Cyber-Security Policy Decisions in Small Businesses

Cyber-Security Policy Decisions in Small

Businesses

Section 1: Foundation of the Study

The advent of technology comes with an increasingly unstable and changing

landscape. Cyber-security threats continue to evolve and reinvent themselves making

cyber-attacks a concern for anyone utilizing technology (Dinicu, 2014). One particularly

vulnerable group is small businesses. Small businesses have become an increasingly

popular target for cyber-attacks for several reasons. Specifically, small business owners

lack a cyber-security infrastructure capable of keeping up with cyber-security threats.

Furthermore, hackers perceive small businesses as gateways to large businesses,

including government entities, due to established business relationships (Shackelford,

2016).

While small business owners have struggled in years past to keep up with

combating cyber-security threats, it is not immediately clear what small business owners

must prioritize to maintain some degree of sanctity. What is clear is that small business

owners lack effective strategies to make informed decisions to protect the business from

cyber-attacks. In fact, an estimated 80% of small businesses reported not having

cybersecurity policies in place (Shackelford, 2016). This qualitative case study will

explore what strategies small business owners can adopt when making decisions

regarding protecting themselves from cyber-attacks.

Background of the Problem

In this age of digital technology, no business or government entity is safe from

cyber-attacks. Cyber criminals do not target organizations based on size, rather the

information or access held by that organization. The increasing adoption of information

technology for business activities has increased the number of vulnerabilities and threats

faced by businesses. Scholars and business entities alike have increased the number of

resources devoted to the protection of these assets (Sen & Borle, 2015).

The U.S. Secret Service and Verizon have reported a spike in cyber crimes against

small businesses that coincide with the increased use of technology (Wright, 2011). Small

business owners are increasingly adopting technology related activities such as electronic

commerce, which leaves them susceptible to cyber crimes (Rahman & Lackey, 2013).

While crimes against small businesses increase, resources and strategic direction are

minimal. A limited number of studies currently address why small business owners do

not implement adequate cyber-security strategies.

Problem Statement

Cyber-security attacks explicitly aimed at small businesses progressively increase

from year to year (Rahman & Lackey, 2013), with each breach estimated to cost

$263,000 (Symantec, 2016). In addition to fending off deliberate cyber-security attacks,

small business owners must contend with over 10 million viruses circulating the internet

on any given day leaving them vulnerable to unintended exploits (Ethala & Seshadari,

2013). The general business problem is small business owners are not adequately

implementing cyber-security strategies, leaving them susceptible to unplanned costs that

can bankrupt their business. The specific business problem is that small business owners

lack effective strategies to make informed decisions regarding cyber-security investments

to protect the businesses from cyber-attacks.

Purpose Statement

The purpose of this qualitative multiple case study was to explore strategies used

by small business owners to make informed decisions for cyber-security investments to

protect the business from cyber-attacks. One of the biggest issues a company, whether

large or small, must face is defending themselves against cyber-attacks (Fielder,

Panaousis, Malacaria, Hankin, & Smeraldi, 2016). Cyber-attacks are on the rise,

specifically for small businesses (Hutchings, Smith, & James, 2013). However, small

business owners often do not implement adequate cyber-security controls.

While all businesses are susceptible to cyber-attacks, small business owners are

appropriate for this study because current researchers have suggested they lack the overall

resources to identify and mitigate cyber-security threats. The sample for this multiple

case study was 10 small business owners from the southeastern United States with

successful cyber-security strategies. For this study, successful cyber-security strategies

were strategies or measures that have successfully mitigated cyber-security risks resulting

in the small business not having a realized cyber-security incident. The participants were

from various small businesses that met the United States Small Business Association

classification for their type of offerings. The results of this study may impact social

change through the improvement of the small business cyber-security climate by

providing insight into potential barriers and recommend feasible solutions.

Nature of the Study

I employed a qualitative research methodology for this study. Qualitative research

is ideal when exploring areas with unknown variables (Horsewood, 2011) and the method

allows for flexibility in data collection through the use of personal interviews and

openended questions (Yin, 2014). The qualitative methodology is appropriate to study

the resources used by small business owners to make informed decisions for security

investment and policy decisions. Davies (2015) defined quantitative research as

explaining phenomena by collecting numerical data that are analyzed using

mathematically based methods (in particular statistics). Quantitative and mixed methods

research were not appropriate for this study because there is no established basis of

measurement. I asked small business owners open-ended questions that would not

produce consistent, measurable results required in a quantitative or mixed methods study.

The selected design for this study was multiple case study. The rationale for the

use of a multiple case study was that this case represents a common case (Yin, 2014).

According to Yin (2014), a multiple case study allows the researcher to capture

conditions related to a particular interest. The multiple case study design is the most

appropriate design to use for this study. As affirmed by Yin, case studies are relevant

when research questions are explanatory, such as how or why questions, which is the

context of this study. Ethnographic, phenomenological, and grounded theory research

designs are not appropriate for this study since they focus on culture, lived experiences,

and theory.

Research Question

The results of this study may help small business owners understand cybersecurity

threats and possible strategies to protect their business from these threats. The central

research question for this study was:

What strategies do small business owners use to make decisions regarding

cybersecurity?

Interview Questions

1. What strategies are you using to secure your business from cyber-security

attacks?

2. What type of resources did you use to craft your cyber-security strategies?

3. What have you learned through personal experience about securing your

business?

4. What training do you have in place for your employees about cyber-security?

5. What role do your employees play in your cyber-security activities?

6. What cyber-security strategies have you implemented but have found are not

useful to small businesses?

7. What types of cyber-security strategies would you like to implement but have

not?

8. What additional information would you like to share your information security

strategies?

Conceptual Framework

The implementation of a successful cyber-security strategy requires an initial and

ongoing investment in resources and people (Rahman & Lackey, 2013). The process of

implementing and maintaining this potentially complex security strategy can be daunting

to those who do not have basic cyber-security knowledge (Wright, 2011). The foundation

of this study was that cyber-security strategies are part of the overall business model, or

system, and only through acceptance of security technology will a small business be able

to implement a successful cyber-security strategy.

To support this study, I selected Bertalanffy’s general systems theory as the

conceptual framework. According to Bertalanffy, an organization is a complete system

involving different parts (Bertalanffy, 1972). These parts include human, social,

organizational, and technological subsystems and they must interrelate to achieve the

goals of the organization (Baxter & Sommerville, 2010). For this study, the small

business was the overarching system. The employees, technology, and strategies

comprise the internal components of the system. These parts must cohesively work

together to protect the security of the information a small business owner is entrusted to

protect.

According to Hayes (2012), small business owners are reluctant to accept

cybersecurity as a necessity. This reluctance has an overarching effect on the viability of

a small business to sustain operations. The interconnection between employees,

hardware, and security controls is vital to the success of a small business adequately

securing their data (Puhakainen & Siponen, 2010). Specifically, concerning the people

making the overarching decisions, the people working on the network, the hardware

implemented, and the security controls implemented. The overarching goal is to promote

awareness of the interconnection of these components and the relationship to cyber-

security to the successful operation of the system.

Operational Definitions

Application: An application is a program that allows users to accomplish tasks

utilizing a computer (Raiyn, 2014).

Breach: unauthorized access to sensitive, confidential, or protected data (Sen &

Borle, 2015).

Cloud computing: cloud computing allows users to access resources through the

internet or network connection remotely (Gupta, Seetharaman, & Raj 2013).

Cyber-security awareness: knowledge of Cyber-security controls, threats, and

handling methods (Locasto et al., 2011)

Security Controls: any precaution or countermeasure used to avoid or minimize

cyber-security risks (Conner & Conner, 2013)

Assumptions, Limitations, and Delimitations

Assumptions

In research, there are assumptions that are accepted as true, or certain to happen

with proof (Bonell, Fletcher, Morton, Lorenc, & Moore, 2013). There were two

assumptions related to this study. The first was that participants would answer questions

without fear of reprisal or harm to their reputation and business. The second assumption

was that the data gathered from interviewed participants would accurately depict what is

truly happening. I presented participants with nondisclosure agreements to ease fear of

reprisal. In addition, my academic chair verified the validity of the data.

Limitations

Limitations in research are conditions out of the researcher's control (Moustakes,

1994). There were three limitations in this study. The first limitation was that small

business owners might inadvertently provide inadequate data due to their limited

knowledge of cyber-security. The second limitation was that cyber-security continues to

evolve, and that would limit the knowledge of participants. The third limitation was that

because this was a multiple case study, the results would be specific to those

organizations.

Delimitations

Delimitations are boundaries set by the researcher in a study (Moed, 2010). I

limited this study to small business owners located in the southeastern United States. The

delimitations of the study were: the sample size, the size of the business, and the location

of the business studied. Ten small business owners were sampled to ensure data

saturation. The size of the business was limited to small businesses as to control the

information received and appropriately direct the findings. I limited the participant

population to the southeastern United States for interview accessibility.

Significance of the Study

Contribution to Business Practice

Small businesses are a vital component of the American economy which is

evidenced in the federal government outsourcing over $83 billion dollars’ worth of work

to small businesses in 2013 (SBA, 2013). With this success, small businesses have

become targets of cyber-crimes. According to the National Small Business Association’s

2013 survey, over 94% of small business owners believe cyber-attacks are a risk to them,

and over 44% had fallen victim to a cyber-attack. Small business owners have an urgent

need for effective strategies for cyber protection. This study may provide small business

owners with a better understanding of strategies required to protect their data from

cyberattacks.

Implications for Social Change

Social responsibility transcends business size and can likely have a positive

impact on all society. The intent of this study is to encourage small business owners to

protect the data entrusted to them, which will benefit society overall. If small business

owners consider an investment in security to maintain or increase financial performance,

they may consider security a sustainable business practice. This may, in turn, generate

social benefits for the communities in which they operate. These advantages include, but

are not limited to, employment opportunities, revenue, and an increased sense of

community.

A Review of the Professional and Academic Literature

The purpose of this qualitative multiple case study was to explore strategies used

by small business owners to make informed decisions for cyber-security investments to

protect the business from cyber-attacks. The literature review included a review of

academic journals, commercial print articles, websites, industry white papers, corporate

reports, government reports, and presentations. At a minimum, 85% of the academic

journals are peer-reviewed and published within five years of this doctoral study. I noted

that the pace and rate of change within cyber-security related topics limited sources for

peer-reviewed work in not in journal format. To ensure the accuracy and legitimacy of

the articles I used the following sources Walden University Library, Google Scholar,

ProQuest, SAGE, and EBSCO.

A review of academic and professional literature allowed me to research current

cyber-security strategies used by small business owners, the current cyber-security threats

faced by small business owners and cyber-security strategies used by large businesses

that have the potential to benefit small businesses. Search methods included researching

current trends in cyber-security, small business statistics, risk assessments, business

plans, strategic plans, and government regulations regarding cyber-security. Accordingly,

the specific focus areas will be cyber-security threats, strategies, and cost of

cybersecurity.

Cyber-Security Threats

Cyber-security threats continue to rise, evolve, and take on a new form. There

were 430 million new unique pieces of malware detected in 2015, which is a 36%

increase from 2014 (Symantec, 2016). This increase in threats represents a sharp increase

from the 10 million malware infections that circulated the Internet in 2010 (Ethala &

Seshadari, 2013). With the rising rate of technology adoption by small businesses, this

leaves them extremely vulnerable. Malware infections alone have the ability to corrupt,

steal, or exploit data. It is vital for small business owners to adopt a cyber-security

posture that provides a robust and adaptable layer of protection.

In addition to malware, a new threat has emerged called ransomware.

Ransomware is a type of malware that hackers use to lock users out of their computer

system (Goldsborough, 2016). Ransomware is a tool utilized by hackers with the intent to

extort money from the persons they infect (Everett, 2016; Goldsborough, 2016). The

primary targets of ransomware in 2016 were users and hospitals (Goldsborough, 2016).

End users are targets because they lack the resources to recover properly from an attack

while hospitals are concerned with data integrity and confidentiality (Goldsborough,

2016). Small business owners typically have the same cyber-security controls in place as

end users, which make them targets of ransomware (Everett, 2016).

There is an increase in the diversity of ransomware attacks as well as the rationale

behind them. In the past, hackers focused on blanket attacks with the attempts of gaining

as much money as possible in a short amount of time (Everett, 2016). The new trend is

hackers attacking specific businesses with a critical need for their data, such as hospitals,

and businesses that cannot recover with any loss of data (Everett, 2016). This targeted

approach also lends credibility that small business owners will become prey to hackers

who utilize ransomware because they do not have the ability to rebound from a loss of

data.

There are many areas of technology that are vulnerable to cyber-security threats.

One particular area of interest of researchers is security vulnerabilities associated with

consumer electronic systems and the methods used by small business owners to protect

that data (Bandar & Christian, 2013; Laszka, Johnson, Schottle, Grossklags, & Bohme

2014). In a survey of small businesses, researchers found that the majority of the small

business owners surveyed outsourced their electronic commerce web sites (Laszka et al.,

2014). Though outsourced, the IP address and operating system of the server that hosted

the site was still visible through a basic Google search. Additionally, the researchers

found that the appropriate ports were secure in outsourced sites, and cited the need for

more research to ascertain how small businesses that do not outsource their electronic

commerce sites handle port security and overall network security (Laszka et al., 2014).

The referenced flaw is an illustration of how small businesses are vulnerable through just

publicizing their IP address, something that is quite common.

While the publication of IP addresses is a potential exploit to small business

owners so is the use of web technologies. Hutchings, Smith, and Lau (2015) and Lesnykh

(2011) theorized there are three main contributing factors that expose vulnerabilities in

web technologies. The first is the proliferation of high-end technologies, including Web

2.0. The second is the increasing shift that hackers have taken from targeting information

technology infrastructures to targeting data. The third, and largest contributing factor, is

insider threat. Consequently, the minimum cost of a single cyber-security breach

associated with web technologies was $190,000 in 2011 (Lesnykh, 2011) and has risen to

$263,000 in 2015 (Symantec, 2016).

Cyber-terrorism is another form of threat that is becoming a bigger threat to both

government and commercial entities (Ahmad & Yunos, 2012; Jarvis, Macdonald, &

Nouri, 2014). The threat has materialized at such a rapid pace that researchers have called

for a method to establish and test a cyber-terrorism framework (Ahmad & Yunos, 2012;

Jarvis, Macdonald, & Nouri, 2014). In one study, researchers found that governments

were at greater risk of cyber-attacks followed by computer networks, but businesses with

access to government networks had an equal threat (Ahmad & Yunos, 2012). With the

continued use of small businesses to perform government work, this is a realistic threat.

Without hardening techniques that are capable of adapting to the latest threats,

cyberterrorism will continue to pose a threat to all businesses, regardless of size (Ahmad

Yunos, 2012).

While web technologies are slowly monopolizing commerce so are the use of

Smartphone and other mobile devices (Brenner, 2013; Harris & Patten, 2014). With small

and medium-sized businesses having a heavy reliance on tablet and Smartphone

technology the inability to secure these devices, leave them vulnerable. Small and

medium-sized businesses do not have the same monetary capabilities that large-scale

enterprises possess to keep pace with these emerging threats (Gordon, Loeb, Lucyshyn, &

Zei, 2015; Harris & Patten, 2014). Researchers have called on the academic community

to provide additional research and resources to develop cost effective ways to secure the

data of small and medium businesses (Gordon et al., 2015; Harris & Patten, 2014).

The use of mobile devices and social media go hand in hand (Chauhan & Panda,

2015). In particular, small businesses are utilizing social media for primary business

functions such as recruiting employees or marketing to customers (Chauhan & Panda,

2015). The use of social media applications is a vulnerability or another point of access

that business owners need to control (Zhao & Zhao, 2015). Specifically, the protection of

the data that are transmitted and stored electronically.

Data storage is a growing concern for large businesses. The way data are shared

and stored evolves together with technology. The term Internet of Things (IoT) refers to

objects embedded in technology objects to transmit data (Britton, 2016). According to the

2015 State of the Market Report, there will be 5 billion IoT items by 2020. These items

can range from microchips, sensors, and actuators. These devices mostly share data

through Internet Protocol through software or other communication devices.

Small businesses utilize numerous components that belong to the IoT, specifically

smartphones, computers, tablets, and other credit card readers (Ban, Choi, & Kang,

2016). These devices transmit data over the internet through wireless technology such as

4G networks or hardwired Ethernet connections. Data protection is important, regardless

of the connection type. Often small business owners adopt this type of technology

assuming that it is safe, or that the vendor has ensured the safety of the data.

Unfortunately, small business owners must also consider securing data at rest as well as

data in transit. While the device the small business owner is using may encrypt data while

in transit, they must encrypt any data they store.

Another topic of research is potential exploits within the software of the network

infrastructure. Specifically, the platform used to run the servers and network devices on

the network. Often networks consist of servers running operating systems such as

Microsoft Server or Linux. Microsoft Server has over 45 million lines of code (Britton,

2016) that carry inherent security vulnerabilities. These operating systems are susceptible

to malware just as personal computers are. A breach on a server can carry heavier

consequences depending on the type of data hosted or connections that server has to other

devices.

In 2013, there were over 103,000 open exploits related to Linux, a popular

operating system (Avgerinos et al., 2014). In 2015, there were over 100,000 confirmed

incidents with 2,164 reported data breaches involving United States companies (Verizon,

2016). With Linux being open source, it is a popular choice for small businesses and

companies that are outsourced by small businesses (Avgerinos et al., 2014).

While network attacks will remain a common vulnerability, the need for detecting

these exploits is critical. Researchers and industry officials have attempted to control

exploits through virus detection software, anomaly detectors, and other scanning

apparatus. In one study, researchers created an active exploit program, which they called

the automatic exploit generation (AEG), and implemented it in a live environment

(Avgerinos et al., 2014). AEG was able to identify buffer flows and detect other

anomalies in a network considered secure. Avgerinos et al. (2014) found that the program

was effective yet more time and further research should focus on scaling the solution

based on network size. Without being able to scale AEG, the program was ineffective in

stopping all attacks. The most significant finding from this study was that networks

considered secure might have vulnerabilities. These undetected vulnerabilities have the

potential to be detrimental to small business owners based on the previously discussed

cost of security breaches.

Researchers emphasize threats to infrastructure or hardware while often a

cybersecurity breach is due to a simple human error (Heidenreich & Gray, 2014). Posey,

Roberts, Lowry, and Hightower (2014) performed a qualitative study to measure the

perception of security controls and responses to breaches interviewing 22 regular users

and 11 security experts. The researchers intended to ascertain whether users know about

security controls and feel responses to security breaches are effective. Posey et al. (2014)

concluded that both sets of individuals had varying perceptions of both categories.

Specifically, the individuals surveyed were not aware of most controls and were unaware

of any actions taken. Both groups agreed that the biggest threat was the insider threat.

The insider threat is not limited to human error it can also be a deliberate act by

malicious employees or compromised employees (Branker, Eveleigh, Holzer, & Sarkani,

2016). Insider threat can take the form of simple theft or ongoing and continues data theft

(Branker et al., 2016). Small business owners can be particularly susceptible to insider

threat because they often have access to data from larger entities as part of a teaming

agreement and lack sophisticated detection methods (Heidenreich & Gray, 2014).

Insider threat has become harder to detect over the years due to the proliferation of

technology (Wang, Gupta, & Rao, 2015). In previous years’ insider threat was isolated to

the employee’s specific job role. In any given office environment an employee can

intentionally plant malware or other nefarious hacking tools to steal or destroy

information. Small business owners may perceive that they do not have information that

is of any value to these types of threats, but the threat may lie in the fact that the

employee deliberately destroys data.

Another threat that is unknown to most, but prevalent in cyber-threats is shielding

(Yener & Cerezci, 2016; Zhang, Zhang, Wang & Lu, 2012) Shielding is the theft of data

through radio frequency (Yener & Cerezci, 2016). In multiple studies, researchers have

found that the increase in data theft through shielding is rising (Yener & Cerezci, 2016;

Zhang et al., 2012). The primary method for data theft through shielding is through

intercepting the transmitted data to a liquid crystal display (LCD) (Yener & Cerezci,

2016; Zhang et al., 2012).

Researchers in both industry and academia have focused on the impact of shielding

breaches as well as potential methods to decrease the ability to intercept data. In one

study Zhang et al. (2012) evaluated information leakage arising from computers and

other peripheral devices through shielding focusing on personal impact as well as

organizational impact. The variables were the components that make up shielding. The

statistical model created was to challenge the existing FCC and MIL 461C models

accuracy. The researchers concluded that both the FCC and MIL 461C models were not

accurate and that the model created had a greater degree of precision that allows for

quantitative measurement of the potential for theft by computer shielding.

Similarly, researchers have sampled commonly used items such as CRT monitors,

LCD monitors, laptops, and smartphones for shielding theft to determine which is more

susceptible (Yener & Cerezci, 2016; Zhang et al., 2012). The most susceptible item to

shielding is an LCD monitor due to the frequency in which it transmits data to the screen

(Yener & Cerezci, 2016) with smartphones being almost impenetrable to shielding. These

items apply to individuals and all sizes of businesses. The overall intent is a good

platform for further research. Specifically, to determine the frequency at which these

types of attacks occur and any cost associated with them.

While many researchers focus on threats and vulnerabilities to specific hardware,

software, or network platforms, there is a qualitative aspect to cyber-security. In some

respects, if a company does not believe they are a target they will not invest in

protections. There is an overall lack of cyber-security related literature that goes into

depth specifically related to small businesses (Hayes & Bodhani, 2013). The number of

academic articles related to cyber-security and small businesses has not grown in

proportion to the number of vulnerabilities associated with small businesses (Hayes &

Bodhani, 2013). This disproportional coverage is thought to be contributing factor to

small and medium business owners not perceiving themselves as a target, in the same

manner, a large company does (Hayes & Bodhani, 2013).

Additionally, Harris and Patten (2014) highlighted the dilemma faced by small

and medium businesses in implementing emerging controls for smartphones and tablets.

Harris and Patten discussed that small and medium-sized businesses do not have the same

monetary capabilities that large-scale enterprises possess to keep pace with these

emerging threats. With small and medium-sized businesses having a heavy reliance on

tablet and smartphone technology the inability to secure these devices, leave them

vulnerable. Harris and Patten provided recommendations for small and medium business

owners to implement. Harris and Patten cited a need for additional research to ascertain

cost effective ways to secure the data of small and medium businesses.

Cyber-Security Strategies

While cyber-security threats continue to evolve strategies to mitigate and

counteract, these attacks must evolve too. Corporations have dedicated teams of

cybersecurity specialists, the government has specific regulations, and universities have

degrees revolving around cyber-security. The average small business owner does not

have the skill set required to implement large-scale, proactive network defense

techniques, yet needs a strategy (Borett, Carter, & Wespi, 2013). It is important for small

business owners to stay abreast of current trends in cyber-security and utilize strategies

that make sense to their business (Lanz, 2013).

In addition to cyber-security strategy, there is a necessity for sustainability

planning for small and medium businesses (Ates & Bitici, 2011). Specifically, scholars

are calling for studies that focus on the need for small and medium businesses to create

capability and sustainability plans, keeping mind turbulent times and economic downfalls

(Ates & Bitici.2011; Cezar, 2013). According to Ates and Bitici (2011), organizational

resilience is achievable with long term planning and proper management planning

regardless of business size.

Another claim by researchers is that users with more control over their computer

assets are more at ease (Elie-Dit-Cosaque, Pallud, & Kalika, 2011). Essentially, if

controls are visibly stringent, it causes anxiety on the part of the end user. Elie-

DitCosaque et al., (2011) surveyed students enrolled in a training program and found that

an increase in autonomy reduced the anxiety of end users with new technology. The

results of this study are important to small business owners as they control their hardware

and software most of the time. In understanding what causes anxiety as it relates to

security controls, small business owners can properly manage that versus decrease

number of controls they have in place.

Sustainability through the process or product innovation lacks in small businesses

(Theyel & Hofmann, 2012). Often small business owners lack knowledge of current

market trends, or on the innovation of other companies driving an overall sense of

insecurity and instability in small businesses as they are unable to sustain without the

guidance of industry. An attribute determined by researchers that lend to small business

owners thriving and sustaining their business is their ability to communicate with

stakeholders about continual improvement and sustainment efforts (Theyel & Hofmann,

2012). Effective communication lends to the credibility of the small business and their

ability to manage their work. Developing and testing a cyber-security policy is not only

good business, but it is also essential to operating in today’s business environment.

The United States government has initiated reporting mechanisms for industry to

share security information with the government to track trends. The government has

taken particular interest in small businesses since they are not required to report security

incidents through any other legislation (Clinton, 2015). Previous literature and limited

government statistics show that small business owners are more susceptible to

cybersecurity attacks versus large corporations due to their lax controls (Clinton, 2015).

Researchers found that companies with strict security controls reported the same amount

of breaches as companies without security controls though it could be because companies

without strong controls are unaware of breaches (Urciuoli, Mannisto, Hinsta, & Khan,

2013).

Companies can utilize risk management techniques to reduce cyber-security

threats. Risk management is a technique that would particularly benefit small business

owners due to the low cost involved with learning how to perform risk assessments.

Researchers reviewed two recent surveys performed that assessed companies risk

assessment procedures and found that 68% of the respondents indicated that their CEO is

placing greater emphasis on risk management (Barles, Cote, & Williams, 2012). Also,

only 35% of the respondents indicated that they had a formally trained executive or

business line manager capable of properly assessing risk. Furthermore, the researchers

found that 55% of the respondents indicated that no one in senior management was

responsible for risk management or mitigation (Barles et al., 2012).

Another area of academic research is the lack of anti-fraud controls instituted by

small businesses, leaving them vulnerable to security breaches (Tysiac, 2012). In an

extensive literature review, Tysiac (2012) found that only 56% of small businesses

underwent external audits of their financial documents, as compared to 96% of large

firms. ACFE also found that only 18.5% of small business employees received training in

fraud detection and prevention. The indication of the lapses in security controls had

negative repercussions on unidentified fraud experienced by small businesses.

Specifically, small businesses found one of three fraud violations by accident versus

through vigilant activities or countermeasures.

The issue of expanding Sarbanes-Oxley to small businesses is another area of

research that is prevalent in academia (Dey & Sullivan, 2012). The implementation of

security measures required to be compliant with Sarbanes-Oxley may be too expensive

for small businesses, and the cost would outweigh the benefits (Dey & Sullivan, 2012).

The adaptation of internal audit procedures similar to those required in Sarbanes-Oxley

may be a viable solution for protecting small businesses from cyber-security attacks (Dey

& Sullivan, 2012).

The use of managed service providers, or MSSP’s, is another viable alternative for

small business owners (Hui, Hui, & Yue, 2012). The use of MSSP’s is on the rise,

especially in the United States. Small business owners utilize MSSP’s to perform

penetration testing, security assessments, and security planning. While MSSP’s have a

distinct advantage over not performing these tasks, there is an inherent risk associated

with system interdependency. System inter-dependency, according to Hui et al. (2012), is

the unintentional spread of viruses or other vulnerabilities using the same MSSP.

Specifically, the MSSP may handle a security incident for one client and unintentionally

passes the vulnerability to other, either through the inability to detect the vulnerability in

time or through improper controls. Having viable alternatives is especially important to

small business owners as it gives them an alternative method of performing cybersecurity

related work.

While hackers are a known threat to any business, they can also prove to be

beneficial in some cases. The study of utilizing ethical hackers is popular among

researchers and industry alike (Conrad, 2012; Steinmetz & Gerber, 2016). Specifically,

Conrad (2012) recommends that small and medium-sized businesses utilize ethical

hackers to perform penetration testing on their networks. The belief is that small and

medium-sized businesses do not perform penetration testing or network security outside

normal virus protection. The use of ethical hackers could greatly increase the security

posture of small networks without incurring the cost of hiring full-time security

personnel.

The utilization of existing solutions can be an efficient alternative for small

business owners. In particular, the use of existing frameworks that provide a solid

foundation with a sense of flexibility can increase the likelihood of establishing a

successful cyber-security strategy (Hoy & Foley, 2015). One such existing solution is

cyber-security frameworks such as ISO 27001 or COBIT. These standards are established

with the input of industry and by building off of known best practices (Hoy & Foley,

2015).

Standards like ISO 27001 and COBIT provide users with a framework to follow

based on industry best practices but do not dictate specific requirements (Hoy & Foley,

2015). For example, the ISO 27001 requires users have a password policy but does not

dictate the content of the policy or the requirements. Also, small business owners who

adopt any ISO standard can become certified. The certification process includes having a

licensed external auditor from an accredited company evaluate the company’s adherence

to the standard. The cost of an external appraisal is significantly less than hiring a

consultant to evaluate processes and can be an inexpensive way to get an outsiders

perspective (Hoy & Foley, 2015).

The ISO 27001 standard is flexible in that can be utilized for any business that

employs information technology (Hoy & Foley, 2015). Small businesses in the medical

field that require extra controls to protect protected health information would benefit from

the use of the ISO 27001 standard. Compliance with ISO 27001 is ideal for medical

organizations as it would assist in addressing network, data, physical, and human security

controls (Liao & Chueh, 2012). A survey of medical professionals that currently utilize

ISO 27001 as a security management system found that risk management was more

thorough, employees were better trained, and incidents decreased (Liao & Chueh, 2012).

The robustness and interaction employees have with the security management system is a

benefit to small businesses that do not employ a large cyber-security team (Hoy & Foley,

2015; Liao & Chueh, 2012).

Another area of research is the use of COBIT in conjunction with the ISO 27001

standard (Razieh & Nasser, 2012; Sheikhpour & Modiri, 2012). In one study, researchers

compared the ISO 27001 standard to the COBIT standard to identify similarities (Razieh

& Nasser, 2012; Sheikhpour & Modiri, 2012). The researchers found that ISO 27001

focuses on integrity, confidentiality, and availability of resources whereas COBIT is more

focused on network security (Razieh & Nasser, 2012; Sheikhpour & Modiri, 2012).

COBIT focuses on these areas; it does not provide a strong enough framework to

implement COBIT effectively.

Other researchers focus specifically on utilizing COBIT 5 as a security framework

for small businesses (Thomas, 2013). In one case study, Thomas (2013) monitored the

implementation of COBIT 5 in a small certified public accounting firm. The firm

consisted of 140 employees and 21 shareholders. The firm had six locations including

employees who worked remotely or at client sites. The details included glitches, cost,

setbacks, and usability and found that COBIT 5 is an efficient way to organize and

integrate IT functions with the overall organization (Thompson, 2013). The CPA firm

that utilized COBIT was able to focus on mitigating risks more effectively versus trying

to implement strategies.

While compliance is often studied, other areas of research include the necessity

and benefits ISO 27001 certification (Cohen, 2011). This area of the investigation came

about due to the requirement for compliance with the standard is required for all

companies bidding on work in the United Kingdom. To show compliance United

Kingdom companies must complete a lengthy survey that maps compliance to the ISO

27001 standard. On the contrary, companies that were ISO 27001 certified were often

given a waiver from filling out the survey due to the complexity of ISO 27001 and the

external audit procedure (Cohen, 2011). Also, Cohen found that a company could request

an extension if they were out of compliance if they were able to show a project plan

showing they were working towards complying with or obtaining an ISO 27001

certification. Cohen believed that companies could benefit from following the ISO 27001

standard, and if possible, obtaining the certification. The overall cost is minimal; so small

businesses can afford to get the certification.

The return on investment and overall benefit for obtaining ISO 27001 are other

relevant areas of research. The two leading adopters of ISO 27001, by way of external

audit, are Japan and the United Kingdom (Everett, 2011). The majority of industries in

the United States that did obtain the ISO 27001 certification were defense contractors,

telecommunications, energy companies, and financial companies (Everett, 2011).

Retailers small businesses were not embracing the standard though they could utilize it

for a framework that is proven and stable. Also, ISO 27001 is ideal for small companies

and retailers because it stimulates employee training and accountability (Everett, 2011).

Similarly, Kanynak and Karagöz (2014) explored the slow rate of adoption for the

ISO 27001 standard versus ISO 9001 and ISO 14001. ISO 9001 focuses on quality

management, and ISO 14001 focuses on environmental protection. The research intended

to find cost-effective ways for companies, specifically small businesses, to adopt the ISO

27001 standard. One trigger for this research was the recent adoption of ISO 27001 by

governments. In particular, the Japanese government mandates ISO 27001 certifications

for companies that handled sensitive data which is similar to the United Kingdom

requirements (Kanynak & Karagöz, 2014).

Another important area of cyber-security is risk management. In one study,

researchers explored why business managers the necessity, efficiency, and investment

worth of risk management while making risk management accessible to those without IT

knowledge (Baily, Migilio, & Richter, 2014). They developed a user-friendly software

solution that they implemented in two qualitative studies. They concluded that the risk

management software, through its intuitiveness, allowed companies to identify more

risks, more efficiently, and with improved accuracy (Baily et al., 2014).

In addition to identifying potential risks and vulnerabilities, companies must

deploy appropriate countermeasures to mitigate risks (Schuessler, 2013) As with risk

identification, companies that do not employ security experts should utilize industry

reports and trending analysis. Industry, academia, and government entities publish reports

that detail the exact results ranked the most common exploits and vulnerabilities as well

as the most efficient controls at the time of the report.

There is an increased adoption of cloud computing among small and medium

business owners (Beckers, 2013). Researchers believe five factors influence the adoption

of cloud computing (Gupta & Seetharaman, 2013). The factors are ease of use, security

and privacy, cost reduction, collaboration, and reliability. The researchers utilized a

qualitative structural equation to test 14 hypotheses. The researchers administered a

survey to small business owners who utilized cloud computing and found the strongest

relationship exists between cost reduction and cost savings (Gupta & Seetharaman,

2013).

Another emerging trend in technology is the use of cloud computing. Cloud

computing is growing in popularity among individuals, businesses, and government

entities (Georgescu & Suicimezov, 2012). Cloud computing allows users to store data in

a remote location that is maintained by another group. While cloud computing can

enhance productivity, and protect data from loss Georgescu and Suicimezov (2012) found

that users who adopt cloud storage methods and completely disregard risk management

and mitigation activities associated with local onsite storage. Georgescu and Suicimezov

contend that cloud computing requires a special risk assessment and additional security

precautions apply to the user. Georgescu and Suicimezov recommended further studies to

apply a framework that accounts for confidentiality, availability, and integrity.

While there are many resources available to small and medium businesses alike, it

is unknown what fosters adoption of these standards. In one study researchers and

explored user acceptance techniques as they relate to cyber-security activities (Wang,

2014). Wang and Wang (2014) created a model for user acceptance predictability based

on current technology, utility, cognitive cost, and self-efficacy. Wang and Wang verified

the data as being efficient and offer additional advice for Chinese firms to utilize when

implementing cyber-security activities. Further research can be done to validate if these

techniques will benefit all small businesses or a subset.

In addition to compliance and adoption techniques, researchers also focus on the

need to create a culture that is rich in cyber-security awareness to enhance the overall

safety of the network (Alhogail & Mirza, 2014). One belief is that adopting a change

management process that includes cyber-security considerations for all changes to the

network (Alhogail & Mirza, 2014). Incorporating cyber-security into change management

decreases the chances of making a change that can create vulnerability on the network.

Ultimately, all businesses should adopt simple change management processes regardless

of the size of the business.

While technology evolves constantly, there is a trend in innovation and adoption

of mobile technology in public health (Currie and Seddon, 2014). As of 2014, more

public health institutions were creating mobile medical technology products to meet

consumer demand (Currie & Seddon, 2014). The contention is that while social

innovation is growing the creation of models and testing against these models have not

kept pace. According to researchers, most innovation is due to comparative analysis in

varying regions (Currie & Seddon, 2014). Research shows that consumers’ desire mobile

health technology and by 2016, there could be over three billion active users of internet

technology. This progression and continued adoption of technology should be an

indicator to health care institutions to adopt mobile technology.

An additional area of study is the influence of emotions on cyber-security

behavior (Gulenko, 2014). In one case study, Gulenko (2014) attempted to correlate

motivation techniques for individuals and adherence to cyber-security policies. The

researchers compared the findings to the technology acceptance model, innovation

diffusion theory, and the social cognitive theory and found that positive words used in

information systems security were effective in establishing secure habits (Gulenko,

2014). Subsequently, negative words are effective when breaking negative habits

(Gulenko, 2014).

Furthermore, Lebek et al., (2014) performed a study that comprised of a literature

review of 113 publications aimed to identify applied cyber-security related theories

within the last decade. The authors found that only 4 of 54 theories were being used by

researchers; the theory of planned behavior, general deterrence theory, protection

motivation theory, and the technology acceptance model. The analysis also showed that

there are specific factors that have proven to be a more significant influence on security

behavior.

Cost of Cyber-Security Breaches

Cyber-security has become a consideration that managers must consider when

planning their budget (Gupta, 2011). In particular, managers must know how to fund

according to their threat model. In one case study, Gupta (2011) comprised funding

models through the perspective of a small business and an attacker. The strategic portion

of the model allows companies to identify funds needed to cover technology, security,

continuity activities, and infrastructure. The other part of the model is a risk management

module and allows companies to allocate money to items specific to protecting their risks.

The model was efficient and is adaptable for small and medium businesses (Gupta, 2011).

The consequences of a data breach can be devastating to small businesses. In one

case study, researchers looked at historical stock market data and compared firms that

reported a violation to those who did not (Gordon, Loeb, & Lei, 2011). The researchers

utilized the basic one-factor CAPM model and FAMA-French three-factor model to

calculate the stock return 121 days before and three days after a security breach and

concluded that the stock remained unchanged after a security breach (Gordon et al.,

2011). The lack of financial ramifications is often perceived as a factor for small

businesses not adopting security controls.

Building upon previous literature Watts (2011), discussed the recent decision by

the SEC to continue and allow companies who float under 75 million a year to opt out of

Sarbanes-Oxley. While there had been calls from scholars, academics, politicians, and

large corporations alike for equal treatment, the SEC could not find the justification in the

cost for businesses that did not gross profit over 75 million. The results of this study can

be helpful to small business owners because, years later, the contention is that still, those

small businesses need oversight in financial and other reporting.

While small businesses do not require Sarbanes-Oxley, it can be effective in

establishing a cyber-security framework (Kinney & Shepardson, 2011). Between

20032008, small businesses undergoing 404 (b) audits experienced a statistically

significant increase in weaknesses discovered during these audits (Kinney &

Shepardson). Also, it researchers found that the small firms did not correct the audit

findings. The rationale behind this was the increase in cost for not only audits, which

doubled during that period, but the remediation costs.

There has been a growing need for a tool that can anticipate the possibility of the

company failing based on several attributes (Borrajo, Baruque, Corchado, Bajo, &

Corchado, 2011). In one study, researchers created a model that incorporates inputs

regarding purchasing, cash management, sales, asset management, human resources, and

information technology (Borrajo et al., 2011). The researchers grouped the processes into

functional areas with information technology including cyber-security activities and

tested the prototype on small businesses. The results were both useful to the researchers

collecting data and the business owners that participated in the study. The business

owners were able to see potential pitfalls in their investments, and how modifications to

each can change the others, potentially for the good or bad.

Data shows that half of all new small businesses survive after four years yet there

were a sufficient number of studies to ascertain why this phenomenon occurs, but the data

collection is done mostly through businesses that did survive which skews the data

(Cader & Leatherman, 2011). To confirm this belief, the researchers conducted a study

utilizing the Cox Accelerated Failure Time Model and found that the data collection is

not truly adequate thereby giving small business owners a false sense of security.

Samujh (2011) explored the issues involving small business sustainability. Smaujh

(2011) performed literature reviewed followed by a qualitative grounded theory study to

ascertain the reasons why small businesses often fail. Smaujh (2011) was able to gather

91 usable questionnaires. Smaujh (2011) concluded that small business owners lacked

formal business training, were unable to maintain their business without working over 60

hours a week and had little documented in the areas of business planning and

sustainability. Smaujh (2011) concluded that small business owners lacked sufficient

resources to assist them with basic business planning, including financial backing to

implement sustainability plans.

Researchers contend that there is a connection between market competitiveness

and small business strategy (Salazar, Soto, & Mosqueda, 2013). Specifically, the

researchers believe there is a relationship between funding decisions and market

longevity and subsequently found that small business owners in their region lack

competitiveness due to intensive strategies and lack of long-term investment plans. Also,

the researchers found that companies that managed their short-term assets and liabilities

are more competitive and survive longer in the market (Salazar et al., 2013).

In addition to sustainability, researchers also focus on innovation and whether

small businesses can keep up with rapid advances in technology (Pirta & Strazdina, 2012;

Theyel & Hofman, 2012). The researchers were able to ascertain that recent events,

including media coverage, community advocacy groups, and customers influenced more

small companies to implement sustainability plans and activities which are a vital area of

research for the future sustainability efforts of small businesses.

There is an overarching belief in industry and academia that information

technology controls lower risk and reduce overall costs through mitigation of security

risks (Pirta & Strazdina, 2012). In one study, researchers found through a comparison of

61 companies and their security controls that companies that implemented controls had a

higher success rate in passing financial audits (Pirta & Strazdina, 2012). The researchers

also found that these companies also had less risk and fewer incidents involving breaches

(Pirta & Strazdina, 2012).

Additionally, Hayes (2012) considered a customized model for technology

acceptance. Hayes posits that a visual diagram explaining the new technology and the

usefulness to the adopter is a better indicator of acceptance than previous models.

According to Hayes, this would be useful for small business owners who have a low

adoption rate of technology. Hayes created a template based on the diffusion of

innovation theory and the technology acceptance model. Hayes interviewed small

business owners to gauge their response to the model. Hayes found that the small

business owners were more receptive of the model due to the visual representation of the

technology, cost, and benefits.

Furthermore, Rahman and Lackey (2013) explored the common security flaws

present in small business e-commerce sites. Specifically, that a small business owner is

less likely to follow established security standards and guidelines created to guide them to

secure their sites. Rahman and Lackey (2013) discussed common vulnerabilities found in

e-commerce sites and the prevention of these attacks. The researchers found that hackers

are targeting small business owners more frequently due to their inability or

unwillingness to spend money to protect their assets and concluded that small business

owners should hire outside firms or individuals regardless of the cost to stay competitive

and secure their data.

Little research exists on how to adapt to future changes in technology and how

that can affect small business research and development firms. Teirlinck and Spithoven

(2013) explored the role of small business research and development firms and their

reliance on the key technology. Teirlinck and Spithoven performed a mixed methods

study and found that internal innovations directly relate to the external environment.

Likewise, Teirlinck and Spithoven found that firms that had strategic plans were more

successful in market positioning and longevity.

In addition to security controls, small business owners should implement

Emergency Response & Business Continuity plans (Nicoll & Owens, 2013). The impact

on a small business that does not have adequate plans in place is catastrophic and can

affect the small businesses ability to stay in business compared to a large business. While

the previous researchers suggest small business owners had previously been reluctant to

spend the money on the development and sustainment of these plans, the view appears to

be changing which is pertinent because it assesses the need for small business owners to

implement appropriate emergency response and business continuity plans. Also, Nicoll

and Owens (2013) also cite previous literature pointing to the need for small businesses to

get more in tune with large businesses when it comes to cyber-security controls and

plans.

Stephen and Apilado (2013) built upon previous research that suggests that

companies are better off because of the Sarbanes-Oxley Act due to the stricter security

monitoring guidelines; this was to include smaller businesses that were not required to

participate in Sarbanes-Oxley. Stephen and Apilado found that large firms benefit from

the analyst security oversight and public reporting mechanisms, which has increased the

values of companies over time. Stephen and Apilado found that smaller companies

benefit from the overall lack of oversight and reporting requirements.

There are substantial benefits in following an industry security standard since it is

a proven framework that is accepted and adopted by many in the same industry. Many

companies that follow a cyber-security framework were able to plan better for continuity

activities and mitigate risks (Ramanauskaitė, Olifer, & Goranin, 2013). Retailers and

small businesses are not embracing the standard though they needed it most as they do

not employ full-time security analysts (Ramanauskaitė et al., 2013). Ramanauskaitė et al.,

(2013) found that following a security standard was ideal for small companies and

retailers because it pushed employee training, and was more cost effective than hiring an

outside consultant.

Small businesses should also consider the cost of protecting new technology

assets when investing in them (Raiyn, 2014). New technology is often susceptible to the

attacks such as denial of service, access attacks, cyber war, and passive attacks until the

vendor can release patches (Raiyn, 2014). The cost of actively monitoring a network is

something that small businesses cannot afford, though they actively handle electronic

commerce, personally identifiable information, and government information (Raiyn,

2014).

Eastman, Iyer, Liao-Troth, Williams, and Griffin (2014) explored the relationship

between millennials involvement and purchase behaviors as it relates to mobile

technology. According to the Eastman et al., research shows a trend indicating that the

millennial generation has different values, and buying behaviors compared to previous

generations. Also, Millennials have a higher spending power. The millennial generation

also has become highly dependent on mobile technology and social networking. To study

the relationship between millennials involvement and purchase behaviors as it relates to

mobile technology Eastman et al. used the social comparison theory. Eastman et al. found

that the level of innovations affects the usage among the millennial consumers.

Additionally, users of technology are millennials and may be willing to invest more

money in a product for the sake of security (Eastman et al., 2014).

Akhtar, Azeem, and Mir (2014) studied the impact of utilizing information

technology, specifically the internet, within small and medium businesses. Specifically,

Akhtar et al., contend that small and medium businesses are shying away from utilizing

internet technology for several reasons. The first proposed reason cost. Small and

medium businesses do not have the funds to finance a significant internet presence as

large businesses do. Second, small and medium businesses do not have the capabilities to

sustain internet technology related investments. Small and medium businesses could, and

should, utilize outsourced technology, like the cloud, to improve their business offerings

possibly allowing small and medium businesses to have a similar presence as large

businesses and expand internationally.

Researchers often utilize systems theory to explore safety and security based

decisions (Young & Leveson, 2014). According to Young and Leveson (2014), safety

and security are requirements for every business and should be part of every system.

There has been significant focus on security in scholarly study, but not to the point that

shows individual firms or corporations how to embed these activities into their overall

system (Young & Leveson, 2014). Without considering these functions, where

applicable, the entire subsystem is in jeopardy due to inconsistency and lack of planning.

In conclusion, the literature supports the intent of this study and problem

statement. While technology continues to evolve, cyber -security is a relatively new field

that has a limited number of extensive studies and models. Cyber-security continues to

present itself as a viable field of study due to the risk it presents to businesses of all sizes.

It is clear that small business owners face the same, if not more, cyber-security threats as

large businesses. It is also clear that small business owners do not have access to viable

resources to make informed decisions regarding cyber-security techniques within their

business. The impact and cost associated with a single cyber-security breach can be

catastrophic to small businesses and warrants further research.

Transition

Section 1 included information supporting the research problem. Additionally, a

foundation and background presented supporting the phenomenon that small business

owners lack adequate resources to address cyber-security. The problem statement

addressed both the general and specific business problem while the purpose statement

included justification for the selected research method, design, and participant pool. An

extensive literature review supported the rationalization of the research problem. The

overarching themes of the literature review were; cyber-threats, cyber-security strategies,

and the cost of security breaches. Section 2 of this study will include a framework of the

research components, further detail on the overall intent of the study, participant

enlistment, data collection, and analysis. Section 3 of this study will contain a formal

presentation of the findings and proposals for the application of the information collected.

Section 2: The Project