Abstract:Security Awareness and Training (SAT) programs are commonly put in place to reduce risk related to insecure behaviour among employees. There are however studies questioning how effective SAT programs are in terms of improving end-user behaviours. In this context, we have explored the potential of applying the concept of gamification -i.e. using game mechanics -to increase motivation and learning outcomes. An interactive SAT prototype application was developed, based on interviews with security experts and a workshop with regular employees at two companies. The prototype was tested by employees in a second workshop. Our results indicate that gamification has potential for use in SAT programs, in terms of potential strengths in areas where current SAT efforts are believed to fail. There are however significant pitfalls one must avoid when designing such applications, and more research is needed on long-term effects of a gamified SAT application.

Part 1: The International Cross Domain Conference (CD-ARES 2016)International audienceAs a basis for offering policy and setting tariffs, cyber-insurance carriers need to assess the cyber risk of companies. This paper explores the challenges insurance companies face in assessing cyber risk, based on literature and interviews with representatives from insurers. The interview subjects represent insurance companies offering cyber-insurance in a market where this is a new and unknown product. They have limited historical data, with few examples of incidents leading to payout. This lack of experience and data, together with the need for an efficient sales process, highly impacts their approach to risk assessment. Two options for improving the ability to perform thorough yet efficient assessments of cyber risk are explored in this paper: basing analysis on reusable sector-specific risk models, and including managed security service providers (MSSPs) in the value chain

No abstract

No abstract

BackgroundIn hospitals, digital versions of dry-erase whiteboards are increasingly becoming more common. One of the purposes with such whiteboards is to support coordination of care by augmenting visibility and availability of clinical information. However, clinical information usually concerns patients and is regarded as sensitive personal health information, meaning that it should be access controlled. The purpose of this study is to explore how digital whiteboards can be designed for supporting coordination of care, by providing clinicians with useful information in a usable way, and at the same time protect patient privacy.MethodsA demo application was designed, demonstrated and evaluated iteratively. In total, 15 professional ward nurses role-played a scenario in which the application played a central part. Afterwards, the participants were interviewed. All interviews were recorded, transcribed verbatim, and analysed qualitatively.ResultsThe participants valued having updated clinical information presented on a digital whiteboard, even if the information was de-identified and abstracted. According to the participants, such information could possibly improve inter-departmental communication, reduce the number of electronic health record-logins, and make nurses more rapidly aware of new information. The participants expected that they would be able to re-identify much of the de-identified information in real situations based on their insight into their patients’ recent and expected care activities. Moreover, they also valued being able to easily access more detailed information and verify patient identities. While abstraction and de-identification was regarded to sufficiently protect the patients’ privacy, the nurses also pointed out the importance of having control over what can be seen by other patients and passers-by if detailed medical information was accessed on a digital whiteboard.ConclusionsPresenting updated information from patient care activities on a digital whiteboard in a de-identified and abstracted format may support coordination of care at a hospital ward without compromising patient privacy.