The good, the bad and the missing: A Narrative review of cyber-security implications for australian small businesses

Tam, Tracy; Rao, Asha; Hall, Joanne L.

doi:10.1016/j.cose.2021.102385

Cited by 48 publications

(44 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The literature presented the state of cybersecurity, common cyber threats, their impact on businesses, and technology-related issues (Akhtar, Sheorey & Bhattacharya, 2021). Studies expose increased cybercrimes that affect information security, economic and business growth (Tam, Rao & Hall, 2021). For example, during the IMB security week in 2020, Sizwe Dlamini stressed the financial impact caused by cyber incidents, estimated to be R40.2 million per breach.…”

Section: Background Of the Studymentioning

confidence: 99%

Human Errors: A Cybersecurity Concern and the Weakest Link to Small Businesses

Ncubukezit¹

2022

iccws

View full text Add to dashboard Cite

Cybersecurity is essential for all organizations, especially during this menacing Covid-19 global pandemic. The sudden transition of leaving the offices to work from home – the 'new normal' – has introduced information security-related risks associated with human factors. For example, both criminals and employees use the same platform for information exchange but with starkly different intentions. But both their actions compromise information and computer security. Criminals intentionally exploit systems to gain unauthorized access for their benefit, while employees make careless mistakes, leaving systems exposed and vulnerable. The present study examines human errors influenced by actions, attitudes, and behaviors that affect overall information security. Purposive sampling within the qualitative approach was used to select thirty (30) small business managers. Data was collected using a qualitative online survey as a Google Form. The study used thematic analysis. The results revealed that repeated human mistakes compromise information security principles and render employees the weakest link. The study explained the risks caused by employees due to ignorance or poor decision making, technical-related errors, and skills- and policy-based errors. Even though small businesses do not require a 'one-size-fits-all' security approach, recommendations to reduce human mistakes were made.

show abstract

Section: Background Of the Studymentioning

confidence: 99%

Human Errors: A Cybersecurity Concern and the Weakest Link to Small Businesses

Ncubukezit¹

2022

iccws

View full text Add to dashboard Cite

show abstract

“…In another article by Tam, T. et al (2021) [44], another developed country is examined through the lens of Australia. Lessons are shared of how developed nations such as Australia deal with their SMEs and how they are faced with cyber security challenges.…”

Section: Sme's Cybersecurity Barriers and Challengesmentioning

confidence: 99%

Machine Learning Cybersecurity Adoption in Small and Medium Enterprises in Developed Countries

2021

View full text Add to dashboard Cite

In many developed countries, the usage of artificial intelligence (AI) and machine learning (ML) has become important in paving the future path in how data is managed and secured in the small and medium enterprises (SMEs) sector. SMEs in these developed countries have created their own cyber regimes around AI and ML. This knowledge is tested daily in how these countries’ SMEs run their businesses and identify threats and attacks, based on the support structure of the individual country. Based on recent changes to the UK General Data Protection Regulation (GDPR), Brexit, and ISO standards requirements, machine learning cybersecurity (MLCS) adoption in the UK SME market has become prevalent and a good example to lean on, amongst other developed nations. Whilst MLCS has been successfully applied in many applications, including network intrusion detection systems (NIDs) worldwide, there is still a gap in the rate of adoption of MLCS techniques for UK SMEs. Other developed countries such as Spain and Australia also fall into this category, and similarities and differences to MLCS adoptions are discussed. Applications of how MLCS is applied within these SME industries are also explored. The paper investigates, using quantitative and qualitative methods, the challenges to adopting MLCS in the SME ecosystem, and how operations are managed to promote business growth. Much like security guards and policing in the real world, the virtual world is now calling on MLCS techniques to be embedded like secret service covert operations to protect data being distributed by the millions into cyberspace. This paper will use existing global research from multiple disciplines to identify gaps and opportunities for UK SME small business cyber security. This paper will also highlight barriers and reasons for low adoption rates of MLCS in SMEs and compare success stories of larger companies implementing MLCS. The methodology uses structured quantitative and qualitative survey questionnaires, distributed across an extensive participation pool directed to the SMEs’ management and technical and non-technical professionals using stratify methods. Based on the analysis and findings, this study reveals that from the primary data obtained, SMEs have the appropriate cybersecurity packages in place but are not fully aware of their potential. Secondary data collection was run in parallel to better understand how these barriers and challenges emerged, and why the rate of adoption of MLCS was very low. The paper draws the conclusion that help through government policies and processes coupled together with collaboration could minimize cyber threats in combatting hackers and malicious actors in trying to stay ahead of the game. These aspirations can be reached by ensuring that those involved have been well trained and understand the importance of communication when applying appropriate safety processes and procedures. This paper also highlights important funding gaps that could help raise cyber security awareness in the form of grants, subsidies, and financial assistance through various public sector policies and training. Lastly, SMEs’ lack of understanding of risks and impacts of cybercrime could lead to conflicting messages between cross-company IT and cybersecurity rules. Trying to find the right balance between this risk and impact, versus productivity impact and costs, could lead to UK SMES getting over these hurdles in this cyberspace in the quest for promoting the usage of MLCS. UK and Wales governments can use the research conducted in this paper to inform and adapt their policies to help UK SMEs become more secure from cyber-attacks and compare them to other developed countries also on the same future path.

show abstract

“…Cyber security research is a growing field with numerous topics which authors such as Suryotrisongko and Musashi have tried to develop taxonomies for [14]. Our study was necessitated by the realisation that there was very limited literature available regarding the cyber security of SMBsboth in Australia and globally [15]. To the best of our knowledge, only two surveys of a similar nature have been done [15,16] which we discuss in more detail in Section IV.…”

Section: Introductionmentioning

confidence: 99%

“…Our study was necessitated by the realisation that there was very limited literature available regarding the cyber security of SMBsboth in Australia and globally [15]. To the best of our knowledge, only two surveys of a similar nature have been done [15,16] which we discuss in more detail in Section IV. None of the existing surveys aligned their surveyed research to a well-known security framework or analysed the geographic spread of the surveyed research.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Survey on the Cyber Security of Small-to-Medium Businesses: Challenges, Research Focus and Recommendations

2022

View full text Add to dashboard Cite

Small-to-medium sized businesses (SMBs) constitute a large fraction of many countries' economies but according to the literature SMBs are not adequately implementing cyber security which leaves them susceptible to cyber-attacks. Furthermore, research in cyber security is rarely focused on SMBs, despite them representing a large proportion of businesses. In this paper we review recent research on the cyber security of SMBs, with a focus on the alignment of this research to the popular NIST Cyber Security Framework (CSF). From the literature we also summarise the key challenges SMBs face in implementing good cyber security and conclude with key recommendations on how to implement good cyber security. We find that research in SMB cyber security is mainly qualitative analysis and narrowly focused on the Identify and Protect functions of the NIST CSF with very little work on the other existing functions. SMBs should have the ability to detect, respond and recover from cyberattacks, and if research lacks in those areas, then SMBs may have little guidance on how to act. Future research in SMB cyber security should be more balanced and researchers should adopt well-established powerful quantitative research approaches to refine and test research whilst governments and academia are urged to invest in incentivising researchers to expand their research focus.INDEX TERMS Cyber security, small-to-medium business, security posture, cyber security threats, cyber security frameworks, security and privacy.

show abstract

The good, the bad and the missing: A Narrative review of cyber-security implications for australian small businesses

Cited by 48 publications

References 41 publications

Human Errors: A Cybersecurity Concern and the Weakest Link to Small Businesses

Human Errors: A Cybersecurity Concern and the Weakest Link to Small Businesses

Machine Learning Cybersecurity Adoption in Small and Medium Enterprises in Developed Countries

A Survey on the Cyber Security of Small-to-Medium Businesses: Challenges, Research Focus and Recommendations

Contact Info

Product

Resources

About