A cyber situational awareness model to predict the implementation of cyber security controls and precautions by SMEs

Abstract

PurposeThere is widespread concern about the fact that small- and medium-sized enterprises (SMEs) seem to be particularly vulnerable to cyberattacks. This is perhaps because smaller businesses lack sufficient situational awareness to make informed decisions in this space, or because they lack the resources to implement security controls and precautions.Design/methodology/approachIn this paper, Endsley’s theory of situation awareness was extended to propose a model of SMEs’ cyber situational awareness, and the extent to which this awareness triggers the implementation of cyber security measures. Empirical data were collected through an online survey of 361 UK-based SMEs; subsequently, the authors used partial least squares modeling to validate the model.FindingsThe results show that heightened situational awareness, as well as resource availability, significantly affects SMEs’ implementation of cyber precautions and controls.Research limitations/implicationsWhile resource limitations are undoubtedly a problem for SMEs, their lack of cyber situational awareness seems to be the area requiring most attention.Practical implicationsThe findings of this study are reported and recommendations were made that can help to improve situational awareness, which will have the effect of encouraging the implementation of cyber security measures.Originality/valueThis is the first study to apply the situational awareness theory to understand why SMEs do not implement cyber security best practice measures.

CyberSecurity Readiness: A Model for SMEs based on the Socio-Technical Perspective

“…Since the first wave of Covid-19, studies highlight that SMEs do not consider themselves favorable targets for cybercrime since they are 'small' [5], [13]. Among the causes of the increased exposure of small businesses are factors ranging from low cybersecurity awareness of personnel, † The Digital Attacks Observatory (OAD) is the only independent online survey in Italy concerned with collecting data regarding digital attacks on IT systems witnessed by companies and public bodies.…”

“…The Allianz Risk Barometer (2022) [4], to which 2,650 risk management experts from 89 countries contributed, reflects this development: cyber incidents have replaced 'business and supply chain interruption' as the top risk. Furthermore, numerous previous studies revealed that SME respondents have reported cyberattacks (e.g., [5]). Consequently, businesses risk millions in damages, reputational losses [6], and business interruptions that jeopardize their continuity and sustainability.…”

“…In contrast to large-size organizations, SMEs typically suffer from a lack of knowledge, expertise, and resources [3], [10]. In general, due to their low level of awareness with respect to cyber threat reality, they seldom perform thorough cyber-risk assessments and have been shown to have poor cybersecurity adoption [5].…”

Towards the quantification of cybersecurity footprint for SMBs using the CMMC 2.0

“…Small and Medium Businesses (SMBs) are significant to economic development in most countries, especially within the western world, as they represent the majority of businesses (Renaud & Ophoff, 2021;Ward, 2021). Gafni and Pavel (2019) noted that SMBs, a term usually used in the United States (U.S.), while in Europe it is known as Small and Medium Enterprises (SME), may vary in size between countries.…”

Improving cybersecurity incidents reporting in Nigeria: micro and small enterprises perspectives

“…In order to sustain its growth and contribution to the economic growth value-chain system, it is required that MSEs report any cybersecurity incidents that occur in their business operations to the CSIRT or SOC in their sector. However, many MSEs are seen to have a very weak defence against cyber-attacks and lack the importance of cybersecurity; thus, they do not have good knowledge of the precautions to adopt in the face of cyber incidents [8][9][10][11]. For cybersecurity incidents to be reported, stakeholders of MSEs need to know the medium of reporting, and the organisations they should report attacks to.…”