49 research outputs found
Automating the Communication of Cybersecurity Knowledge: Multi-Case Study
Cybersecurity is essential for the protection of companies against cyber
threats. Traditionally, cybersecurity experts assess and improve a company's
capabilities. However, many small and medium-sized businesses (SMBs) consider
such services not to be affordable. We explore an alternative do-it-yourself
(DIY) approach to bringing cybersecurity to SMBs. Our method and tool, CYSEC,
implements the Self-Determination Theory (SDT) to guide and motivate SMBs to
adopt good cybersecurity practices. CYSEC uses assessment questions and
recommendations to communicate cybersecurity knowledge to the end-user SMBs and
encourage self-motivated change. In this paper, the operationalisation of SDT
in CYSEC is presented and the results of a multi-case study shown that offer
insight into how SMBs adopted cybersecurity practices with CYSEC. Effective
automated cybersecurity communication depended on the SMB's hands-on skills,
tools adaptedness, and the users' willingness to documenting confidential
information. The SMBs wanted to learn in simple, incremental steps, allowing
them to understand what they do. An SMB's motivation to improve security
depended on the fitness of assessment questions and recommendations with the
SMB's business model and IT infrastructure. The results of this study indicate
that automated counselling can help many SMBs in security adoption. The final
publication is available at Springer via
https://link.springer.com/chapter/10.1007%2F978-3-030-59291-2_8Comment: 14 pages, 1 figure, 13th World Conference on Information Security
Educatio