Improving Cybersecurity Awareness Among SMEs in the Manufacturing Industry

Abstract

Small and medium-sized (SME) manufacturing enterprises have been described as a sector that traditionally has not been data-intensive, with low spending on IT and cybersecurity and employees with low cybersecurity awareness. SMEs have also been described as agile and under pressure to adopt new technology and embrace digitalization to gain a competitive advantage. Entering this data-intensive world also comes with new risks, making them extra vulnerable. Not much attention has been directed at how SMEs in the manufacturing sector are working with improving employees’ cybersecurity awareness. Especially not where cybersecurity training programs are in focus. To investigate these aspects, we opted for a set of five SMEs in the manufacturing industry where it was possible to perform in-depth semi-structured interviews with chief information security officers’ (CISO) and employees. The results show several interesting results, for example, regarding the view on contextualization of training material and the relevance of microlearning. The study also presents several practical implications, including recommendations for improving cybersecurity training measures for SMEs in the manufacturing sector.

German SMEs and “Home Office”: Narrative-Driven Game-Based Awareness Raising with Long-Term Efficacy

“…Presentations should be limited in duration to around 15 to 20 minutes to help learners focus on the topic. Employees had a positive perception of workshops, and various types of interactive meetings in which discussions could take place and knowledge exchange was encouraged, with the element of interactivity cited as the main reason for the positive attitude [20]. We can confirm these results.…”

“…An analog and a digital serious game for ISA/CSA should be completed in 15 minutes, thus corresponding to the study results of [20]. The length of such a microlearning module should be very short, lasting only a few minutes: "What you can do quickly during a break" [20]. Quizzes that followed a module were also valued because they forced people to focus on content [20].…”

“…The length of such a microlearning module should be very short, lasting only a few minutes: "What you can do quickly during a break" [20]. Quizzes that followed a module were also valued because they forced people to focus on content [20]. Adapting the (external) training material to the local context and language was seen as crucial by staff; however, they also acknowledged that this could be a challenge for the CISO [20].…”

“…Quizzes that followed a module were also valued because they forced people to focus on content [20]. Adapting the (external) training material to the local context and language was seen as crucial by staff; however, they also acknowledged that this could be a challenge for the CISO [20]. Presentations should be limited in duration to around 15 to 20 minutes to help learners focus on the topic.…”

“…Measures that have been tried and tested in practice must be taken into account. For example, the finding from the study by Johansson et al: Chief Information Security Officers (CISOs) recognized increased awareness among employees when microlearning with shorter topic modules was used [20].…”