# An Adaptive Cybersecurity Training Framework for the Education of Social Media Users at Work
## 3 Methods  
The ACSTF-SMR follows the methodology proposed by [PERSON] et al. (2018), which defines the three fundamental steps for cybersecurity training. The first step consists of analyzing the target group to identify their roles and responsibilities. The second step involves risk assessment, and the third step identifies gaps and vulnerabilities. The development of the training material and the evaluation of the training program are additional steps that complete the entire process. Taking [PERSON] et al. (2018) as our starting point, we propose a training framework consisting of four steps, as shown in Figure 1. Our first step identifies the target audience--employees' backgrounds are determined here, including their job roles, age, education, work experience, and patterns of social media usage. We will consider the employees' preferred training methods to ensure our training is adaptable ([PERSON] et al., 2018). The communication with the employees, the quizzes, and the training were all carried out in the English language. Due to the nature of our investigation and given that we were required to store and analyze details about the employees' work and their demographics, we had to undertake the ethical review process stipulated by the University of Plymouth (Plymouth, UK), which is where we were based while conducting our research. The ethical review was recorded through the Plymouth Ethics Online System (PEOS) (Plymouth, UK) (Plymouth, UK) (Plymouth, UK) (Plymouth, UK) and the approval was granted on 5 September 2020. Abiding by the University of Plymouth's ethical approval policy, the survey to gather information about the participants was conducted in anonymity. The thirteen training approaches that we offered to the employees are listed in Table 4. We provided a wide range of options to cater for as many preferences as possible. \begin{table}
\begin{tabular}{c c} \hline \hline
**Training Option** & **Description** \\ \hline Awareness Raising Events & \begin{tabular}{c} Occasional events at which employees are invited to \\ increase their awareness and knowledge of \\ cybersecurity risks on social media. \\ \end{tabular} \\ \hline Email & \begin{tabular}{c} Messages sent from management or training \\ coordinators to the employees to deliver \\ cybersecurity information, warnings about new or \\ specific threats, etc. \\ \end{tabular} \\ \hline Games & \begin{tabular}{c} Software or classroom games that facilitate \\ engagement and participation. \\ \end{tabular} \\ \hline Incentives & \
\begin{tabular}{c} Concessions or benefits offered to promote “good” \\ behavior and discourage “bad” behavior. \\ \end{tabular} \\ \hline Mock Attacks &
\begin{tabular}{c} Training which imitates various forms of \\ cyberattacks as a way of preparation. Cyberattacks \\ may include phishing tests, sharing virus-infected \\ devices, etc. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Training options. Figure 1: The Adaptive Cybersecurity Training Framework for Social Media Risks (ACSTF-SMR). Our second step evaluates the risk levels of each individual employee following the recommendations of the National Cyber Security Centre (NCSC) [51] and its best practices for social media [52]. To do so, employees take a quiz to assess their knowledge and skills, and we collect the data that we use to determine what sort of training is needed and how it will be delivered. Using a risk assessment tool is a cornerstone of our framework. Our risk assessment tool is based on two main factors, the _target group_ (TG) and _awareness_ (A). To explore the awareness factors, the questions in our quiz assess the employees' level of knowledge regarding best practices for social media. The quiz is designed to estimate the three security risk awareness levels: _high_, _moderate_, and _low_[20]. The parameters used to develop the quiz are listed below:  
* Hacking challenges;
* Privacy and security;
* Password protection;
* Identification of phishing;
* Incident report;
* Two-factor authentication.