## 5 Data Analysis and Results  
### CAIN Scores  
Overall, participants correctly responded to most of the items (Table 1). A few items had a low proportion of correct responses. For example, item #33 \"_Cookies are a mechanism to _steal sensitive information_\" received a correct response, FALSE, only in half of the cases. That item may be somewhat ambiguous, as cookies may be used to steal sensitive information but are not by themselves a malicious piece of code. Item #40 _\"Firewalls slow down the performance of devices_\" also showed correct responses in half of the cases. However, this is more likely a knowledge gap rather than an item-related issue. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Item** & **Correct Response** & **Correct Responses** \\ \hline
1. Some programs can send a large number of emails automatically. & TRUE & 98\% \\ \hline
2. Computers can be controlled remotely. & TRUE & 99\% \\ \hline
3. It is not possible to secretly install software on a computer. & FALSE & 87\% \\ \hline
4. Personal data shared on the Internet (including social networks) can be & TRUE & 99\% \\ eventually accessed by others even if the user deletes them. & TRUE & 99\% \\ \hline
5. Criminal organizations use spyware to exploit any weakness in cyberspace. & TRUE & 99\% \\ \hline
6. Activities of a single user cannot affect the cybersecurity of an entire system. & FALSE & 82\% \\ \hline
7. Users are responsible for their actions in cyberspace, even when such actions & TRUE & 93\% \\ are unintentional. & TRUE & 73\% \\ \hline
8. Avoiding using real names or pictures keeps a user safe from & TRUE & 91\% \\ possible threats. & FALSE & 91\% \\ \hline
9. Virtual money has no value in the real world. & FALSE & 92\% \\ \hline
10. A hacker stealing a user’s virtual information cannot access the user’s sensitive information. & FALSE & 92\% \\ \hline
11. Banks may accept transactions using virtual currency. & TRUE & 78\% \\ \hline
12. Credit information can be sold on the black market. & TRUE & 98\% \\ \hline
13. Cyber criminals can prevent users from accessing their personal & TRUE & 91\% \\ applications and services. & FALSE & 93\% \\ \hline
14. Cyber criminals are not interested in the personal information recorded in online games. & FALSE & 93\% \\ \hline
15. An organization’s URL is a critical resource. & TRUE & 90\% \\ \hline
16. Phishing emails can be used to steal users’ personal information. & TRUE & 97\% \\ \hline
17. Documents received by email cannot convey viruses. & FALSE & 93\% \\ \hline
18. Cyber-attacks cannot be delivered by legitimate websites. & FALSE & 88\% \\ \hline
19. Individuals may receive cyber-attacks from people they know. & TRUE & 96\% \\ \hline
20. A free Wi-Fi Internet access can be used to steal personal information. & TRUE & 97\% \\ \hline
21. Hackers can remotely capture the keypresses from a computer (e.g., for & TRUE & 93\% \\ stealing passwords). & TRUE & 80\% \\ \hline
22. Intranets (organizations’ private networks) are secure from cyber-attacks. & FALSE & 80\% \\ \hline
23. It is not possible to sneak into another computer just by knowing the IP & FALSE & 78\% \\ (Internet Protocol) address. & TRUE & 94\% \\ \hline
24. A user should report to the appropriate authority if they inadvertently gain & TRUE & 90\% \\ access to a site that requires authorization. & TRUE & 90\% \\ \hline
25. When buying or selling online, one may unintentionally participate in & TRUE & 90\% \\ criminal transactions. & TRUE & 83\% \\ \hline
26. An organization is not responsible for its employees’ security education. & FALSE & 83\% \\ \hline
27. Reading the security policy of a website is useless to prevent cyber-attacks. & FALSE & 82\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Proportion of correct responses for each CAIN item. The average total score was 40.26 (st.dev. = 4.34).