  There is a conflict between the need for security compliance by users and the
fact that commonly they cannot afford to dedicate much of their time and energy
to that security. A balanced level of user engagement in security is difficult
to achieve due to difference of priorities between the business perspective and
the security perspective. We sought to find a way to engage users minimally,
yet efficiently, so that they would both improve their security awareness and
provide necessary feedback for improvement purposes to security designers. We
have developed a persuasive software toolkit to engage users in structured
discussions about security vulnerabilities in their company and potential
interventions addressing these. In the toolkit we have adapted and integrated
an established framework from conventional crime prevention. In the research
reported here we examine how non-professionals perceived security problems
through a short-term use of the toolkit. We present perceptions from a pilot
lab study in which randomly recruited participants had to analyze a crafted
insider threat problem using the toolkit. Results demonstrate that study
participants were able to successfully identify causes, propose interventions
and engage in providing feedback on proposed interventions. Subsequent
interviews show that participants have developed greater awareness of
information security issues and the framework to address these, which in a real
setting would lead ultimately to significant benefits for the organization.
These results indicate that when well-structured such short-term engagement is
sufficient for users to meaningfully take part in complex security discussions
and develop in-depth understanding of theoretical principles of security.
