PaperlayerView exact revision on arXiv

Source-linked AI summary

Developing cybersecurity education and awareness programmes for Small and medium-sized enterprises (SMEs)

Maria Bada, Jason R. C. Nurse

arXiv:1906.09594v1cs.CRcs.CYcs.HC

TL;DR

SMEs face cybersecurity threats while often lacking awareness, expertise, and resources, and existing proposals have not eliminated the challenge. The paper combines a literature review with a case study of a city-based support programme to propose a high-level education and awareness programme. Its analysis brings research guidance and practitioner experience together, while the proposal is currently scoped to developed economies.

  • Problem

    SMEs face cybercrime and may lack the awareness, expertise, and resources to address cybersecurity, while existing support proposals have not resolved the problem.

    Source: §1 · p. 2, §3 · p. 8

  • Method

    The paper combines a scoping review of cybersecurity guidance with a case study of the London Digital Security Centre and uses both to develop a programme proposal.

    Source: §1 · p. 2, Method of analysis · p. 10, §6 · p. 17

  • Results

    The review and LDSC case study inform a proposed programme combining research-based best practice and practitioner insight; the case findings suggest offering varied support methods may be better than relying on only a few.

    Source: Views from SMEs engaged by the Centre · p. 12, §6 · p. 17

  • Takeaways & Limitations

    The proposed programme offers a high-level framework for organisations seeking to support SMEs with cybersecurity education and awareness.

    Source: §6 · p. 17

    The proposal is currently scoped to developed economies because of resource requirements and limited access to comparable organisations and SMEs in developing countries.

    Source: §2 · p. 4

Abstract

from arXiv · show

Purpose: An essential component of an organisation's cybersecurity strategy is building awareness and education of online threats, and how to protect corporate data and services. This research article focuses on this topic and proposes a high-level programme for cybersecurity education and awareness to be used when targeting Small-to-Medium-sized Enterprises/Businesses (SMEs/SMBs) at a city-level. We ground this programme in existing research as well as unique insight into an ongoing city-based project with similar aims. Findings: We find that whilst literature can be informative at guiding education and awareness programmes, it may not always reach real-world programmes. On the other hand, existing programmes, such as the one we explored, have great potential but there can also be room for improvement. Knowledge from each of these areas can, and should, be combined to the benefit of the academic and practitioner communities. Originality/value: The study contributes to current research through the outline of a high-level programme for cybersecurity education and awareness targeting SMEs/SMBs. Through this research, we engage in a reflection of literature in this space, and present insights into the advances and challenges faced by an on-going programme. These analyses allow us to craft a proposal for a core programme that can assist in improving the security education, awareness and training that targets SMEs/SMBs.

1 Introduction

SMEs face cybersecurity challenges amid limited awareness, expertise, and resources, while existing support proposals have not resolved persistent cybercrime. The article proposes a city-level education and awareness programme by combining research with insight from London’s ongoing practitioner programme.

1 Introduction

  • SMEs are increasingly targeted and often lack the awareness, expertise, and resources to address cybersecurity challenges.The article also notes that implementing security can be difficult for SMEs even in the face of regulations such as the EU General Data Protection Regulation.Source: §1 · p. 2
  • Proposals from academic, industry, government, and cross-sector sources seek to support SMEs, but cybercrime against them persists.The article outlines the scoping review, LDSC case study, and subsequent proposal as the sequence of its analysis.Source: §1 · pp. 2–3
  • The article proposes a high-level city-level cybersecurity education and awareness programme for organisations supporting SMEs, grounded in literature and an LDSC case study.The article states that, to the authors’ knowledge, prior research had not addressed programmes for support organisations, only programmes intended for SMEs.Source: §1 · p. 2
  • While the article was in press, the LDSC became part of the UK Police Digital Security Centre, extending its remit beyond London.The updated remit built on the LDSC’s initial London focus.Source: §1 · p. 2

2 Research approach

The study combines a scoping review, a case study of the London Digital Security Centre (LDSC), and synthesis of research and practice to propose a programme for organisations supporting SMEs. The proposal is scoped to developed economies at this stage.

2 Research approach

  • The first phase uses a scoping review to identify cybersecurity awareness, education, and training initiatives and extract best practices.The review is intended to identify gaps using preset inclusion and exclusion criteria and includes general internet-based reports as well as academic literature.Source: §2 · p. 3
  • The review searches literature and reports published from 2000 to 2019, using academic databases and broader web searches conducted in 2018 and 2019.The searches took place from May to July 2018 and again from January to February 2019.Source: §2 · p. 3
  • The review prioritises SME-focused work offering new or fundamental cybersecurity best practices, with particular interest in research grounded in industry.It excludes non-English sources and uses searches combining cybersecurity, education or awareness, programmes, and SMEs/SMBs.Source: §2 · p. 3
  • The second phase studies the LDSC, a London partnership offering SMEs hands-on, free cybersecurity education and guidance.The Centre was established and funded by the London Mayor’s Office for Policing and Crime, in partnership with police and industry experts.Source: §2 · pp. 3–4
  • The LDSC case study uses feedback from SMEs signed up for support to examine the programme’s strengths and weaknesses.The Centre was selected for its government-industry partnership, education focus, range of support options, and city-oriented approach.Source: §2 · p. 4
  • The third phase combines research and industry best practice with case-study findings to outline a programme for organisations supporting SMEs.It covers essential activities, partnerships, and overarching recommendations.Source: §2 · p. 4
  • At this stage, the proposed programme is scoped to developed economies because of resource requirements and limited access to comparable organisations and SMEs in developing countries.The authors intend to use experience in developed cities to inform future adaptation to other contexts.Source: §2 · p. 4

3 Cybersecurity for SMEs: A review

The review finds useful SME cybersecurity guidance across research and practice, but much of it depends on SMEs proactively finding and acting on detailed material despite operational pressures. It argues for interactive, city-level support and identifies programme practices spanning culture, relevance, engagement, and practical assistance.

3 Cybersecurity for SMEs: A review

  • The review includes 36 articles and reports selected after searching more than 1,000 initially identified papers.The review summarises academic and industry contributions as best practices for SME programmes.Source: §3 · p. 5
  • Security culture and employee behaviour matter, while effective awareness must address organisational settings, work processes, and human factors.The review notes that how to encourage lasting good security behaviour remains less understood, with changing cybercriminal tactics and security fatigue among the concerns.Source: §3 · p. 5
  • SMEs can be difficult to engage because owners and operators may be occupied with daily operations or may not recognise the importance of cybersecurity.The review notes ongoing discussion about how campaigns can improve communication and engagement with SMEs.Source: §3 · p. 5
  • Government and industry initiatives offer SMEs starting points through schemes, guidance, training, and other forms of assistance.Examples discussed include Cyber Essentials, IASME, vouchers, online learning, free training, and guidance from US and international initiatives.Source: §3 · pp. 5–6
  • Recommended practices include aligning training with an organisation’s mission, culture, users, and resources, and providing practical, relevant advice.The review also highlights identifying key assets and harms, measuring behavioural impact, and providing topic-specific free courses as possible ways to support SMEs.Source: §3 · pp. 6–7
  • Existing guidance often depends on SMEs proactively reading and applying detailed, technical material, although daily operational demands make this unlikely.The review therefore identifies a gap in support beyond one-way dissemination and argues for more interactive programmes delivered by supporting organisations in defined cities.Source: §3 · p. 8
  • The LDSC programme is described as a novel practitioner initiative that may benefit from research lessons and could inform programmes in other cities.The authors present the city-level approach as a practical way to target support while recognising that local governmental and organisational structures differ.Source: §3 · p. 8

4 A case study of a cybersecurity programme targeting SMEs

The London Digital Security Centre (LDSC) combines outreach, assessment, education, follow-up and a vetted marketplace to support London SMEs. Surveyed SMEs valued practical, tailored support and reported some security improvements, while also identifying communication and marketplace-use gaps.

4.1 Overview and context

  • The LDSC’s three activity areas are community engagement, a security education and membership cycle, and a security-solution marketplace.Its membership cycle includes information gathering, in-person consultation, security assessments, workforce education, testing and review, with further support available.Source: §4.1 · pp. 8–10
  • The Centre builds local SME awareness through lectures, industry-body outreach and business visits, sometimes accompanied by uniformed police officers.It also uses fraud reports and other cybercrime data to select business areas to visit.Source: §4.1 · pp. 8–9

4.2 Reflecting on the approach Method of analysis

  • The authors used an exploratory single-case study and a survey of LDSC members to reflect on the programme, receiving 27 responses from 626 SMEs contacted.The 27 responses comprised 20 complete and 7 partial surveys, a 4% response rate; quantitative data were summarised and qualitative responses analysed for themes.Source: Method of analysis · pp. 10–11

Views from SMEs engaged by the Centre

  • Word-of-mouth was the most commonly reported way SMEs first heard of the Centre, while workshops and visits supported engagement; some members reported little follow-up communication.Word-of-mouth accounted for 8 of 21 responses; 5 of 24 respondents mentioned little further communication after joining.Source: Views from SMEs engaged by the Centre · p. 11
  • SMEs valued practical, immediately applicable advice, expert interaction and tailored, largely free assessments with action plans; reported benefits included guidance, security assessments and training access.The reported benefits varied across participating organisations, rather than centring on one common benefit.Source: Views from SMEs engaged by the Centre · pp. 11–12
  • Participants reported enhanced employee security awareness (10/21), and some adopted Cyber Essentials (9/21) or DMARC (6/21), changes the authors describe as possible uptake.The authors note that awareness gains are best assessed over the long term and that the sample was small.Source: Views from SMEs engaged by the Centre · p. 12
  • The marketplace was the programme’s most underused component: 15 of 21 respondents had not used it, often because they did not know it was available or its purpose.Users who selected marketplace offerings chose employee-training support, platform protection and security-posture review products.Source: Views from SMEs engaged by the Centre · pp. 12–13

Key practices

  • The authors identify trust-building, personalised assessment, free support and clear communication as practices for an SME programme, alongside education and a marketplace.They warn that marketplace advice may not deliver its advantages if it is not communicated appropriately.Source: Key practices · p. 13

5 Towards a cybersecurity awareness programme for SMEs/SMBs

The section proposes a flexible, five-area city-level support programme for SMEs/SMBs, building on an ongoing programme and combining practitioner insight with research recommendations.

5 Towards a cybersecurity awareness programme for SMEs/SMBs

  • The proposed five-area programme builds heavily on the LDSC case study, with academic recommendations and additions intended to address its challenges.Figure 1 presents the programme overview; asterisks mark notable changes or additions.Source: §5 · p. 14, Figure 1 · p. 14
  • Engagement combines workplace visits, local events, and industry relationships with improved communication and practical advice suited to each SME.The programme aims to avoid relying solely on incident-related messages.Source: §5 · pp. 14–16
  • The programme pairs security practices and culture-building with assessment-led training tailored to identified cyber-risks and each SME’s organisational context.It also proposes addressing current cybercrimes and risks through education, awareness, and training plans.Source: §5 · p. 15
  • Security awareness metrics should track security posture, service fit, behavioural impact, and compliance, with SANS guidance recommended for measures and scope.The passage also links metrics to tracking possible declines in incidents or violations.Source: §5 · p. 15
  • The programme proposes regularly reviewed, vetted materials and trusted providers, including reduced-cost third-party services for SMEs.Suggested materials include reports, training guides, videos, and poster templates, alongside SME-focused events and workshops.Source: §5 · pp. 15–16
  • Its organisational support structure is intended to ease SMEs’ burden of finding and applying guidance while remaining adaptable to emerging tools and recommendations.The authors suggest it may balance SME needs with the needs of those providing support.Source: §5 · pp. 16–17

6 Conclusion and future work

The authors combine a scoping review with examination of a live city-level programme to propose cybersecurity awareness support for smaller enterprises. They emphasize support beyond one-way dissemination and identify evaluation of the proposal as future work.

6 Conclusion and future work

  • The proposal draws on a scoping review and examination of a live city-level security awareness programme.The authors say they extracted best practice from both areas.Source: §6 · p. 17
  • The authors emphasize awareness efforts beyond one-way dissemination of reports, standards, and recommendations for SMEs/SMBs.They describe developing a high-level programme to help direct smaller enterprises’ cybersecurity focus.Source: §6 · p. 17
  • Future work will investigate the proposal’s utility through partnership with LDSC before trials in other appropriate locations.The authors identify this as the next step in assessing support for better awareness efforts.Source: §6 · p. 17
Loading 1906.09594v1…