## 3 Research Methodology
### Self-Diagnosis Application  
Regarding the self-diagnosis web application development, the following presumptions were initially defined:  
\begin{table}
\begin{tabular}{l l} \hline \hline
**ID** & **Question** \\ \hline B1 & Sharing passwords with friends and colleagues. \\ \hline B2 & Using or creating passwords that are not very complicated (e.g., family name and date of birth, letter strings). \\ \hline B3 & Using the same password for multiple websites. \\ \hline B4 & Using online storage systems to exchange and keep personal or sensitive information. \\ \hline B5 & Entering payment information on websites that have no clear security information/certification. \\ \hline B6 & Using free-to-access public Wi-Fi. \\ \hline B7 & Relying on a trusted friend or colleague to advise you on aspects regarding online security. \\ \hline B8 & Downloading free anti-virus software/apps from an unknown source. \\ \hline B9 & Disabling the anti-virus on my computer so that I can download information from websites. \\ \hline B10 & Bringing in my own USB to school in order to transfer data onto it. \\ \hline B11 \({}^{*}\) & Checking that software in your smartphone/tablelet/laptop/PC is up to date. \\ \hline B12 & Downloading digital media (music, films, games) from unlicensed sources. \\ \hline B13 & Sharing my current location on social media. \\ \hline B14 & Accepting friend requests on social media because you recognize the photo. \\ \hline B15 & Clicking on links contained in unsolicited emails from an unknown source. \\ \hline B16 & Sending personal information to unknown people over the Internet. \\ \hline B17 & Clicking on links in an e-mail message that come from a trusted friend or colleague. \\ \hline B18 \({}^{*}\) & Checking for updates for any anti-virus software you have installed. \\ \hline B19 & Downloading data and material from websites on your computer without checking its authenticity. \\ \hline B20 & Storing personal, family and friend’s information on your personal electronic device (e.g., smartphone/tablelet/laptop). \\ \hline \hline \end{tabular} \({}^{*}\)Items negatively worded were reverse-scored for further analysis.  
\end{table}
Table 2: Cybersecurity Behaviors in Schools (CsB-S).  
The web application should be user-friendly and easy to use.
* The database of questions should include a vast number of items, and on each interaction, a new randomly generated set of questions should be used.
* The text of each question and its possible answer options should use an understanding, unambiguous, and easy-to-read language.
* The database of questions should follow a predefined layout that meets the published cybersecurity and information security taxonomies and standards.
* There should be provided feedback to the user, according to the answer given for each question. The feedback should include a score, a list of further readings, and a set of tips and hints that should be followed to mitigate some kind of bad behavior that has been observed in the answers.  
Figure 3 depicts the overall methodology adopted to build the self-diagnosis web application. the areas identified in the first step meet the CSIRT taxonomy [26]. For each of the ten areas that were identified, a list of ten multiple-choice questions was then set up. For each option chosen in the answer, a score was defined regarding its level of assertiveness. For each less appropriate or even wrong answer, a feedback report was prepared, giving indications about mitigation practices that should be adopted. Finally, before designing and releasing the auto-diagnosis questionnaire to the students, the number of questions to include and the layout were defined.  
An example of a question and its layout is depicted in Figure 4. For each question, a list of four options for answers is presented to the user, one being correct and the remaining ones incorrect. A feedback text is presented when the wrong answer is selected.