Cybersecurity and the Unbearability of Uncertainty

Flowerday

Warkentin

et al. 2018

Computers & Security

Self Cite

Cyber criminals appear to be plying their trade without much hindrance. Home computer users are particularly vulnerable to attack by an increasingly sophisticated and globally-dispersed hacker group. The smartphone era has exacerbated the situation, offering hackers even more attack surfaces to exploit. It might not be entirely coincidental that cyber crime has mushroomed in parallel with governments pursuing a neoliberalist agenda. This agenda has a strong drive towards individualizing risk i.e. advising citizens how to take care of themselves, and then leaving them to face the consequences if they choose not to follow the advice. In effect, citizens are "responsibilized." Whereas responsibilization is effective for some risks, the responsibilization of cyber security is, we believe, contributing to the global success of cyber attacks. There is, consequently, a case to be made for governments taking a more active role than the mere provision of advice, which is they case for many countries. We conclude with a concrete proposal for a risk regulation regime that would more effectively mitigate and ameliorate cyber risk.

Section: Cyber Crime Riskmentioning

confidence: 99%

Is the responsibilization of the cyber security risk reasonable and judicious?

Flowerday

Warkentin

et al. 2018

Computers & Security

Self Cite

“…SMEs might lack financial resources (Heidt et al, 2019) or experience difficulties prioritizing advice (Redmiles et al, 2020). They might also suffer from information overload (Cenfetelli and Schwarz, 2011;Renaud and Weir, 2016;Gafni and Pavel, 2019) because they do not know which advice to follow.…”

Section: (2b) Awareness Of Cyber Security Precautions and Controlsmentioning

confidence: 99%

“…Research also shows that SMEs remain vulnerable because they often do not take action to protect their devices and information (Shred-it, 2011;Bell, 2017;Reuter, 2015;Berry and Berry, 2018;Ncubukezi et al, 2020;Renaud and Weir, 2016). SMEs run the risk of falling victim to an attack if they neglect cyber security (Muncaster, 2020;SMESEC, 2021).…”

Section: Introductionmentioning

confidence: 99%

A cyber situational awareness model to predict the implementation of cyber security controls and precautions by SMEs

Ophoff

2021

OCJ

Self Cite

PurposeThere is widespread concern about the fact that small- and medium-sized enterprises (SMEs) seem to be particularly vulnerable to cyberattacks. This is perhaps because smaller businesses lack sufficient situational awareness to make informed decisions in this space, or because they lack the resources to implement security controls and precautions.Design/methodology/approachIn this paper, Endsley’s theory of situation awareness was extended to propose a model of SMEs’ cyber situational awareness, and the extent to which this awareness triggers the implementation of cyber security measures. Empirical data were collected through an online survey of 361 UK-based SMEs; subsequently, the authors used partial least squares modeling to validate the model.FindingsThe results show that heightened situational awareness, as well as resource availability, significantly affects SMEs’ implementation of cyber precautions and controls.Research limitations/implicationsWhile resource limitations are undoubtedly a problem for SMEs, their lack of cyber situational awareness seems to be the area requiring most attention.Practical implicationsThe findings of this study are reported and recommendations were made that can help to improve situational awareness, which will have the effect of encouraging the implementation of cyber security measures.Originality/valueThis is the first study to apply the situational awareness theory to understand why SMEs do not implement cyber security best practice measures.

“…Assumption 1 : The problem with cyber advice is that there is no obvious route by which such advice can be delivered, reliably, to every citizen (Okuku, Renaud, and Valeriano 2015). Certainly, some people may seek advice, but many turn to Google (Renaud and Weir 2016) or rely on a family friend (Poole et al 2009). As a consequence, they may not receive accurate advice or be so bewildered by the sheer amount of advice that they give up altogether (Bawden and Robinson 2009).…”

Section: Question 3: What Assumptions Have Been Made?mentioning

confidence: 99%

Cyber Security Responsibilization: An Evaluation of the Intervention Approaches Adopted by the Five Eyes Countries and China

Public Administration Review

Orgeron²,

Warkentin

et al. 2020

Self Cite

Governments can intervene to a greater or lesser extent in managing the risks that citizens face. They can adopt a maximal intervention approach (e.g., COVID‐19) or a hands‐off approach (e.g., unemployment), effectively “responsibilizing” their citizens. To manage the cyber risk, governments publish cyber‐related policies. This article examines the intervention stances the governments adopt in supporting individual citizens managing their personal cyber risk. The authors pinpoint the cyber‐related responsibilities that several governments espouse, applying a “responsibilization” analysis. Those applying to citizens are identified, thereby revealing the governments' cyber‐related intervention stances. The analysis reveals that most governments adopt a minimal cyber‐related intervention stance in supporting their citizens. Given the increasing number of successful cyber attacks on individuals, it seems time for the consequences of this stance to be acknowledged and reconsidered. The authors argue that governments should support individual citizens more effectively in dealing with cyber threats.