Developing cybersecurity education and awareness programmes for small- and medium-sized enterprises (SMEs)

Abstract

Purpose -An essential component of an organisation's cybersecurity strategy is building awareness and education of online threats, and how to protect corporate data and services. This research article focuses on this topic and proposes a high-level programme for cybersecurity education and awareness to be used when targeting Small-to-Medium-sized Enterprises/Businesses (SMEs/SMBs) at a city-level. We ground this programme in existing research as well as unique insight into an ongoing city-based project with similar aims. Design/methodology/approach -To structure our work, we begin by conducting a scoping review of the literature in cybersecurity education and awareness, particularly for SMEs/SMBs. This theoretical analysis is then complemented by using a case study and reflecting on an ongoing, innovative programme that seeks to work with these businesses to significantly enhance their security posture. From these analyses, we extract best practice and important lessons/recommendations to produce a high-level programme for cybersecurity education and awareness. Findings -We find that whilst literature can be informative at guiding education and awareness programmes, it may not always reach real-world programmes. On the other hand, existing programmes, such as the one we explored, have great potential but there can also be room for improvement. Knowledge from each of these areas can, and should, be combined to the benefit of the academic and practitioner communities. Originality/value -The study contributes to current research through the outline of a high-level programme for cybersecurity education and awareness targeting SMEs/SMBs. Through this research, we engage in a reflection of literature in this space, and present insights into the advances and challenges faced by an on-going programme. These analyses allow us to craft a proposal for a core programme that can assist in improving the security education, awareness and training that targets SMEs/SMBs.

Re-territorialising the policing of cybercrime in the post-COVID-19 era: towards a new vision of local democratic cyber policing

“…Other forces have taken a different approach to engage with the SME community. In partnership with the London Digital Security Centre (LDSC), uniformed police officers visit these businesses to build up a relationship, promoting who can be contacted in the event of cyber security issues (Bada and Nurse, 2019). Hampshire Constabulary worked in association with the University of Portsmouth to explore how to increase cyber resilience and cyber-awareness within the wider community (Karagiannopoulos et al, 2019).…”

Reasons Behind Poor Cybersecurity Readiness of Singapore’s Small Organizations: Reveal by Case Studies

“…The threats of cybersecurity, which include disruptions to businesses, negative publicity, litigation, and long-lasting reputational damages (Lanz, 2014), can be costly for small organizations as they have little resources at their disposal (Al-Moshaigeh, 2019). It is a vicious cycle that due to the limited resources to strengthen their cybersecurity, small organizations are increasingly being targeted (Bada and Nurse, 2019).…”

“…There is indication of the poor cybersecurity readiness in the small organization can be attributable to the poor awareness because they are too immersed in their day-to-day operations and did not spend enough time to proactively study emerging risks (Bada and Nurse, 2019). The lack of awareness then leads to delay the investment in security and give priority to other urgent tasks (Lanz, 2014).…”

Untitled

“…UMKM seharusnya menyadari bahwa melalui kejahatan dunia maya dapat berdampak pada informasi yang seharusnya hanya diketahui oleh UMKM yang bersangkutan. Keamanan dunia maya, pengalaman, persepsi, sikap, dan kepercayaan adalah faktor utama yang dapat mempengaruhi perilaku para pemilik UMKM (Bada & Nurse, 2019). Dengan demikian diperlukan cara supaya mereka memiliki perilaku mengenai kesadaran kejahatan dunia maya untuk mencegah pergerakan kriminal dunia maya yang menargetkan pengguna.…”