against organisations. Without proper security behaviour, citizens’ home computers will indirectly and unknowingly pose a threat to the functional and sound Critical Information Infrastructure when performing everyday tasks on IT devices connected to the Internet.

text: In this context the general goal of EISAS is to:

text: • empower all EU citizens and SMEs with the knowledge and skills necessary to protect their IT systems and information assets;

text: • build on national capabilities of EU Member States;

text: • enhance cooperation between national/governmental CERTs in the EU Member States.

text: With regards to empowering citizens and SMEs, the first obstacle is that there is just too much information available that is not tailored to the problem context of the user. The second obstacle is that home users are not easily reached by IT security information.

text: These shortcomings need to be addressed once and for all.

text: The main objective of this feasibility study has been to develop and validate a ‘ready-to-use’ information security awareness-raising concept (‘EISAS Basic Toolset’). The EISAS Basic Toolset will be a set of methodologies and tools that facilitates outreach to different sub-categories of the EISAS target groups with information about IT security in order to efficiently empower them with the necessary means and skills to protect their computers. The study acknowledges that there is a long road to travel from knowledge to behaviour. The outcome of the study ‘EISAS Basic Toolset’ shows that approaching the home user via his/her role as an employee of an organisation or enterprise works

text: EISAS Basic Toolset 1.0 Feasibility Study of Home Users’ IT Security

text: well. The key success factors of enhancing the reach and outreach of IT security education measures for home users are listed below. • Address employees in their role as home users directly by e-mail or other means of personal contact by a trusted person or entity of the organisation. Just putting a link on a website does not work. • Provide information and tools tailored to the understanding and skills of the target groups. A one-size-fits-all approach will not work. • Provide the opportunity for feedback and comments. • Acknowledge the fact that the most important source of help to the user is a personal network of technically competent individuals. • Bring the fact that there is help right in front of the eyes of the users, for example, by introducing a 112-Internet emergency button for the browser that connects the home user to his/her preferred information sources and trusted specialists.

text: EISAS Basic Toolset 1.0

text: 2 Background

text: Citizens and small and medium enterprises (SMEs) constitute the largest group of Internet users in the EU. IT systems owned and operated by these users are popular targets for hackers to, for instance, steal valuable personal information such as credit card numbers or customers’ details or to be incorporated into botnets, i.e. networks of remotely controlled computers. A botnet, in turn, is the means used to massively distribute spam and malware or to carry out Distributed Denial of Service attacks (‘DDoS attacks’) against networks.

text: A successfully conducted DDoS attack will inevitably cause damage for the targeted organisation by causing longer or shorter disruptions of communication services and information systems. In the worst case, the networks and systems attacked would be part of Critical Information Infrastructures (CIIs), which makes DDoS attack a serious threat to society at large.

text: The reason that computers of citizens and SMEs are being targeted by hackers is because the computers of those end-users are generally less protected than those in large organisations and companies. In general, large organisations have more resources at their disposal for managing information security risks, including having experts in charge of ensuring the appropriate protection of the organisation's computers, and are able to invest in carrying out awareness-raising activities and provide training for their employees, i.e. end-users.

text: That is, without proper security behaviour citizens at home will pose a threat to the functional and sound Critical Information Infrastructure when performing everyday on IT devices connected to the Internet.

text: Figure 1 Interaction of system and user from the IT security perspective

text: EISAS Basic Toolset 1.0

text: Until now the response of society to citizens’ lack of expertise in network and information security, lack of awareness of threats and risks to their computers, and lack of knowledge about how to protect themselves against those risks and threats has been the focus of awareness-raising initiatives.

text: In fact, the EISAS feasibility study shows that there is a great deal of good quality information available on the national Computer Emergency Response Team (CERT) websites and other initiatives that could be accessed and used by citizens and SMEs to advance security at home and at the SME workplace.

text: The FISHA project can be seen as building on EISAS and shows that there are ways to enhance the cooperation amongst the national information-providing bodies and organisations. The project has started to address the EISAS activities of information collection, information processing (consolidation and formatting) and information dissemination (making information available) as part of transmitting security information from the source to the end-user chain.

text: Figure 2 EISAS activities

text: There is, however, still more to be accomplished with regards to the European Commission’s goal to ‘empower all EU citizens and SMEs (seen similar to end-users in their security behaviour) with the … skills necessary to protect their IT systems and information assets’ and ensure that those target groups incorporate knowledge and skills into IT security action.

text: There is just too much information out there that is not tailored to the problem context of the user. Also, information on IT security and IT problems in general is often communicated in a way that requires more skills than everyday users possess.

text: EISAS Basic Toolset 1.0

text: In problematic IT security situations users often do not have the inclination, time, energy or cognitive resources to undertake a complete analysis of the situation. Where they are rushed, stressed, uncertain, indifferent, distracted or fatigued they tend to focus on less of the information available. When making decisions under these circumstances they often revert to simple heuristics taken from their experience in the analogue world or just do nothing.

text: There is a long road to travel from knowledge to behaviour.

text: • Firstly, it must be known that there are threats such as botnets out there in the first place.

text: • Secondly, one has to adopt the opinion that this is something that one should care about.

text: • Thirdly, one has to have the skills to actually do something to get rid of malware, such as botnet components on your equipment.

text: • If one then has the intention to actually invest time and energy in doing something then it is probably running the anti-virus software on the home PC (provided one does not have other more important duties to take care of in this available time slot).

text: EISAS Basic Toolset 1.0

text: Figure 3 Information dissemination and IT security behaviour

text: There are awareness initiative websites addressing the home user. However, those initiatives compete with an abundance of information services to get the users’ attention and are, additionally, difficult to evaluate in terms of effectiveness.

text: This illustrates that there is a real problem in reaching out with information on IT security to the home user and other entities without a professional IT department such as SMEs. Putting information on security websites is obviously not enough. The skill, intention and behaviour component of IT security behaviour at home is not covered.

text: The concept proposed here builds upon the recommendations of the ENISA Ad Hoc Working Group on Analysing Micro Enterprises’ Needs and Expectations in the Area of Information Security (IS) , which point out that important steps are to create new user-friendly tools and tailor security and privacy initiatives in order for the target groups to be able to comply with them.

text: This study tests the presupposition that the easiest way to accomplish these aims is to take security information and alerts directly to the user’s desktop instead of waiting until the user recognises that there is a problem and, in addition, has the motivation and opportunity to look for help.

text: EISAS Basic Toolset 1.0

text: 3 Goal of the study

text: The general goals of EISAS are to:

text: The main objective of this feasibility study is to take the first step in the direction of the development and validation of a ‘ready-to-use’ information security awareness-raising concept (‘EISAS Basic Toolset’).

text: The EISAS Basic Toolset will be a methodology that facilitates outreach to the EISAS target groups with information about IT security in order to efficiently empower them with the necessary means and skills to protect their computers. The target groups are citizens (home users) to be reached via their employment in an enterprise.

text: In addition, the EISAS Basic Toolset has the aim and should be a means of raising security awareness among home users, but implemented by targeting employees – in their capacity as home users – at their workplaces. This reflects the ever-increasing dissolution of the boundaries between work and private life, and also builds upon the fact that employees can be reached by motivating the employer to take an active role but home users cannot easily be reached directly. There is no reachability information on home users publicly available.

text: EISAS Basic Toolset 1.0

text: 4 Methodology

text: The study was planned and conducted as a feasibility study, as a proof of concept that an intervention such as the one described above would work.

text: The study was implemented using a ‘pre-test –> EISAS intervention –> post-test’ design.

text: The pre-test (an online questionnaire borrowing heavily from Eurostat Model Questionnaire on ICT usage in households and by individuals 2010) asked questions on IT usage, knowledge, attitudes, skills, intentions and behaviour regarding IT security at home.

text: The intervention consisted of a special website set up to inform respondents about botnets and ‘howto’ information on getting the home PC clean. Also, a 112-Internet emergency button was presented that the respondents could optionally use to search the database for information and get in contact with support. After responding to the pre-test questionnaire, respondents were asked to go to the EISAS Toolset website, read the information, follow the instructions, and install the 112-Internet emergency button.

text: For the post-test another online questionnaire was used, repeating some questions from the pre-test and also questions asking respondents to evaluate the EISAS Toolset information and the 112-Internet emergency button. The post-test was sent out to respondents of the pre-test.

text: This design shows the effect size of applying the EISAS Basic Toolset and will thus be a measure of impact (# of individuals taking desirable actions).

text: Pre-test, intervention and post-test were set up in German and Danish language versions. Undertaking the feasibility study in two Member States using two languages should show that the Basic Toolset would work on an EU-wide level.

text: In Germany participants were recruited among employees:

text: • of the two universities of Munich (Technical University Munich – TUM; University of Munich – LMU);

text: • from units of the public administration of the city of Munich;

text: • and persons connected to those institutions. In Denmark participants were recruited among employees: • of Alexandra Institute of the Aarhus University; • of Danfoss, an international manufacturer of heating products. Employees were invited by e-mail to take part in the study by a person known to and trusted by the respondents (CSO, head of department). The pre-test was taken by 331 respondents; the post-test was taken by 108 respondents.

text: EISAS Basic Toolset 1.0

text: 5 Results 5.1 Knowledge of IT security

text: The most impressive data, amongst the others, show that knowledge of what a botnet is proves to be dramatically absent even in this population of relatively well-educated citizens: 52.9% of the respondents stated that they do not know what a botnet is and 12.4% said that they cannot explain it to another person. This shows that there is a long way to go to make users aware of this threat.

text: But data also show a significant decrease of ‘Do not know what it is’ and ‘Can't explain’ responses after respondents digested the information presented by the EISAS Basic Toolset database. Only 5.5% of respondents claimed that they do not know what a botnet is and 2.2% said that they cannot explain what a botnet is to another person.

text: We see similar effects with the other terms. ‘Don't know’ and ‘Can't explain’ in the case of worms dropped from 35% to 14%, phishing from 33% to 13%, trojan from 16% to 6% and so on.

text: Figure 4 Can you explain... to a friend or colleague?

text: EISAS Basic Toolset 1.0

text: The ‘Introduction to Botnets’ in the EISAS Toolset knowledge base worked remarkably well.

text: Why did the intervention work so well? Respondents liked the ‘how-to’ style of the presentation of the text and the security check that gave them the opportunity to actually check the security state of their PC at home.

text: As one respondent stated: ‘It took me more than 15 minutes to fill out the questionnaire, 30 minutes at least, because I did not know some terms and what I have on my PC and had to think. But now I am much brighter than before.’

text: Another respondent wrote: ‘The information contained in the toolset is worth much more than those 10 minutes you need to fill out the questionnaire. I downloaded and installed the firewall. The security check was positive all green then. May I forward the link to friends and colleagues? This is worth real money.’

text: Respondents learned and respondents acted.

text: It can be seen that:  46% of respondents state they learned a lot about the threats of the Internet;  44% of respondents state they learned a lot about the security of their PC at home;  55% of respondents state that they intended to deal with the security of their PC at home;  49% of respondents state that they actually dealt with security and increased the security of their PC at home. In other words, half of the respondents state that they cared about the security of their PC at home, actually increased the security and attributed this motivation and action to being exposed to the information and ‘how-to’ on the EISAS site.

text: EISAS Basic Toolset 1.0

text: As the content and wording of the Toolset introduction to botnets were directed at the less competent home user, we expected more effect on those low competence users than on users stating high competence with computers.

text: Figure 6 below shows the average rating of the items on a six-point scale running from ‘1=totally agree’ to ‘6=do not agree at all’. Lower values signify that users agree with this item, higher values signify that users do not agree with this item.

text: Figure 6 thus shows that the Basic Toolset worked as expected. Users having a low level of competence with computers are showing much larger mean effects of the exposure to the toolset material. The largest effect can be seen with the item ‘I intended to enhance the security of my private PC at home’ as an effect of being exposed to the toolset material. This also holds for the item ‘I enhanced the security of my private PC at home’ as an effect of being exposed to the toolset material.

text: This is not only encouraging in putting further work into the EISAS Basic Toolset approach, but also shows that the attitude – intention – behaviour chain is working for IT security information. As far as we can tell from samples of some users who took part in the feasibility study, the behaviour change seems to be enduring. Users were impressed, changed their attitudes, changed their behaviour and are establishing the changed behaviour as a behavioural routine.

text: EISAS Basic Toolset 1.0

text: Figure 6 What effect did the ‘Introduction to Botnets’ have on you personally (mean values)

text: In general, respondents think they are reasonably well informed in the area of ‘security in the internet’ (see Figure 7). About 40% of the respondents state ‘very good’ or ‘good’ when asked how well informed they personally feel about ‘security in the Internet’.

text: From the first to the second wave of the survey this figure goes up to about 70% feeling ‘very good’ or ‘good’ , the number of informed respondents grew by more than 30%. This shows that appropriate information such as in the EISAS Basic Toolset site does have an effect on the state of information of home users.

text: EISAS Basic Toolset 1.0

text: Figure 7 How well informed do you feel about security in the Internet?

text: Figure 7 also shows that those who think the Internet was a reasonably secure place feel better informed than those who feel the Internet was an insecure place. This probably reflects everyday reality: better knowledge leads to better mastery of the environment. Knowledge and perceived mastery are correlated.

text: It comes as no surprise that the effect on knowledge is larger with those who feel that the Internet is a less secure place. These respondents are simply more susceptible to messages that promise to change the feeling of insecurity. Even more interesting in Figure 7 is the fact that the information in the EISAS Basic Toolset not only changed the state of knowledge of those who feel that the Internet is an insecure place, but it also instilled knowledge in those who do not feel in too much danger from the Internet.

text: In light of the general goal of the EISAS Basic Toolset, this means that the awareness of home users can be changed to a large extent, provided one can manage to get the attention and time of home users. This may seem like a truism, but it shows that an awareness-raising activity extending the reach – the

text: EISAS Basic Toolset 1.0

text: right channel strategy, to adopt a term from marketing – is more important than accumulating information and hoping the users will find the right information at the right time.

text: Where do users head for information and solutions to security of computers and the Internet? Interestingly, Figure 8 shows that ‘security sites on the web’ are the most frequented sources of

text: security information. Security sites on the web are sites such as BSI für Bürger or Heise Online , but not security information of the producers of security products, which rank among the least preferred information sources on IT security.

text: Figure 8 What sources do you use for information and solutions to problems of IT security?

text: EISAS Basic Toolset 1.0

text: Personal sources are very important to home users when it comes to information and support in the area of IT security and problems. Friends, colleagues, family members and specialists combined show that interpersonal sources are by far the largest and most important information source. This means that home users like information that has been filtered by some unbiased human intelligence.

text: Everyday information-seeking and problem-solving rely on a social network of persons who have more knowledge than the users themselves and are able to interpret the complex information out there in the context of the user’s particular problem, knowledge and skills.

text: Personal information, therefore, is easy information that poses little strain on the help-seeker. In fact, the problem will often be solved by the helping person. If an individual is in a position to use the help of a knowledgeable person, he/she will use it.

text: The combined importance of web and personal sources definitely shows what practitioners and governments have to do in the security education of home users: take information and personal support right to the desk of the user. The ‘112-Internet’ browser plug-in, which was used as an experiment as part of the EISAS Basic Toolset piloting, does exactly this.

text: 5.1.1 Security information at the workplace

text: We had hoped that home users would bring home security information from the workplace, but this does not seem to be the case.

text: About 40% of respondents feel relatively confident (‘1=fully agree’ or ‘2’) that IT security policies are known to all employees and 25% express severe doubts (‘6=do not agree at all’ or ‘5’). Equally, only 40% think that IT security policies are easily accessible. Thirty per cent of respondents agree when asked if the IT security policies included the home PC, but only 30% think that the policies are easily understood.

text: EISAS Basic Toolset 1.0

text: Figure 9 Security policies at the workplace are...

text: Users definitely think that the information security policies of their companies can be significantly improved. The evidence tends to suggest that company security policies are largely unknown and are not easily accessible. If an employee knows where to find them, they do not sufficiently include the security of home computers and if they do, the employee cannot understand what they are all about.

text: 5.2 Attitudes towards Internet security and security experiences

text: Respondents were asked to state the biggest dangers of the Internet in their opinion and also how secure their PCs at home were against these dangers.

text: EISAS Basic Toolset 1.0

text: Figure 10 shows the arithmetic means of the responses to this question. The opinions of respondents were measured using a scale ranging from 1=‘not dangerous’ to 6=‘very dangerous’ and from 1=‘very secure’ to 6=‘very insecure’. A high mean thus designates that the perceived danger of the Internet is high and – in the case of PC security – that the PC is perceived as insecure against this danger from the Internet.

text: Figure 10 Biggest dangers of the Internet – how secure is your PC?

text: We see that respondents perceive malware (viruses, worms and so on), problems of privacy, data theft and fraud to be the biggest dangers of the Internet to the PCs at home.

text: At the same time they feel that their equipment at home is actually comparatively secure against those threats of the Internet. With malware, problems of privacy, data theft and fraud we find the greatest difference between perceived insecurity (danger) of the Internet and perceived insecurity of

text: EISAS Basic Toolset 1.0

text: the PCs at home. Malware, threats to privacy, fraud and data theft are perceived as the most dangerous threats, but respondents also think that they are secure in this respect.

text: The respondents feel insecure in the case of SPAM, fraudulent e-mail, human error, technical error and hackers.

text: Explanations of this outcome (the feeling of insecurity in those cases) can be found in the psychology of security, for example, neatly put together by Bruce Schneier. The perception of risk is influenced by many factors such as innate tendencies, information on risks and actual experience with risks.

text: Figure 11 below shows the real world experience of respondents with regards to dangers with networked PCs. Respondents were asked whether they had had a problem with certain dangers and if they had actually experienced harm from those dangers within the last 12 months.

text: EISAS Basic Toolset 1.0

text: Figure 11 Did you have any of the following problems in the last 12 months?

text: SPAM really is a nuisance: 70% of the respondents say that they have had a problem with SPAM in the last 12 months and they feel that they cannot do very much about it. So this fact of the Internet has high salience (everyone gets SPAM): relatively low experience of harm done by SPAM and the experience that a user cannot do much about it. This leads to an intense feeling of the PCs at home being insecure against this threat. Hackers are also seen as a risk one cannot immunise the home PC against. There is low real world experience with hacking, but users read a lot about this problem in the press. That is low salience, but high presence in the public discussion also leads to an intense feeling of the PCs at home being insecure against this threat. It is interesting to see that human error, technical error and malware are seen as the threats doing most real harm to the PC at home. The difference in security perception is that people feel they are secured against malware (perhaps by installing an anti-virus package), whereas human and technical errors occur like bad weather (and one never carries warm clothing and an umbrella). So people feel insecure in respect to human and technical error, but not so much in the respect of malware.

text: Respondents do not report problems with botnets, they just feel insecure because of the coverage they may have seen somewhere or heard of botnets. It should be mentioned here that botnets were known to only 50% of the respondents in the first wave of the survey. The information on dangers of the Internet presented in the Toolbox did have its effects on the perception and attitudes of the home users (see Figure 12 below). The mean fear of users regarding botnets rose by 0.85 scale points from the first to the second wave of the survey.

text: EISAS Basic Toolset 1.0

text: other threats through technical or human error such as being seized by a botnet trojan or losing days’ worth of work and data that cannot be recovered .

text: The information presented in the Toolbox did also have effects on users' perception of how secure their PC would be against the dangers mentioned (see Figure 13). In fact, after running through the Toolbox information on securing the home PC, users thought that their equipment is better armed against threats than before. There is one notable exception: users felt more insecure regarding botnets than before. Correlational analysis shows that less knowledge and less competence lead to a more intense feeling that the home PC could fall prey to a botnet or – perhaps – already has.

text: The explanation is that given the initial state of virtual ignorance regarding botnets, the information presented in the Toolbox shows users that botnets are a serious threat that needs to be addressed with proper security measures. This insight will last for a while and keep the botnet threat on home users' security radar for some time to come.

text: What does this mean for the security education of home users? It seems that the treatment of malware risks by home users has reached some sort of a stable state. People know that malware is there: 9 out of 10 have installed security software and what else can a home user do? It seems that here the security community has to come up with some new ideas if they want users to take more effective countermeasures against malware on their home PCs. One inroad could be the botnet. The term is little known and if it is known, people think they should be concerned. This situation is a door-opener for doing something about security. The threat of botnets to society is primarily DDoS attacks targeting critical information services. If the large-scale DDoS attacks against society are equivalent to natural disasters in the world which people often learn about but seldom experience, then SPAM is the ‘digital litter’ all users unfortunately have to face every

text: EISAS Basic Toolset 1.0

text: day. Although ‘digital litter’ does not smell it is just like real litter; it is clearly visible to the user in the form of SPAM. The ‘botnets-create-SPAM’ relation, together with a sense of being indirectly personally responsible for the problem at large, may prove to be a way forward in convincing home users to better protect themselves.

text: 5.2.1 Responsibility for security

text: Respondents were also asked who should care for the security of the Internet and should be held ultimately responsible. Respondents were asked to rank institutions, persons and bodies according to their responsibility. Figure 14 shows the percentage of respondents who ranked an institution, person or body with rank 1.

text: Respondents in this survey hold the home users, i.e. themselves, primarily responsible for the security of the Internet, closely followed by the Internet content providers. Producers of hardware and software are seen to rank 3 of those responsible for the Internet. Government and law enforcement definitely should not be involved, according to the opinion of these respondents.

text: Figure 14 Who do you think should care for the security of the Internet?

text: EISAS Basic Toolset 1.0

text: The inclination of taking responsibility is underscored by the fact that 80% of the respondents agree with the statement ‘it is in the social responsibility of the user to keep his PC clean’. This corresponds exactly with the ENISA report on botnets which recommends social countermeasures and states: ‘From an ethical and social point of view, protecting a computer from malware is a civic duty.’

text: Taken together this means that it is a good idea to take the users at home at their word and provide them with the information and tools necessary to put the intentions to be secure into practice. Users are definitely much more interested in being empowered to secure themselves than being secured from the Internet by police, government and Internet access providers.

text: It is common knowledge among security professionals and the security community that the perceived time and effort necessary to secure home PCs is one reason why home users shy away from securing their networked IT equipment.

text: Four statements were suggested in order to surround this eluding topic of home user IT security:

text: 1. Time and effort to secure my computer all-in-all is too high for me.

text: 2. It is not important to know how security software works; just install it and you are done.

text: 3. All-in-all the topic of IT security is too complicated for me.

text: 4. There is definitely too much fuss around the topic of security in the Internet.

text: Respondents were asked to agree (1=totally agree) or not to agree (6=don't agree at all) to these statements.

text: 6 5,5 5 4,5 4 Grand mean before

text: an

text: 3,5 Me Grand mean after 3 Mean low comp. before 2,5 Mean low comp. after 2 1,5 1 Time and Tech Security too Too much fuss effort too high knowledge complicated about security not necessary Figure 15 Attitudes regarding time and effort to secure the PC at home The statement ‘Time and effort to secure my computer all-in-all is too high for me’ shows a grand mean of 3.58 on a six-point scale, suggesting that home users tend to invest more time and effort for securing the computer at home if they know what to do. In this respect it is important that exposure to the Toolset is moving things in the right direction, most significantly for those respondents who attribute to themselves low competence with computers. These respondents obviously learn that: 1. Time and effort to secure the PC at home is not too high. 2. Some knowledge of the workings of security software is necessary. 3. The topic of IT security is not so complicated after all. 4. The topic of Internet security is even more important than they thought before.

text: EISAS Basic Toolset 1.0

text: This shows that a lot can be done for the security of private computers in households if home users can be reached with the right information and the right tools. The EISAS Basic Toolset seems to be a step in the right direction.

text: 5.3 Security behaviour at the home PC

text: Basically, respondents sport a security level known from Eurostat surveys, with 88.8% reporting that they have security software installed and 82% reporting that they keep the installed security software updated to the latest version and definition file.

text: Though security is on a high level already, Figure 16 below shows that it can be raised to even higher levels. Exposure to the EISAS Basic Toolset shows remarkable effects on the security behaviour of respondents.

text: EISAS Basic Toolset 1.0

text: Figure 16 Security behaviour before and after intervention

text: Security software installed goes up from 88.8% to 95.1%, which is an increase of 6.3%. This is not too small an increase in itself, but taken into account that only 11.2% of respondents had the chance to change their behaviour, it means that 60% of respondents eligible changed their security behaviour.

text: Table 1 below shows the percentage of respondents having a certain security level before being exposed to EISAS Basic Toolset information and the percentage change to the better security level after they had worked through the Toolset information.

text: 5.4 Home and office

text: Many respondents work with office data at home. Two-thirds take home office data on portable storage or access office data using an online connection to the employer's network to work with. This is in line with the general observation that the borders between work and private life, between office and home are blurring. One basic presupposition of the EISAS Basic Toolset is that there is a connection between employers and employees concerning the security of private computers at home and, in fact, this connection exists. Of all employees, 89% consider it a good idea to have the employer provide information and tools for the security of private computers, smartphones, etc. at home.

text: EISAS Basic Toolset 1.0

text: Figure 17 Office data on the home PC; should the employer provide information and tools for home PC security?

text: The reasons employees give for this opinion in an open text question are listed below.

text: • Since they work for the employer at home, it is a duty of the employer to care for the employees.

text: • It is in the interest of the employer to secure his/her information on home PCs.

text: • The employer is considered a trusted and knowledgeable source for information and tools.

text: • The employer could provide the right tools at lesser cost.

text: As one respondent put it:

text: ‘Though Internet security and IT security in general is ever present in the media most people act as if time and effort necessary were too high, updates would be annoying and security software just eating up PC resources. People who are not trained as IT specialists are unable to distinguish useful from

text: EISAS Basic Toolset 1.0

text: useless or even harmful information. On this background, it is a good idea to get the means for selfdefence at home from an actor having a certain accepted authority (e.g. employer) who provides tools, background information and alerts if immediate action is required.’

text: Only a minority of respondents (11%) think that employers should keep their hands off the private home PC. Those users fear the employer could seize the home PC and do more harm than good to the employee at home.

text: The employees' requests and wishes regarding the security of their computers at home are currently not met at even the most basic level – the information security policies at the workplace (see Figure 18 below).

text: Figure 18 Security policies at the workplace and at home

text: • Only 37% of the employees think that the company security policies are known to all employees.

text: • Only 26% feel that the security policies of the company include the security of the computers at home. • Only 39% of the employees rate the security information of the company as easily accessible. • Only 28% judge the understanding of security information of their company as being very good or good. On the whole this shows that there is much room for improvement in providing employees with security information they can act upon in their home environment. Companies and organisations are trying to improve the situation. One participating organisation carried out experiments with a monthly consultation hour handling problems that employees have with their computers at home. Another implemented a series of lectures and presentations treating the problems of users at home. Both approaches are considered successful in extending the reach of security information. However, on the downside, neither approach is considered suitable for large-scale implementation. Having a more personal face-to-face approach with security information and actually helping people in a ‘home user helpdesk’ is seen to be well beyond the resources available. It seems that the EISAS Toolset has at least some properties of a mature solution in this regard: • knowledge base with information tailored to the knowledge and needs of users (employees) at home; • authoritative and trusted source of information and tools (employer); • some method of providing personal or virtually personal contact to security specialists and tech-savvies; • hints and alerts on what is important to reduce the complexity of dealing with IT security.

text: 5.5 Attitudes towards the EISAS Basic Toolset

text: 5.5.1 Introduction to botnets and securing the home PC

text: The ‘Introduction to Botnets’ site contained in the EISAS Toolset Knowledge Base was accessed over 1,500 times during the field phase of the survey. Since access to the site was anonymous there is no

text: EISAS Basic Toolset 1.0

text: information on who accessed the site and what information contained therein was accessed for how long. Whatever the users did, however, the introduction worked well, as was shown above.

text: Users also liked the introduction and its components. On a scale ranging from ‘1=very good’ to ‘6=very bad’, users on average rated content with 2=good, and its clarity even better with a mean rating of 1.8. What is even more important is that the lower the IT competence of the user, the more he/she liked the introduction to botnets. Since the text was tailored to the home user not having special training or experience in IT technology, the Toolset obviously worked in the intended direction.

text: Figure 19 How do you like the ‘Introduction to Botnets’ in the Basic Toolset?

text: Users had many proposals for what content and problems could and should be included and handled in the Toolset database. The proposals covered issues such as:

text: • Is antivirus software really secure?

text: • What are the right steps if malware is detected? • What threats exist against routers, smartphones, etc.? • How can information be encrypted? • How can a hacker be tracked down? • How can I block and remove unwanted software? • How can I filter content (children, advertising)? • Secure online banking? • What about the Mac? It can be expected that the knowledge base would grow in many directions if home users were given the opportunity to question and discuss.

text: 5.5.2 The 112-Internet emergency button

text: The experiment with an emergency button browser plugin (see Figure 20 below) was very well received by users (see Figure 21). On a scale ranging from ‘1=very good’ to ‘6=very bad’, users on average rated the basic idea of the emergency button with content with 1.2 and aspects such as layout, clarity, usefulness and usability with an average of about 2, which means ‘good’ on the scale of German school grades ranging from ‘1=very good’ to ‘6=unsatisfactory’. The questionnaire also asked the respondents about the perceived usefulness of various functions of the 112-Internet emergency button, which were also well received with average ratings ranging between 1.5 and 2.5 on a scale from ‘1=very useful’ to ‘6=not useful at all’.

text: EISAS Basic Toolset 1.0

text: Figure 20 The 112-Internet emergency button with alert

text: Figure 21 What do you think about the 112-Internet emergency button?

text: EISAS Basic Toolset 1.0

text: 6 Participants 6.1 Companies

text: The study set out to reach a typical mix of companies and organisations. Among the companies accessed for participation were some large companies from the chemical industry, telecommunications and finance/insurance. In the public sector the study concentrated on the university and public administration sector.

text: All companies approached indicated serious interest in taking part in the study. Dealing with the IT security of employees at home is an issue. The timeframe of the study, however, was too narrow and in addition was located in the vacation time of Germany and Denmark. So participation was not feasible for most possible participants.

text: IT security is a high-ranking theme in all companies and organisations. Often it has to be routed through several boards such as staff council, human resources and IT, and it seems that in some cases the final decision would rest with top management. This process is laborious and time-consuming. In addition, the field phase of the study was scheduled for August/September. Summer is vacation time in Denmark and Germany so this severely derailed the smooth execution of the research programme. Eventually, the following institutions were able to participate in the study.

text: Table 2 EISAS Basic Toolset – Participating organisations and institutions in Germany

text: EISAS Basic Toolset 1.0

text: VKB was a special case. It was not able to finish the internal decision-making and preparation process within the timeframe allocated for the field phase of the study. Nevertheless, it decided to apply the EISAS Basic Toolset and since VKB decided to announce the project on the internal security website in the first instance, it was able to provide important information on the recruiting process and outreach of IT security information and tools.

text: Table 3 EISAS Basic Toolset – Participating organisations and institutions in Denmark

text: Table 4 The number of employees in the participating organisations

text: 6.2 Respondents

text: 6.2.1 Demographics

text: The study was planned and conducted as a feasibility study, as a proof of concept that an intervention such as the one described above would work. The table below shows some respondent characteristics used as independent variables in this report. The questions ‘In your opinion: How secure is the Internet in general?’ and ‘How competent do you personally feel with handling computers?’ were measured on a six-point scale and recoded to three categories for analysis (1,2 = green/high; 3,4 = yellow/medium; 5,6 = red/low). Compared to the general populations of Germany and Denmark, demographic characteristics such as age and sex are skewed, reflecting the employee structure of the participating organisations (public sector, university, manufacturing and various other organisations whose employees were contacted by CSOs of the primary organisations participating in the study). Compared to the general public, the participating respondents are, on average, younger, better educated and technically more proficient. Since the effects of the Basic Toolset are stronger with technically less proficient individuals, it is expected that extending the Basic Toolset to other organisations and other industrial sectors in a second, larger field experiment would produce average effect sizes of similar magnitude.

text: EISAS Basic Toolset 1.0

text: Table 5 Some demographics of the respondents of the study

text: 6.3 Response rates: Survey 1

text: Survey 1 ran from 11.8.2011 through 30.8.2011.

text: Invitations to take part in the study were sent out by e-mail by a known and trusted person in the participating organisations (this was in the hands of the CSO). The invitees were encouraged to give the link to the survey to other people (colleagues, friends, relatives) who might be interested in taking part in the survey.

text: About 25% (N=729) of the individuals invited responded by accessing the online questionnaire. About 45% (N=331) of respondents completed the questionnaire. Of the N=391 respondents who did not complete the questionnaire, almost all (94%) quit with the first question asking for the respondent’s email address. Anecdotal reports show that some respondents just refuse to take part in a survey that is not strictly anonymous.

text: Revealing one's e-mail address definitely is a matter of trust. Respondents either put trust in the integrity of the institution doing the survey and the security of personal information in the hand of this institution or they do not.

text: If the response rate of 25% seems low, VKB gives a hint to the right perspective on response rates. VKB decided to invite employees via a link on the VKB security website. Here the response rate was just about 0.0006% (4 out of 6,500 employees). This is in line with one assumption of the EISAS study: it is just not much use putting a link to IT security information on a website.

text: It was not possible to test different incentives apart from e-mail invitation plus reminder by trusted persons in an organisation owing to the given restraints on time and budget for this study. But talking with the CSOs of the participating organisations and the evaluation of the toolset by respondents did reveal some possibilities (see EISAS Basic Toolset).

text: 6.4 Response rates: Survey 2

text: Survey 2 ran from 7.9.2011 till 19.9.2011. Invitations to take part were sent out by e-mail to all who completed Survey 1. A reminder was sent out six days after the initial mailing. A total of N=108 respondents completed the second questionnaire.

text: 7 Overview of the information material provided 7.1 Introduction to botnets and securing the home PC

text: Figure 22 shows a screenshot of the starting page of the Basic Toolset information on botnets and securing the home PC. The information presented is pulled out of a knowledge base, can be read onscreen or be printed out. There were seven paragraphs of information and a security check.

text: Figure 22 Start page of the Basic Toolset introduction to botnets and secure PCs

text: EISAS Basic Toolset 1.0

text: 7.2 The 112-Internet IT emergency button

text: The 112-Internet IT emergency button was an experiment tested as part of the information material and is not an integral part of the EISAS Basic Toolkit 1.0. The experiment aimed to understand whether and how this approach would be received by the respondents. The component consists of:

text: • a browser plugin, communicating with the user;

text: • a dispatcher that stores and forwards user requests to a backend system;

text: • a Web 2.0 knowledge base that is configured as a background system, to a support ticket system, a chat server, whatever may have to be configured.

text: The browser plugin collects the requests of the user, transmits the requests to the dispatcher and transmits the help information from the dispatcher back to the user. If there are alerts being pushed from the backend system to a group of users or target machines via the dispatcher, the browser plugin informs the user like a traffic message channel and in this way works as an alert system.

text: The dispatcher works as a control centre that qualifies user requests and retrieves help from websites, databases, humans (experts, power users, IT buddies), whatever has been brought to the knowledge of the dispatcher.

text: The dispatcher component acknowledges the fact that there are many IT Sec information sharing and alerting systems out there and many ways information and alert dissemination can be implemented.

text: The dispatcher can collect information from various information, alert and help sources and transmits the search results to the browser plugin where they are shown on a results page. If the user clicks on a result he/she is connected directly to the information source. The dispatcher keeps track of what he/she delivered to what instance (browser, machine, user) of the plugin and asks the user (helpseeker) for feedback on the solutions and alerts received. In the simplest form, the feedback is a star rating; more elaborate forms can use a questionnaire.

text: In its current version the dispatcher connects to a Web 2.0 platform as a knowledge base backend that contains information in various forms (FAQs, Wiki, documents, commented links, monitored

text: community forums, experts, power users etc.). For managing support requests it uses the OTRS ticket system. Other possible backend components already exist in the form of the many initiatives of CERTs, ENISA and other organisations. It can well be imagined that an ‘Information Producer’ in the FISHA model smoothly fits in here as the main information delivery backend.

text: Figure 23 The 112-Internet IT emergency button user interface

text: EISAS Basic Toolset 1.0

text: 8 EISAS Basic Toolset User Manual 8.1 Overview

text: The EISAS Basic Toolset aims to bring IT security information out there to the end-user and his/her equipment at home.

text: Security information is collected and compiled by many organisations, whereby ENISA and the national CERTs have the obligation to compile and condense this information for national use. EISAS has the goal of finding ways of disseminating this information to the end-user at home and SMEs. The FISHA project can be seen as complementary to EISAS in the way that it shows ways to enhance the cooperation amongst the national information-providing bodies and organisations.

text: The EISAS Basic Toolset is set up to provide organisations and companies with recipes and support to enhance the outreach of awareness-raising initiatives to improve the security of their employees in their role of home users of private PCs and other networked equipment.

text: Ideally, the process consists of a security status check (comprising a questionnaire setting the stage), information, tools and other methods that help the home user to get along and a post-test that checks what was reached in the end.

text: Figure 24 EISAS Basic Toolset blueprint

text: 8.2 Recruiting participants

text: Recruiting participants is a two-step process. First, a company or an organisation has to be won for participation in the Basic Toolset program. Next the company has to motivate employees to participate and enhance the security of private IT equipment at home.

text: 8.2.1 Organisations

text: Recruiting organisations and enterprises seems to be an easy, though time-consuming process. Recruitment is easy if the organisation or enterprise has a security program in place. Running awareness-raising initiatives inevitably leads to the point where a lack of outreach and measured success is felt. All organisations and enterprises approached in the course of this feasibility study showed marked interest in new ways of reaching employees, refining and altering the channel strategy and measuring success. All organisations and enterprises were thinking of ways of enhancing the security practices of their employees in their role as home users. Recruitment of organisations and enterprises can be time-consuming if the decision to take part in a programme such as this has to be taken to decision-making bodies and cannot be carried out by the

text: EISAS Basic Toolset 1.0

text: CSO under his own responsibility. If the EISAS Toolset is going to be part of the general IT security of the whole organisation or enterprise it probably has to be routed through several boards such as staff council, human resources and IT, and it seems that in some cases the decision finally would rest with the top management. This takes time. According to the experiences from this study the estimates run from three months to half a year for this laborious process.

text: Decision-making will be easier if the whole program can be carried out in-house. Taking parts of the program to cooperating organisations (LMU in this case) is a handicap owing to issues of data privacy protection and confidentiality.

text: 8.2.2 Employees

text: Recruiting participants in the organisation or enterprise is a matter of finding ways to motivate employees to take part in this endeavour. The most important incentives seem to be:

text:  being personally addressed by a trusted sender;

text:  perceived usefulness of information and tools.

text: Putting a link to the Basic Toolset on a website does not produce any outreach. Luring employees to the Toolset via games or lotteries did not find much support when discussed with the participating CSOs, as they usually warn employees not to go to lottery sites or to take part in lotteries because of security reasons.

text: This feasibility study also shows that success in recruiting participants depends heavily on giving the respondents a feeling of being secure when taking part. Possible participants did not like to give away their e-mail address. Since measurability is a key component of the Toolset, it requires the inclusion of a ‘before and after’ assessment scheme. Therefore, additional incentives should definitely be considered to increase the motivation of employees to respond to both questionnaires.

text: 8.3 Developing the questionnaire

text: The questionnaires used in this feasibility study had too many questions and took too long to get through for some respondents. Median completion time for the pre-test questionnaire was 15 minutes (meaning that 50% of the respondents took 15 minutes and less and 50% of the respondents took more than 15 minutes). Mean completion time was 25 minutes. The post-test questionnaire had a median completion time of 15 minutes and a mean completion time of 22 minutes. It seems to be a good idea to provide the participants with an EISAS model questionnaire from which the participants can take questions (following the example of Eurostat).

text: EISAS Basic Toolset 1.0

text: 8.4 Knowledge base

text: In this feasibility study the EISAS Toolset stored the information presented in a professional knowledge base application. Though for simply presenting information this is a rather complex endeavour, it can be recommended. Built-in communication and feedback functions currently defining Web 2.0 seem to be the right way to foster communities of practice leading to empowerment and self-help for problems defined by home users themselves.

text: The experiment with the 112-Internet emergency button aimed to place a searchable information base (and in the future, possibly a network of tech-savvies) right in front of the users, always at their fingertips.

text: The information presented has to be tailored to the competencies and reading habits of the users. The Basic Toolset information on botnets can serve as an example. The amount of information, technical complexity and presentation style were well balanced to the needs of the respondents. Only time can tell what other populations and problem situations require.

text: As learned in the process of recruiting participating organisations, there is a wealth of knowledge on what works in a particular organisation (content, presentation of information, incentives, timeframes etc.) that should be collected, synchronised and put in the EISAS Toolset. Also, providing learning possibilities such as 'adventure-based learning' for recurring security behaviour problems would be welcomed by enterprises striving to make their employees more secure at home.

text: A more streamlined communication between national CERTs and enterprises regarding advisories, alerts and early warnings would have favourable effects on building a knowledge base tailored to the needs and uses of end-users at home.

text: 8.5 Results and benchmarks

text: The Basic Toolset assumes that measurement of success will be implemented on a regular basis. That means that there is an ever-increasing wealth of information on the security state of home users and their networked equipment at home. A benchmark showing the user where he/she stands in comparison to the average seems to be a good idea to express the importance of being secure to the home user and to further motivate him/her.

text: EISAS Basic Toolset 1.0

text: 9 Next steps

text: The feasibility study shows that the IT security of end-users and their IT equipment at home can be significantly improved using the EISAS Basic Toolset approach.

text: Citizens (home users) can be reached with information on IT security facts and procedures via their employment in an enterprise by motivating the employer to take an active role. The key factors for success are tailoring the IT security information to the needs and understanding of the end-users at home, and offering a support structure providing help at the time when help is needed. The EISAS Basic Toolset approach promises to be a way to efficiently empower end-users with the necessary means and skills to protect their computers and information assets.

text: To implement the EISAS Basic Toolset productively on a national and EU level according to the toolset blueprint in Figure 24, it has to be expanded and tested again.

text: The next steps ideally would comprise the following work packages:

text:  Knowledge base: The knowledge base has to be augmented to a state that qualifies as a homeuser IT security portal. Important topics would be privacy and data protection, social engineering (fraud and phishing) and proper configuration of the various operating systems used on home computers. Also, the ‘how-to’ sections contained in the knowledge base have to be customised to the operating systems used on computers at home. There should be at least informal cooperation with the national CERTs to establish a stream of information, early warnings and alerts to the knowledge base.

text:  User interface and functionality: The user interface of the various components of the Basic Toolset should result in a seamless user experience. Here it is advisable to have a design guide comprising graphic assets and code snippets that can be reused in the various countries and enterprises. The functionality should comprise community-building features such as forums, blogs and similar features. Of course, quality insurance and the security of the Toolbox Platform itself would be an issue. In some cases, it may be a good idea to put the toolbox into the hands of a knowledgeable working group of the participating enterprise and consult on how to realise the EISAS Basic Toolbox in the enterprise without having to resort to networks and platforms outside the boundaries of the enterprise. Alerts and early warnings, though, could still be routed from the CERTs to the desktop of the employee as end-user at home following rules that can be defined between the participating organisation and national CERT.

text:  Participants: In the next iteration participating organisations should be selected according to the industrial sectors. The organisation should be visible and prominent to serve as a lighthouse project for other possible adopters in a particular industrial sector. It is advisable to have the EISAS

text: Basic Toolset working group build the next version of the toolset in tight cooperation with the lighthouse participant.

text: 10 Acronyms

text: CERT Computer Emergency Response Team CII Critical Information Infrastructure CSO Chief Security Officer DDoS Distributed Denial of Service EISAS European Information Sharing and Alert System FISHA Framework for Information Sharing and Alerting IS Information Security NIS Network & information Security SME Small and Medium Enterprise

text: P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu