Mind the Gap: Revealing Security Barriers through Situational Awareness of Small and Medium Business Key Decision-Makers

TL;DR

This study investigates cybersecurity decision-making in SMBs, revealing awareness gaps and proposing interventions to enhance security practices through a mixed-method approach and situational awareness modeling.

Contribution

It introduces a comprehensive analysis of SMB decision-makers' cybersecurity awareness and develops a model to improve their security decision-making.

Findings

SMB decision-makers have varying levels of cybersecurity awareness.

Perceived risks influence defense measure choices.

Interventions can enhance SMB cybersecurity awareness.

Abstract

Key decision-makers in small and medium businesses (SMBs) often lack the awareness and knowledge to implement cybersecurity measures effectively. To gain a deeper understanding of how SMB executives navigate cybersecurity decision-making, we deployed a mixed-method approach, conducting semi-structured interviews (n=21) and online surveys (n=322) with SMB key decision-makers. Using thematic analysis, we revealed SMB decision-makers' perceived risks in terms of the digital assets they valued, and found reasons for their choice of defense measures and factors impacting security perception. We employed the situational awareness model to characterize decision-makers based on cybersecurity awareness, identifying those who have comparatively low awareness in the fight against adversaries. We further explored the relationship between awareness and business attributes, and constructed a holistic structural equation model to understand how awareness can be improved. Finally, we proposed interventions to help SMBs overcome potential challenges.