Systematic Approach to Cyber Resilience Operationalization in SMEs

Abstract

The constantly evolving cyber threat landscape is a latent problem for today's companies. This is especially true for the Small and Medium-sized Enterprises (SMEs) because they have limited resources to face the threats but, as a group, represent an extensive payload for cybercriminals to exploit. Moreover, the traditional cybersecurity approach of protecting against known threats cannot withstand the rapidly evolving technologies and threats used by cybercriminals. This study claims that cyber resilience, a more holistic approach to cybersecurity, could help SMEs anticipate, detect, withstand, recover from and evolve after cyber incidents. However, to operationalize cyber resilience is not an easy task, and thus, the study presents a framework with a corresponding implementation order for SMEs that could help them implement cyber resilience practices. The framework is the result of using a variation of Design Science Research in which Grounded Theory was used to induce the most important actions required to implement cyber resilience and an iterative evaluation from experts to validate the actions and put them in a logical order. Therefore, this study proposes that the framework could benefit SME managers to understand cyber resilience, as well as help them start implementing it with concrete actions and an order dictated by the experience of experts. This could potentially ease cyber resilience implementation for SMEs by making them aware of what cyber resilience implies, which dimensions it includes and what actions can be implemented to increase their cyber resilience.

Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal

“…Information security management is a crucial challenge for the companies, as they aim to prevent the exposure to security and privacy threats to information systems and networking infrastructure. Although many of SMEs may have a minimal IT infrastructure to fight cyberattacks [13,14], they can act on a preliminary phase in order to gradually improve their security level. Therefore, organisations must ensure that their businesses processes, policies, and workforce behaviour allow them to minimize and mitigate some of the risks that are involved in their information systems and IT infrastructures [15,16].…”

Cyber Resilience Self-Assessment Tool (CR-SAT) for SMEs

“…For instance, there are several frameworks that often include domains and policies to guide companies on what is needed in order to operationalize cyber resilience [8], [12]- [15]. Although these frameworks are sometimes comparable, they are often not completely equivalent to each other and offer nuances that can be important for certain companies, but might be too advanced for others, such as SMEs [7]. Similarly, standards can help companies in their cyber resilience operationalization.…”

“…To compare these documents and their ability to aid SMEs in the cyber resilience operationalization, they needed to be compared on their ability to help companies determine their current cyber resilience state, define improvement actions and prioritize them. These documents were all selected based on the criterion of defining a set of policies to operationalize cyber resilience [7], and therefore they all are able to aid companies in the definition of improvement actions. Thus, the comparison in this article focused on these tools' abilities to aid companies in the assessment of their current state and on the prioritization of the improvement actions they defined.…”

“…These simple representations of the progression or scaling of cyber resilience policies could help SMEs easily identify with one of the maturity states and easily be able to define improvement actions based on their current state. • Finally, the tool should have a way to prioritize these actions so that the company is able to effectively operationalize cyber resilience [7], [21]. As shown in the table, there are no tools or documents specifically targeted for SMEs.…”

“…However, the apparently slight change of perspective from cybersecurity to cyber resilience brings several consequences for companies trying to operationalize it. Recent research has defined the dimensions (or domains) and actions (or policies) that need to be understood and implemented for an SME to be cyber resilient [7]. These dimensions and policies include technical solutions, but also governance, risk management, personnel training and awareness, etc.…”