Repository logo
 

Developing cybersecurity education and awareness programmes for small- and medium-sized enterprises (SMEs)

Accepted version
Peer-reviewed

Type

Article

Change log

Authors

Bada, M 
Nurse, JRC 

Abstract

jats:sec<jats:title content-type="abstract-subheading">Purpose</jats:title>jats:pThe purpose of this study is to focus on organisation’s cybersecurity strategy and propose a high-level programme for cybersecurity education and awareness to be used when targeting small- and medium-sized enterprises/businesses (SMEs/SMBs) at a city-level. An essential component of an organisation’s cybersecurity strategy is building awareness and education of online threats and how to protect corporate data and services. This programme is based on existing research and provides a unique insight into an ongoing city-based project with similar aims.</jats:p></jats:sec>jats:sec<jats:title content-type="abstract-subheading">Design/methodology/approach</jats:title>jats:pTo structure this work, a scoping review was conducted of the literature in cybersecurity education and awareness, particularly for SMEs/SMBs. This theoretical analysis was complemented using a case study and reflecting on an ongoing, innovative programme that seeks to work with these businesses to significantly enhance their security posture. From these analyses, best practices and important lessons/recommendations to produce a high-level programme for cybersecurity education and awareness were recommended.</jats:p></jats:sec>jats:sec<jats:title content-type="abstract-subheading">Findings</jats:title>jats:pWhile the literature can be informative at guiding education and awareness programmes, it may not always reach real-world programmes. However, existing programmes, such as the one explored in this study, have great potential, but there can be room for improvement. Knowledge from each of these areas can, and should, be combined to the benefit of the academic and practitioner communities.</jats:p></jats:sec>jats:sec<jats:title content-type="abstract-subheading">Originality/value</jats:title>jats:pThe study contributes to current research through the outline of a high-level programme for cybersecurity education and awareness targeting SMEs/SMBs. Through this research, literature in this space was examined and insights into the advances and challenges faced by an on-going programme were presented. These analyses allow us to craft a proposal for a core programme that can assist in improving the security education, awareness and training that targets SMEs/SMBs.</jats:p></jats:sec>

Description

Keywords

46 Information and Computing Sciences, 4609 Information Systems, 4604 Cybersecurity and Privacy, 4 Quality Education

Journal Title

Information and Computer Security

Conference Name

Journal ISSN

2056-4961
2056-497X

Volume Title

27

Publisher

Emerald

Rights

All rights reserved
Sponsorship
Engineering and Physical Sciences Research Council (EP/M020320/1)