Introduction The way people share knowledge

The way people share knowledge, conduct electronic business, and create value

was revolutionized by the Internet, which is becoming increasingly important for

conducting business (Askitas & Zimmermann, 2015; Jansen, Veenstra, Zuurveen, & Stol,

2016). In the 21st century, small business owners use computer systems and the Internet

to compete in the technology-infused global e-commerce markets (United States Small

Business Administration [SBA], 2016a). Improvements in global wired and wireless

technology provide businesses enormous benefits, yet simultaneously expose companies

to potential vulnerabilities (Weber & Horn, 2017). In 2014, victims of cyber incidents

reported an estimated annual loss due to cyber crime at $400 billion a year (Arief, Bin

Adzmi, & Gross, 2015).

Small and medium-sized enterprise (SME) owners often lack the necessary

information technology resources and capabilities needed to implement emerging cyber

security recommendations (Harris & Patten, 2014). Specifically, SME owners regularly

lack the proper processes to control evolving cybersecurity risks and information systems

security threats that characterize the use of these technologies (Njenga & Jordaan, 2016).

Theft or loss of private information can be an expensive casualty to any business (Piggin,

2016); however, for SME owners, negative losses resulting from cyber attacks might be

unrecoverable (SBA, 2015). The loss of customers, income, and in some instances

forfeiture of business due to expensive litigation costs are among the potential adverse

effects on SME owners (Federal Communications Commission [FCC], 2014; Layton &

Watters, 2014). Managing cyber risks requires organizations to implement multi-tiered

security strategies focused on prevention, mitigation, and reaction while concentrating on

people, processes, and systems (National Institute of Standards and Technology [NIST],

2015a, 2015b). The purpose of the study was to explore effective strategies small

business owners used to protect their businesses from cyber attacks.

Background of the Problem

Daily over 2.3 billion people use online technologies to work, learn, bank, shop,

and date (Central Intelligence Agency [CIA], 2015). Cyber criminals want access to

computers, tablets, and phones because they contain valuable exploitable information,

and they are always devising new ways to attack networked technologies (Symantec

Corporation, 2015). Cyber criminals use mobile phones, tablets, laptops, and server

computers to commit crimes (FCC, 2014).

In 2014, cyber attackers were responsible for 49% of data breach attacks, and

SMEs were the primary targets of cyber attacks (Symantec Corporation, 2015). In 2015,

cyber attacks against SMEs continued to increase; however, many of these attacks were

directed to fewer organizations (Symantec Corporation, 2016). Business owners must be

aware of and proactive in implementing new security strategies to protect their corporate

and personal client data. New and innovative hardware and software technologies are

essential to ensuring business systems and critical infrastructure are resilient (Maughan,

Balenson, Lindqvist, & Tudor, 2015).

Giboney, Proudfoot, Goel, and Valacich (2016) described how security hackers

pose a continuous and unrelenting threat to organizations by exploiting their computer

systems. Moreover, the FCC (2014) emphasized the importance of effective cyber

security practices as a critical factor to ensure Internet communications remain protected,

and that individuals of every organization should have security awareness. According to

E. B. Kim (2013), cyber crimes are diversified and broad reaching. Owners’ cyber

security awareness and proactive actions can potentially limit future cyber crimes and

increase small business cyber survivability.

Problem Statement

Cyber attacks are increasing, and victimization of individuals, businesses, and

governments will regularly continue to occur (Desai, 2013; Federal Bureau of

Investigation [FBI], 2015a; Walker-Osborn & McLeod, 2015). In 2013, estimated cyber

crime losses exceeded $67.2 billion annually for U.S. companies (Filshtinskiy, 2013). In

2014, 60% of all targeted cyber attacks struck SMEs whose owners were disadvantaged

in protecting their infrastructures (Symantec Corporation, 2015; United States Securities

and Exchange Commission [SEC], 2015). SME owners often do not view themselves as

targets for cyber attacks due to their small size or the perception they have nothing worth

stealing (SBA, 2015). The general business problem is 80% of SME owners do not use

adequate processes to protect against cyber attacks (Shackelford, Fort, & Prenkert, 2015).

The specific business problem is some SME owners may lack effective cyber security

strategies to protect their businesses from cyber attacks.

Purpose Statement

The purpose of the qualitative multicase study was to explore effective strategies

SME owners used to protect their businesses from cyber attacks. The specific population

consisted of four SME owners operating in the Melbourne, Florida area who utilized the

Internet for business operations. Additional study selection criteria required that SME

owners (a) were licensed to operate a retail business in Melbourne, Brevard County,

Florida; (b) employed between one and 249 personnel; (c) had an annual gross revenue

under $10 million; and (d) had successfully implemented cyber security strategies.

Given the findings reported by the National Cyber Security Alliance (NCSA,

2015) and in the U.S. House of Representatives Committee on Small Business hearing on

“protecting small businesses against emerging and complex cyber-attacks” (2013), I

determined that the selected population in this study was appropriate because 60% of

SMEs go out of business within 6 months after the first cyber attack. Findings from my

study may provide SME owners effective strategies to protect against a cyber attack,

which may increase consumer confidence and result in greater economic prosperity for

the local community. SME owners who have survived cyber attacks might spur

economic growth by employing community residents, fueling the socioeconomic

lifecycle.

Nature of the Study

I chose qualitative research methodology for the research study. Researchers use

qualitative methods to explore contemporary, real life situations, understand a

phenomenon, identify events’ significance, answer questions, and capture descriptions of

human experiences (Baškarada, 2014; Houghton, Murphy, Shaw, & Casey, 2015; Yin,

2014). I determined that the qualitative method was most appropriate for this study

because my intent was to explore effective strategies SME owners have implemented to

deter cyber breaches. Quantitative researchers test hypotheses and describe, categorize,

or relate comparison groups to provide trend analysis on attitudes and opinions to explain

and provide understanding of the social phenomena (Palinkas, 2014; Yilmaz, 2013; Yin,

2014). Likewise, mixed methods research combines both qualitative and quantitative

methodologies (Azhar, Latif, Murtaza, Khan, & Hussain, 2013; Mayoh & Onwuegbuzie,

2015; Tong, Chapman, Israni, Gordon, & Craig, 2013). To explore effective cyber

security strategies, I did not test hypotheses, which are part of a quantitative analysis or

the quantitative portion of mixed methods study.

I chose a multicase study design for the study because it is the preferred strategy

when asking how and what questions. According to Hyett, Kenny, and Dickson-Swift

(2014), the case study approach is especially appropriate for qualitative research

questions, which require a detailed understanding of social or organizational processes.

Researchers use case study design to explore a bounded system over time through

detailed in-depth data collection, using multiple data sources in a rich, real life framework

(Baškarada, 2014; Boblin, Ireland, Kirkpatrick, & Robertson, 2013; Marshall,

Cardon, Poddar, & Fontenot, 2013; Yin, 2013).

A multicase study is the most suitable choice to explore the research question

using archival data and participant interviews. The ethnographical research design

requires researchers to observe participants in their natural habitats to gain a deeper

understanding of how people experience, perceive, create, and navigate the social world

(Hallett & Barber, 2014; Murthy, 2013; Perry, 2013). Ethnographic design was not

appropriate for this study given that my goal was not to understand the cultural practices

of a specific group. Researchers use phenomenological design to examine the meaning of

lived experiences of an individual or group of people related to a unique phenomenon

(Gale, Heath, Cameron, Rashid, & Redwood, 2013; Mayoh & Onwuegbuzie, 2015;

Tuohy, Cooney, Dowling, Murphy, & Sixsmith, 2013). The phenomenological design

was not appropriate because I did not explore lived experiences in this study.

Research Question

The following research question guided the study: What effective strategies do

SME owners use to protect their businesses from cyber attacks?

Interview Questions

I conducted semistructured interviews focused on investigating effective cyber

security strategies SME owners used to protect their businesses from cyber attacks. The

following were the eight interview questions I asked each participant:

1. What successful strategies do you use to protect your infrastructure from cyber

attacks?

2. What successful strategies do you use for preventing, detecting, and responding to

cyber attack incidents?

3. How do you assess your information technology security risks?

4. What employee training strategies do you use for security procedures with

Internet devices?

5. What risk management strategies do you use to identify and evaluate cyber attack

risks?

6. What is your cyber attack contingency plan?

7. What effective strategies would you recommend to other SME owners to prevent

a cyber attack?

8. What additional information on cyber security strategies would you like to

provide or expound upon before ending the interview?

Conceptual Framework

I selected the general systems theory (GST) as the conceptual framework for the

study. Von Bertalanffy (1968) developed systems theory, which he characterized as the study of

interrelationships rather than individual modules. Von Bertalanffy contended that systems, in

essence, are self-regulating and self-correcting. Kuhn (1970) extended von Bertalanffy’s

works by proposing scientific advancement is not evolutionary, but a systematic process

where knowledge increases to the limits of the current paradigm, and through scientific

revolutions, one worldview replaces another resulting in a paradigm shift. Leaders who

apply the system thinking principle are more adept at working within organizational

structures, and are better able to manage processes and people within broader

environments (Black & Copsey, 2014). Moreover, Young and Leveson (2014) suggested

that the GST approach provides a robust foundation for security.

Gomes (2015) noted that SMEs are systems consisting of different components,

one of which is information security. As cyber attacks increase, cyber security for SME

owners is a critical systems component (Atoum & Otoom, 2016). Cyber security

technologies are inadequate to achieve secure operations without strategies, procedures,

ongoing risk assessment, and review of secure network protocols to achieve efficient and

secure information delivery (Dunn Cavelty, 2014; Wang & Lu, 2013). Applying von

Bertalanffy’s GST approach to SME owners’ cyber security strategies may capture the

influences under which they operate in an unpredictable, dynamically changing

cyberdependent market (Pouvreau, 2014). Exploring successful strategies SME owners

have implemented to protect their businesses from cyber attacks may contribute to SME

owners’ best practices, increase consumer confidence, and result in greater economic

prosperity.

Operational Definitions

Cyber crime: The criminal or harmful acquisition and manipulation of data for

gain using networked computers to assist perpetration of a crime, such as terrorism,

espionage, computer misuse, and fraud, across local or international networks (FBI, 2014;

Kraemer-Mbula, Tang, & Rush, 2013).

Evil hacker: An evil hacker is a person whose computer expertise results in

malicious intent to sabotage or obtain revenge (Sigholm, 2013; Xu, Hu, & Zhang, 2013).

Insider threats: Insider threats are malicious threats to an organization coming

from people inside the organization such as employees, business associates,

subcontractors, and even former employees who have intentionally misused their access

to negatively affect the confidentiality, integrity, or availability of the firm’s information

or information systems (Chou, 2013; Internet Crime Complaint Center [IC3], 2014).

Outsider threats: Outsider threats are malicious threats to individuals,

organizations, and governments from evil hackers, nonstate sponsored groups, terrorist

groups, and members of organized crime (FBI, 2015a; Zhang, Tsang, Yue, & Chau,

2015).

SME: A SME is a business independently owned and operated, which is not

dominant in its field of operation (SBA, 2015). The SBA defines different size standards

for each industry that relate to the dollar size of the business or the number of employees

it has, adjusted for industry (SBA, 2016b; U.S. Census Bureau, 2013).

Assumptions, Limitations, and Delimitations

Assumptions

Jansson (2013) noted that research assumptions are ideas the researcher accepted

as true. In this doctoral study, I made four assumptions. The first assumption was that

the review of company documents and semistructured interviews would provide

sufficient data to answer the overarching research question, and would be sufficient for

triangulation. The second assumption was that I would be able to reduce or eliminate the

effect of personal bias. The third assumption was that I would be able to conduct

effective interviews and solicit authentic responses from the participants. The fourth

assumption was that the participants would understand the questions and provide honest

answers.

Limitations

Research limitations are constraints over which the researcher has no control and

limit the possibility of transferability of the research findings to other situations (Yilmaz,

2013). The first limitation of the study was the selected participants understand the

interview questions and provide honest answers. The second limitation was the

availability of selected participants for personal interviews to support timely data

collection. The third limitation was the review of company documents and

semistructured interviews would provide sufficient data to answer the overarching

research question and suffice for triangulation purposes.

Delimitations

Research delimitations enable researchers to limit the scope and variables of their

research study (García, Skotnicka, & Zamora, 2015; Marshall & Rossman, 2016).

Research quality is dependent upon the investigator’s ability to deflect personal biases

and present research data in an objective manner (Smith & Noble, 2014). I delimited the

study to SME owners who (a) were licensed to operate a retail business in Melbourne,

Brevard County, Florida; (b) employed between one and 249 personnel; (c) had an annual

gross revenue under $10 million; and (d) had successfully implemented cyber security

strategies. Exclusionary delimitations included SME owners who did not meet all of the

criteria.

Significance of the Study

Impact Value to Business

My findings on SME owners’ effective cyber security strategies may be valuable

to individual consumers, other SME owners, third-party software vendors, cyber hackers,

coders, and academics, as well as municipal, state, and federal government agencies.

Case study research on cyber security phenomena may provide valuable information

enabling SME owners to avoid becoming victims of cyber security breaches. Not only do

cyber security breaches have the potential to impact SME owners financially, but they

also create additional management problems such as employees’ frustrations as they deal

with possible adverse customer feedback, systems downtime, and loss of productivity

(Hayes & Bodhani, 2013; Hua & Bapna, 2013).

Alternatively, Gordon, Loeb, and Zhou (2016) reported cyber security investments

could give organizations a competitive advantage by generating additional benefits, such

as increased revenues. The majority of malicious computer security attacks are

preventable by utilizing various security protection methods, thus disabling installation of

viruses, malware, and spyware on host computers and mobile devices (Egele, Scholte,

Kirda, & Kruegel, 2012; FCC, 2014; Tchakounté, 2014). Business owners, regardless of

the size of their enterprises, are potential cyber crime victims and should invest in

securing their data (FCC, 2014; SBA, 2015). Effective strategies for protecting data

require business owners to be aware and proactive, and to implement effective security

measures to defend against cyber threats (Gupta, Seetharaman, & Raj,

2013).

There are computer users whose sole purpose is to exploit the weakness in a

system for self-profit or gratification (Chowdappa, Lakshmi, & Kumar, 2014). Ethical

and malicious computer hackers are patient and diligent in discovering ways to enter and

infiltrate infrastructure weaknesses; only the intention of the hackers makes them diverse

(Chowdappa et al, 2014). Computer users should take precautions when using a network

device (FCC, 2014).

Securing cyber space is one of the nation’s top priorities. However, it is not only a

national effort, but also a global effort (The White House, 2014). Companies must invest

in preventative technologies to provide an initial layer of protection between themselves

and cyber hackers. Technologists have suggested corporations, consumers, and

government entities must invest in innovative solutions, which are years ahead of any

criminal hacking concept to protect global wired environments (Livshits, Bace, &

Neville-Neil, 2013).

Contribution to Effective Practice of Business

Cyber attacks are rapidly increasing, and economic impacts are beginning to affect

the global economy (Kshetri, 2013). Cyber security strategies cannot prevent personnel

authorized to access information from sharing it with those who are not (Bambauer,

2013). SME owners must develop effective cyber security countermeasures to protect

their companies’ transactions (FCC, 2014; Fielder, Panaousis, Malacaria, Hankin, &

Smeraldi, 2016; SBA, 2015).

According to the FBI’s IC3 (2014), Florida was ranked number two in cyber

victim complainants. Cyber crime appears to be growing at a rapid pace with

everchanging, emerging technologies and dependence on the Internet (Rashid & Parvez,

2014). In this study, I have identified factors that may improve SME owners’ awareness

of cyber security strategies and preventative actions. Implementing successful strategies

promotes positive economic and social benefits, which increase local consumer

confidence while minimizing consumer risks (FBI, 2015a). Additionally, the results of

the study may be useful to SME owners who frequently use Internet-connected devices

and may not focus resources on implementing affordable and sustainable cyber security

strategies.

Implications for Social Change

One of the biggest issues facing SME owners is the ability to defend themselves

from potential cyber attacks (Fielder et al., 2016). At present, SME owners have limited

strategies to address cyber security vulnerabilities and implement effective preventative

measures. Positive social change resulting from this study includes the potential for SME

owners to utilize cyber security best practices to alleviate or mitigate future cyber attacks.

Findings from the study may provide SME owners with effective strategies to

protect against a cyber attack, which may increase consumer confidence resulting in

greater economic prosperity. The implications for positive social change include

empowering other SME owners and new entrepreneurs with strategies and resources to

effect changes within the community. The findings in this study may transform the way

SME owners view cyber security strategies, and help SME owners who survive cyber

attacks spur economic growth by employing residents of the community, thereby

stimulating the socioeconomic lifecycle.

A Review of the Professional and Academic Literature

The purpose of this qualitative multiple case study was to explore what effective

strategies SME owners used to protect their businesses from cyber attacks. The Internet

has played a significant role in transforming modern life and requiring users to keep their

data secure from unauthorized distribution (Kortjan & Von Solms, 2014; Kumar &

Chaudhary, 2014). The targeted population consisted of SME owners who operated retail

businesses located in Melbourne, Florida, used the Internet for business operations, and

had successful cyber security strategies.

In a recent study, researchers estimated that the economic losses due to cyber

attacks will exceed $20 trillion by 2020 (Srinidhi, Yan, & Tayi, 2015). SME owners are

disadvantaged in protecting their infrastructures against cyber attacks (SEC, 2015), and

many SME owners conduct business over the Internet without using any security features

(SBA, 2014). Eighty percent of small business owners do not have established cyber

security policies (Shackelford et al., 2015).

The purpose of my academic literature review was to compare and contrast

different and opposing views related to the research topic. My search efforts were

focused on electronic information I obtained through published dissertations, government

websites, and peer reviewed journals available through the Walden University Library,

Google Scholar, and web pages. Hyperlink results provided access to scholarly

information from EBSCOhost, ProQuest, Business Source Complete, IEEE Source

Library, government websites, and other multidisciplined research databases.

The search criteria included the following keywords: browser security, business

failures, cloud computing, computer crimes, cyber attacks, cyber bullying, cyber crimes,

cyber fraud, cyber hacking, cyber loss, cyber security, cyber war, data loss, data theft,

email phishing, espionage, ethical hacking, fraud, hackers, hacking, network loss,

network prevention, security, security detection, security prevention, small business, and

software theft. I used the Ulrichsweb global serials directory database engine to validate

the peer reviewed and scholarly reference listings. Additionally, if an entry was not listed

Ulrichsweb search engine results, I used the journals’ homepages to validate the peer

reviewed and scholarly reference listings.

The literature review consisted of 137 references, of which 121 sources (88%)

were peer reviewed and published between the years 2013 and 2017. Twelve sources

(9%) were peer reviewed but not published between the years 2013 and 2017, and four

sources (3%) were published between the years 2013 and 2017 but were not peer

reviewed. Included in my review were one dissertation, two scholarly magazines, two

seminal books, four industry websites, 25 government websites, and 103 journal articles.

Prior studies have indicated that cyber attacks are on the rise, and that potential

adverse financial impacts are devastating (Desai, 2013; FBI, 2015a; Kongnso, 2015;

Walker-Osborn & McLeod, 2015). This literature review consists of the opening

narrative and discussions of its application to the business problem and conceptual

framework. It is then thematically divided into six major subsections: overview, threats,

attack methodologies, defense methodologies, cyber security, and emerging technologies.

Conceptual Framework

Von Bertalanffy (1968) developed systems theory, which he characterized as the study of

interrelationships rather than individual modules. Von Bertalanffy contended that systems, in

essence, are self-regulating and self-correcting. Kuhn (1970) extended von Bertalanffy’s

works by proposing scientific advancement is not evolutionary, but a systematic process

where knowledge increases to the limits of the current paradigm, and through scientific

revolutions, one worldview replaces another resulting in a paradigm shift. Caws (2015)

described von Bertalanffy’s GST as a theory of open systems which can be opened in

various ways and closed by the selective admission of nearby elements. Leaders who

apply the system thinking principle are more adept at working within organizational

structures, and better able to manage processes and people within broader environments

(Black & Copsey, 2014).

Bambauer (2013) described the current theoretical approaches to cyber security as

significantly flawed, and noted that scholars, governments, and computer scientists agree

inadequate security is an emerging threat and preventative action is urgently required.

The cyber security problem includes economic and structural factors requiring increased

regulation; the reality is cyber threats are inevitable (Bambauer, 2013; Dunn Cavelty,

2013). Gomes (2015) stated that SMEs are systems consisting of different components,

one of which is information security. As cyber attacks increase, cyber security for SME

owners is a critical systems component (Atoum & Otoom, 2016). Cyber security

technologies are inadequate to achieve secure operations without strategies, procedures,

ongoing risk assessment, and review of secure network protocols to achieve efficient and

secure information delivery (Dunn Cavelty, 2014; Wang & Lu, 2013).

Young and Leveson (2014) suggested that the GST approach provides a robust

foundation for security. Applying von Bertalanffy’s GST approach to SME owners’ cyber

security strategies may capture the influences under which they operate in an

unpredictable, dynamically changing cyber-dependent market (Pouvreau, 2014).

Exploring successful strategies SME owners have implemented to protect their businesses

from cyber attacks may contribute to SME owners’ best practices, increase consumer

confidence, and result in greater economic prosperity.

The objective of the study was to explore what effective cyber security strategies

SME owners used to protect their businesses from cyber attacks. Pervasive and sustained

cyber attacks could have a potentially devastating impact and could disrupt the

operations of individuals, businesses, and governments (United States Government

Accountability Office [GAO], 2013, 2015). On February 12, 2013, President Obama

issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity, directing

the NIST to work with over 3,000 government, industry, and academia stakeholders to

develop a voluntary framework based on existing standards, guidelines, and practices to

reduce cyber risks to critical infrastructure (NIST, 2015b; The White House, 2015a).

The Framework for Improving Critical Infrastructure Cybersecurity Version 1.0,

published on February 12, 2014, provides a list of activities to achieve specific cyber

security outcomes (NIST, 2015a). The framework provides elements to identify and

prioritize actions for reducing cyber security risk and can help businesses align policy and

technological methodologies to manage those risks (NIST, 2015a). The NIST

organization focuses on awareness, cyber security education, training, and professional

development (NIST, 2015a; Paulsen, McDuffie, Newhouse, & Toth, 2012).

Typically, large businesses have entire IT organizations dedicated to addressing

advanced persistent attacks and updating security policies, whereas small businesses

normally do not have the same resources to deter cyber attacks. IT experts have argued

that the cyber security framework represents the best efforts to address a threat, which

President Obama has called one of the gravest national security dangers the United States

faces (Shackelford et al., 2015). The NIST cyber security framework is a global plan of

action to guide users by using best practices to develop policies, training, and control

plans to improve or maintain their cyber security (NIST, 2015a; United States

Department of Homeland Security [DHS], 2015c).

The NIST framework includes standards, guidelines, and practices for SME

owners, highlighting the basics of cyber security and information security, defining the

type of information needing protection, discussing common cyber threats, and informing

users of known cyber security best practices (NIST, 2015b; Schneck, 2014). The NIST

(2015b) cyber security framework provides SME owners the best overall framework and

guidelines for protecting information, and it provides the primary tenants for computer

and network security strategies. The NIST framework began in 2010 as part of an effort

under the National Initiative for Cybersecurity Education (NICE) to expand the

Comprehensive National Cybersecurity Initiative from an internal federal activity to an

external national activity (Paulsen et al., 2012).

Moreover, the government created NICE with the idea that the most important

element in the fight against cyber threats is people. People create the technologies that

protect information and resources, they recognize cyber threats and respond to them, and

they understand how to protect themselves and others in cyber space (Paulsen et al.,

2012). The NIST agency’s primary focus is to promote awareness, formal education,

training, development, and workforce structure. Additionally, this new private public

partnership emphasizes collaboration with other government agencies, industry,

communities, and academia for individuals and groups to improve the cyber behavior,

skills, and knowledge of worldwide technology users (Paulsen et al., 2012). The NIST

voluntary cyber security framework is destined to become the next national benchmark

for assessing an organization’s cyber security (NIST, 2015a).

Technological advancements have made critical infrastructures more vulnerable

(Jaradat & Keating, 2014). Bambauer (2013) explained that computer and network

security problems exist because cyber security is undertheorized and lacks a framework

to guide change. Likewise, Jaradat and Keating (2014) examined critical infrastructures

from a systems view, and suggested that interdependences between critical infrastructures

are becoming increasingly apparent and that understanding how to manage critical

infrastructures is an emerging issue for businesses. Global interconnections have caused

systems to converge, meaning an isolated attack on one critical infrastructure system can

result in a cascading effect on other critical infrastructures and affect business operations

(Jaradat & Keating, 2014). Exploring effective SME owners’ strategies aligns with the

systems theory conceptual framework.

Overview

Cyber attacks are actions by individuals or groups of people attempting to bypass

security mechanisms of computer and network systems (FBI, 2016; Raiyn, 2014). Cyber

crime is a relatively new phenomenon with potentially severe consequences for local and

global businesses if not adequately addressed. Intellectual property, patents, and critical

business information are valuable assets (FCC, 2014). The SBA (2012) reported SMEs

produced 16 times more patents per employee than large patenting firms. SMEs are an

important part of the nation’s economy, but their owners often do not view themselves as

targets for cyber attack (SBA, 2015).

Symantec Corporation (2015, 2016) conducted studies of SMEs to determine their

susceptibility to cyber attacks; results indicated SMEs are susceptible to cyber attacks

because they lack sophisticated security capabilities and the financial resources to prevent

potential attacks. Cyber attacks on SMEs may enable access to system backdoors,

exponentially expanding potential losses (MacEwan, 2013). My objective in this

qualitative research study was to explore successful strategic elements of cyber security

and the prevention methodologies employed by SME owners to protect their businesses

from cyber attacks. Cyber criminals are increasing attacks on small business owners who

currently may have limited information on cyber security vulnerabilities and protective

strategies (SBA, 2014).

Trends in the literature indicate cyber attacks are vast and cover many facets of

Internet connectivity (Jang-Jaccard & Nepal, 2014). The term cyber attack includes three

primary areas of criminal activity: cyber terrorism, cyber identity theft, and cyber

espionage (FBI, 2013a). Cyber terrorists are state-sponsored and non-state actors who

engage in computer and network intrusions to pursue cyber space attacks and cause

public fear (Sigholm, 2013). Cyber identity theft occurs when someone unlawfully

obtains another’s personal information and uses it to commit theft or fraud (FBI, 2016).

Cyber espionage is politically motivated hacking focused on national security breaches

and sabotage of a nation’s critical infrastructure (Jang-Jaccard & Nepal, 2014). While

each area contains specific technological advances and methods to perform tasks, the two

commonalities each share are access to connectivity and user vulnerabilities. After

conducting extensive research about cyber security, I found that the United States is not

alone in its efforts to combat cyber attacks and mitigate cyber crimes (Embassy of the

United States, 2013; The White House, 2014).

Technology is a valuable commodity to people, businesses, and governments. In

October 1957 when Russia successfully launched Sputnik 1, the first space satellite

(Kuznetsov, Sinelnikov, & Alpert, 2015), the U.S. government was caught off guard. To

regain their premier and most advanced superpower status, the U.S. Department of

Defense (DoD) awarded multiple contracts to the Advanced Research Project Agency

(ARPA), now known as the Defense Advanced Research Project Agency (DARPA)

(Campbell-Kelly & Garcia-Swartz, 2013). One such contract involved American

scientists who theorized developing a network of dispersed nodes for educators to

communicate with each other over internetworking paradigms using specific

communication protocols. In 1969, Cerf and Kahn’s theory was tested and proved

successful with the first electronic message transmission between two computers: from

the University of California Los Angeles (UCLA) to the Stanford Research Institute

(Campbell-Kelly & Garcia-Swartz, 2013).

Eventually, network and computer developers connected additional computers to

the educational network, exponentially expanding it to the global Internet of today, a

system of diverse networks connected through standard communication protocols

(Campbell-Kelly & Garcia-Swartz, 2013). Campbell-Kelly and Garcia-Swartz found the

developers of the first Internet protocols (IP) did not consider security issues thus fueling

the prominence of current cyber security attacks. Haigh (2014) accurately reported one

person did not develop the Internet, which has evolved over time. The Internet has

transformed the entire global society by enabling information sharing and spurring

economic growth and prosperity.

Cyber espionage of American companies in 2009 exceeded $50 billion while

global losses from cyber hacking surpassed $1 trillion (Ezekiel, 2013). The U.S.

government designed the EINSTEIN program as the first line of defense on national

security prevention against cyber attacks (Malik, 2013). The basis of EINSTEIN’s first

cyber attack strategy was to limit network access points and prescreen incoming network

traffic from malicious attacks. In 2002, the U.S. government established the DHS with its

primary focus to protect the U.S. and its territories from accidents, terrorist attacks, and

natural disasters (DHS, 2015b). Additionally, the DHS has responsibility for protecting

critical national infrastructures, which include the Internet (DHS, 2015b). The DHS faces

many Internet security challenges in its efforts to prevent millions of daily cyber attacks

(DHS, 2015a).

While large organizations have the methods to determine such losses, SME

owners often, lack the capability and ignore the implementation of effective network

security measures, which result in high risk exposure and losses from cyber attacks (SBA,

2014). SME owners prioritize their cyber security strategies by understanding their risk

tolerance to mitigate potential cyber attacks (Fielder et al., 2016). Those who ignore or

fail to implement security measures risk exposure to becoming cyber attack victims

(DHS, 2015a).

Threat Methodologies

Prior studies have indicated cyber attacks are on the rise and that becoming a

cyber attack victim will be a normal occurrence without modifications to national security

and enforcement policies (Desai, 2013; FBI, 2015a; Kongnso, 2015; WalkerOsborn &

McLeod, 2015). Likewise, Filshtinskiy (2013) reported the estimated losses for domestic

U.S. companies affected by cyber crime exceeds $67.2 billion annually. Although cyber

criminals continue to find creative ways to penetrate laptops, phones, and computer

networks resulting in numerous cyber security attacks and thefts, the key to effective

cyber security is managing organizational risks (Sheppard, Crannell, & Moulton, 2013).

Hacking evolved over time spawning into transgressive criminal expertise (Steinmetz,

2014). State and non-state hackers perform cyber operations to achieve a mixture of

political, economic, or military objectives (DoD, 2015). Hackers comprise three groups:

(a) a black hat or evil hacker with malicious intent to sabotage or obtain revenge; (b) a

white hat or ethical hacker, usually a security professional or a penetration tester; and (c)

a grey hat or a person who hacks for curiosity and notoriety and, in some cases, is a

former black hat now employed as a security professional

(Sigholm, 2013; Xu et al., 2013).

Evil hackers are responsible for some of the recent cyber attacks on Coca-Cola,

Target, and the Office of Personnel Management (OPM) (Arlitsch & Edelman, 2014;

Gootman, 2016). Cyberspace is an unpredictable environment characterized by nonlinear

dynamics in which effects are disproportionate to their apparent causes (Betz & Stevens,

2013). The FBI reported global organized crime activities as one of the most

sophisticated reaping illegal profits exceeding $1 trillion per year (FBI, 2015b).

Cyber threats are increasingly affecting businesses’ bottom lines; however,

business owners are often dismissing warnings. Few businesses are taking the necessary

steps to safeguard their private data and enhance cyber security (Shackelford et al., 2015).

The implications and threats posed by security breaches have the potential to crush even

the most intimate aspects of lives (Desai, 2013). There are two categories of threats:

insider and outsider (FBI, 2015a; Zhang et al., 2015).

To mitigate insider attacks, Mandal and Chatterjee (2015) proposed controlling

the system administrator’s activities and proposed policy changes for system

administrators. Hua and Bapna (2013) reported simulation results indicate the optimal

investment required to protect an information systems infrastructure from insiders is

several magnitudes higher than for protecting against external hackers. Effective security

countermeasures are dependent on understanding the user’s behavior and his or her

susceptibility to hackers and scam artists (Zhang et al., 2015).

In many firms, the business value for information technology (IT) is a top

concern. Chen et al. (2014) reported the positive effects of IT capability on

organizational performance but cited our knowledge of the processes through which such

gains are achieved remains limited due to a lack of focus on the business environment.

Kongnso (2015) conducted a qualitative study of 14 participants consisting of four

technology executives and 10 technology staff to determine the best practices technology

leaders use to minimize data security breaches yielding increased business performance.

Research study findings revealed executive business leaders lacked sufficient knowledge

to minimize data security breaches for increased business performance (Kongnso, 2015).

Attack Methodologies

Instigators of both outsider and insider threats use attack methodologies to alter or

destroy data or functionality of networks or systems (FBI, 2015a). One example is the

hacker’s use of bogus security certificates or certificates of authority (CA) which enable

Internet users to operate using secure transmissions (Laurie & Doctorow, 2012). Hackers

then have unlimited access to the Internet via the compromised computers because the

bogus certificates appear to be authentic. In an effort to fix the problem, Laurie and

Doctorow (2012) proposed using a cryptographic protocol called sovereign keys (SK),

which includes additional verification features, as a new security mechanism for vendors

to implement. Internet system administrators continue to explore and deploy solutions to

identify and eliminate the use of bogus security certificates.

Gordon et al. (2016) reported cyber security investments could give organizations

a competitive advantage generating additional benefits, such as increased revenues. SME

owners should develop cyber security strategies focusing on confronting human

vulnerabilities (Zhang et al., 2015). Researchers indicated users are aware of proper

password management, yet are still inclined to take risks (Whitty, Doodson, Creese, &

Hodges, 2015).

The explosion of online and mobile technologies has resulted in a timeless global

workplace. Engineers design computer and network systems to operate with services,

security mechanisms, and attacks running simultaneously without affecting overall

system performance (Emm, 2013). Denial of service attacks, spyware, and viruses are

examples of components affecting computer and network performance (Emm, 2013; Ye,

Aranda, & Hurley, 2013).

The growth of the mobile market has sparked a revolution of employees who

bring their smart phones or tablet devices to use at work locations. Although there may

be advantages for Bring Your Own Device (BYOD) systems, which reduce a company’s

indirect costs, one of the biggest risks involves employees downloading personally

identifying or confidential client information to their smartphones and/or tablet devices

(Disterer & Kleiner, 2013). Thieves could then obtain critical company data if any of

those mobile devices were lost, stolen, or otherwise compromised. To mitigate the effects

of the attack methodology, SME owners can establish policies for employee use of public

Wi-Fi zones, and require employees utilize a virtual private network (VPN) for

connectivity when connecting to a corporate network (Disterer & Kleiner, 2013).

SME owners must be knowledgeable of BYOD systems and develop appropriate

security strategies to mitigate inadvertent company exposure to cyber attacks (MacEwan,

2013). Moreover, business owners must operate under strict regulations to protect client

data (FCC, 2014; SBA, 2014, 2015). The adoption of cloud computing has many benefits

enabling SME owners to compete globally in a cost-effective manner with seamless

sharing of cloud infrastructure and computing resources. Abdellaoui, Khamlichi, and

Chaoui (2016) reported numerous features and advantages; however, the cloud has also

brought some issues, particularly, security and monitoring. One of its primary security

concerns is the weak user authentication.

The U.S. has classified cyber space attacks as an act of war, which allows the use

of military force to combat intrusions (DoD, 2015). Academic computer scientists are in

a unique position to influence and shape national and international cyber security policies

by determining what type of information is required for cyber attack assessments (NIST,

2015a, 2015b; Shackelford et al., 2015). Although the current global political

environment and recommendations by national policy makers are influencing factors,

federal, state, and local officials are ultimately responsible for making decisions to defend

the nation from cyber attacks (The White House, 2014).

Defense Methodologies

Hu and Scott (2014) argued software security prevents leaks of data, alteration of

data, and unauthorized access to data. Determining the level of system vulnerability is

essential to identifying and developing an appropriate security infrastructure

methodology (NIST, 2015b). The top five operating system characteristics for

monitoring system impacts for motion detection, intrusion detection, and cyber attacks

are the system, process, memory, network, and IP (Ye et al., 2013). Varied system

performance objects, such as task manager, monitor the state and performance of systems,

detect attack activities, and trigger appropriate security systems protection (Li, 2013;

NIST, 2015b; Ye et al., 2013).

SME owners are more vulnerable to cyber attacks than large enterprises because

they may lack the IT expertise and resources needed to understand and confront IT

security issues in the rapidly growing threat environments (Emm, 2013). According to a

2016 study conducted by Jansen et al. (2016), SME owners implemented protective

measures when they (a) believe a measure is effective, (b) are capable of using Internet

technology, (c) have a positive attitude toward online protection, and (d) are responsible

for their own online cyber security. Loss of data affects businesses and has the potential

to jeopardize a company’s reputation with customers, suppliers, and partners (SBA,

2014).

Society’s insatiable desire for knowledge has created a repetitive cycle fueling

new technology, computing inventions, and sophisticated cyber attacking (Cheswick,

2013; Jang-Jaccard & Nepal, 2014). Business owners’ first line of defense to prevent

data loss is to implement effective user passwords (Cheswick, 2013). Likewise, Wen et

al. (2014) presented study results indicating appropriate authorization and controls are

necessary to prevent individuals’ data from malicious use and ensures individual privacy

when developing an open platform.

Although Cheswick (2013) and Wen et al. (2014) reported that user passwords are

critical to potentially preventing data loss, Whitty et al. (2015) reported individuals

continue to engage in risky password practices, such as sharing passwords, using the

same password over multiple platforms, and despite numerous public campaigns to the

contrary, using passwords easily cracked. Business owners who used a process approach

to security effectively implement strategies to detect, protect against, and respond to

cyber attacks (Lowe, 2014). Additionally, Emm (2013) addressed six security steps,

which SME owners can employ to protect themselves (a) require user passwords for login

accounts, (b) select products which provide protection, (c) protect and secure systems

data, (d) establish and implement user policies and procedures, (e) properly train staff to

recognize and understand the risks, and (f) expect and prepare for the worst. Business

owners should implement security policies not only flexible and easily adaptable to

counteract emerging cyber threats but also containing data retrieval and backup plans to

prevent complete data loss and enable fast retrieval and recovery (FBI, 2014, 2015c).

Different views for implementing loose and strong password criteria depend on

the business model and user/customer base willingness and ease to access desired

technology. J. Hong and Reed (2013) reviewed password guidelines of international

website retailers such as Amazon, Fidelity Investments, and PayPal, which revealed loose

security password policies enabled users to easily login and purchase products without

stringent verifications. On the other hand, J. Hong and Reed found creating user accounts

and passwords on national government websites was extremely difficult due to strong

password criteria requirements. Jang-Jaccard and Nepal (2014) and the FCC

(2014) recommended business owners’ defense methodologies focus on mitigating risks

associated with owning and operating information systems.

Prevention. Developing a system of preventive security measures adds a

significant deterrent to protect networks from malicious cyber activity (DHS, 2015b;

SBA, 2014). Both public and private organizations require a robust cyber security

strategic approach to prepare, respond, and recover from cyber attacks (Sheppard et al.,

2013). Grossman (2013) analyzed the design of Internet security measures and reported

popular Internet browsers do not offer users sufficient security protection and are still

susceptible to malware downloads, which was similar to findings in previous studies. To

keep information and data safe, developers must make significant improvements to

Internet browsers’ security, such as improved multifactor security authentication methods

and CAs (Grossman, 2013; Laurie & Doctorow, 2012).

SME owners must be more aware of cyber security if they are going to avoid

becoming cyber victim casualties (Hayes & Bodhani, 2013). According to the SBA

(2014), SME owners in the U.S. have a false sense of protection from cyber crime

attacks. SME owners must take a proactive approach to protecting their data by

establishing cyber security plans, and creating and implementing Internet security

policies (DHS, 2015b; SBA, 2014). Building secure software involves several different

processes, but security awareness and implementation are the most important (Hu &

Scott, 2014).

Some businesses are opting to outsource their information security protection

services to a third-party managed security service provider (MSSP), which enable SME

owners to forgo owning, maintaining, and updating their software and hardware

infrastructures (Sultan, 2014). However, outsourcing is not without risks, such as

whether the MSSP’s protection will be sufficient if a data breach occurs (Jang-Jaccard &

Nepal, 2014). Ultimately, a business owner must evaluate whether the risks of

outsourcing security protection services to a third-party are necessary to mitigate

company losses (FBI, 2014, 2015c).

The Internet has rapidly grown from its inception requiring fundamental

legislative changes to keep up with rapidly developing consumer requirements (Kutty &

Sreeramareddy, 2014). There are concerns from privacy advocates who fear legislation

will allow unauthorized disclosure of personal information to the federal government

(Taddeo, 2013). Both the Federal Trade Commission [FTC] (2016) and Taddeo (2013)

reported the need to reach an ethical solution to fine-tune cyber security measures and

individual rights. Taddeo reported public authorities’ attempts at legislation have resulted

in disagreement over cyber security measures and an individual’s rights,

attributing to the struggle between liberties and authorities.

Garfinkel (2012) expressed concern over cyber security and computer related

risks since no single solution addresses the problem of computer security breaches. Rid

and Buchanan (2015) reported attribution for computer network intrusions is one of the

most intractable technical problems and is dependent on the available forensic evidence.

Both Desai (2013) and the White House (2015a) reported on the need to develop cyber

space policies and adopt national and international enforcement for social and business

transactions including data location, accountability, cyber bullying, crimes, terrorism, and

fraudulent activities. Business owners should concentrate their efforts to reduce risks by

implementing technical and political solutions (NIST, 2015b; SBA, 2015, 2016b). While

awaiting additional cyber space policies and enforcement at the national level, it is

imperative for business owners to develop and implement cyber security strategies and

preventative measures to mitigate data losses (FBI, 2015a).

Cloud computing. Cloud computing is a time-sharing, on-demand network

model, which enables access to a shared pool of configurable computing devices where

businesses store and retrieve their data securely at a remote (cloud) location

(Whaiduzzaman, Sookhak, Gani, & Buyya, 2014). Users can quickly provision clouds

fully scalable depending on business requirements. Whaiduzzaman et al. (2014) and

Rashid and Parvez (2014) agreed the emerging technology fills the void for SME owners

whose workforces have immediate access to the Internet by allowing users to access end

systems using infrastructure and software provided by the cloud at minimal cost.

Not only does cloud computing relieve SME owners of the indirect information

technology burden large businesses have by leveraging virtual data storage and retrieval,

it also mitigates huge overhead or indirect costs (Rashid & Parvez, 2014). Cloud

computing efficiencies increase profits by allowing more employees to work from remote

locations thereby increasing overall company productivity. Additionally, Whaiduzzaman

et al. (2014) reported vehicular cloud computing as hybrid technology influencing traffic

management and road safety by instantly allowing users to access vehicular computing

resources and the Internet for decision-making.

Cyber Security Strategies

The global economy depends on effective cyber security strategies to ensure

individual, business, and global governments’ infrastructure assets remain secure (FBI,

2015a; The White House, 2015b). Von Solms and Van Niekerk (2013) defined cyber

security as the ability to protect or defend cyber space from cyber attacks and includes

capabilities allowing detection, assessment, reaction, and exploitation of potential cyber

threats in real or near real time. SMEs comprise the majority of businesses in most

economies and the potential cyber threats to SMEs could be catastrophic

(YeboahBoateng, 2013). Defense, exploitation, and attack are three operational domains

of cyber security while confidentiality, integrity, and availability are three primary

principles of cyber security (Raza, Wallgren, & Voigt, 2013; Wang & Lu, 2013).

President Obama reported cyber security affects the national security, economic

prosperity, and personal privacy and is one of the most significant challenges the global

economy is unprepared to confront (The White House, 2015b).

Cyber security decisions require insight into current security threats and the ability

to forecast potential vulnerabilities (NIST, 2015b). SME owners lack the proper

processes to control evolving cybersecurity risks and information systems security

threats, which characterize the use of these technologies (Njenga & Jordaan, 2016).

According to Verbano and Venturini (2013), because SME owners lack the resources to

respond to cyber security threats, which may potentially threaten their survival, they

should adopt risk management strategies and methodologies. Cyber security models aid

decision-makers by identifying security threats and system vulnerabilities further

enabling stakeholders to quantify their risks results in economic terms (Rabai, Jouini,

Aissa, & Mili, 2013). Each stakeholder defines specific security requirements and the

model adjusts to the identified requirements based on desired security compliance (NIST,

2015b; SBA, 2015, 2016b). Although Rabai et al. (2013) provided a quantitative model

for security measurement to quantify risks enabling SME owners to strategize and

mitigate losses, Bambauer (2013) recommended a different approach to focus on

mitigating breaches rather than preventing them.

Fielder et al. (2016) proclaimed one of the biggest issues facing SME owners is

the ability to defend themselves from potential cyber attacks. Kongnso (2015) conducted

a qualitative multiple case study exploring best practices technology leaders use to

minimize security breaches and increase business performance. According to Kongnso,

the four major elements further reducing security breaches and improving business

performance are (a) an organizational culture promoting security awareness, (b)

consistent organizational security policies and procedures, (c) implementation of security

awareness education and training to mitigate insider threats, and (d) organizational

commitment to adopt new technologies and innovative processes.

Garfinkel (2012) reported there is evidence that global interconnectedness

combined with the proliferation of hacker tools means today’s computer systems are less

secure than equivalent systems a decade ago. Additionally, Garfinkel stated although IT

experts have introduced techniques and technologies to reduce security-critical defects,

such as Microsoft’s Security Development Lifecycle, they have not been widely adopted.

According to Garfinkel, most companies view IT as a cost or product rather than as an

enabling technology, with Fortune 500 companies in 2011 spending $5.3 billion per year

on cyber security, stopping just 69% of all attacks. Organizations increased use of mobile

devices, cloud services, and Electronic Health Records (EHRs), and exploitation by

criminals to commit cyber crimes through handheld devices require organizations to

adequately address security and privacy concerns to deter cyber crime activity (Kotz, Fu,

Gunter, & Rubin, 2015). As the Internet continues to grow, so does the concern over

security threats inflicted by cyber attacks (NIST, 2015a, 2015b). Various researchers,

federal organizations, and commercial companies are working together to identify the

primary factors, which contribute to a secure business environment (FCC, 2014; NIST,

2015a, 2015b).

Emerging Technologies

SME owners are predominantly disadvantaged in protecting their infrastructures

against cyber attacks (SBA, 2014; SEC, 2015). Likewise, Shackelford et al. (2015)

reported 80% of owners of small firms do not have established cyber security policies.

The damage inflicted by recent cyber attacks demonstrates SME owners should

proactively create cyber security strategy plans (SBA, 2014). Strategic planning elements

should include how organizations can leverage emerging technologies to assist with their

strategic visions and risk assessments (NIST, 2015b).

Developers of home electronic devices deploy cyber technology ranging from the

traditional (laptops and desktops) to televisions, toys, appliances, and home automation

systems (Denning, Kohno, & Levy, 2013). By leveraging the latest technological

inventions, criminals have accessed individuals’ home video and audio feeds, unlocked

doors, disabled home security systems, tampered with home healthcare devices, and

interfered with home appliances and utilities (Denning et al., 2013). Items as

insignificant as a bathroom scale are subject to remote data retrieval by unauthorized

access (Denning et al., 2013).

Cyber criminals are using society’s thirst for technology to plan their crimes by

identifying houses with expensive and easily resold items (Denning et al., 2013). The

creation of wireless systems technology provides another vulnerability to enable tracking

and reporting (Denning et al., 2013). Criminals are targeting modern homes because they

now contain a wide range of new technology capabilities, and hackers can tap into these

new technologies relatively undetected (Denning et al., 2013). Moreover, criminals have

compromised police cruisers by hacking into their onboard computer systems and

streaming live video feeds as officers responded to incidents (Denning et al., 2013).

Financial crime committed in the cyber financial world is an emerging threat,

particularly in online gaming where committing fraudulent activities goes virtually

undetected (Keene, 2012). Moreover, due to lack of legislation and regulation, criminals

are able to conceal real life crimes like fraud, identity theft, and money laundering using

virtual worlds (FBI, 2013b; Keene, 2012). In cyber virtual worlds, users pay with

genuine currency to modify their characters (Keene, 2012). Online gamers who

converted their virtual dollars into genuine currency spurred several recent financial

crimes (FBI, 2013b; Keene, 2012). Both the FBI (2013b) and Keene (2012) reiterated the

need to establish legislative or regulatory clarification of the ambiguous lines between

virtual and real-life environments since virtual environments continue to be an

unmonitored criminal safe haven.

Developers of the emerging augmented reality (AR) glasses industry have created

additional cloud computing security issues (Hyman, 2013a). AR glasses are wearable

computer devices developed by Google Glass, Microsoft Corporation, and Apple

Incorporated with an expected industry market of $240 billion (Hyman, 2013a). Hyman

(2013a) reported the concept behind AR glasses is to capture and collect everything you

see and say and backup or save the data to cloud storage in real time. Subsequently,

search engine giants like Google or Bing could buy the data to assist their respective

companies with advertising (Hyman, 2013a). Security experts are concerned about the

amount of data sold to third parties, as well as the issue of saving and backing up real

time data to the cloud, and predict a sharp increase in hacking along with the potential

unauthorized surveillance use of AR glasses affecting individuals’ rights (Hyman, 2013a).

Researchers are exploring and leveraging quantum mechanics to generate

potentially unhackable communications because of the cyber espionage committed by

Eric Snowden, a civilian contractor working for the National Security Agency [NSA]

(Mone, 2013). To achieve the goal, Laurie and Doctorow (2012) proposed using a

cryptographic protocol called sovereign keys (SK) instead of CAs, while Mone (2013)

recommended using quantum cryptography utilizing photons in communication protocols

versus the public-key cryptography. Financial institutions and various government

entities are also evaluating future uses for quantum cryptography (Mone, 2013). Laurie

and Doctorow encouraged browser vendors to adopt cryptographic protocols as a new

security mechanism with the intention of creating a safer Internet environment.

Security awareness and malware identification are critical components to prevent

cyber attacks and cyber crimes (Huang, 2013; Tchakounté, 2014). Tchakounté (2014)

reported malware, viruses, and spyware are prevalent on computers, and currently

infiltrating the operating systems, which support tablets and mobile devices. Huang

(2013) articulated the botnet is one of the most notorious threats to Internet users.

Likewise, Jang-Jaccard and Nepal (2014), Nagunwa (2014), and Prayudi and Yusirwan

(2015) reported malware is one of the most serious threats associated with cyber security.

Nagunwa (2014) reported 556 million global online consumers were victims in

more than 30 million hacking activities yielding economic losses exceeding $110 billion.

Brute force, malware botnets, and web app attack are the prominent types of cyber attacks

in the cloud environment (Singh, 2014). Nagunwa reported Trojans are the most

deployed malware by phishers, accounting for 77% of all malware attacks whereby

phishers install malware to steal credentials or link the host system to a botnet. Botnets

have globally infected hundreds of millions of computers without the owners’ knowledge

(MacEwan, 2013; Nagunwa, 2014; Singh, 2014). Botnets infected with malware and

malicious software have been increasing in numbers, are becoming more sophisticated,

are extremely difficult to detect, and are almost impossible to stop (Jang-Jaccard &

Nepal, 2014; MacEwan, 2013; Nagunwa, 2014).

Moreover, the botnet malicious invasion will continue to adversely impact SME

owners who fail to recognize the threats and implement proper security strategies

(MacEwan, 2013). The Stuxnet malware spied on and invisibly changed data for years

hiding the cause of the Iran nuclear weapons centrifuge failures (Bambauer, 2013).

Sophisticated malware succeeded where diplomacy and threats of military force failed

(Bambauer, 2013).

Malware is often a mechanism for cyber criminal activities because malware

characteristics usually elude most forensics experts’ detection and analysis methods

(Prayudi & Yusirwan, 2015). Prayudi and Yusirwan (2015) reported an infected

application could potentially affect thousands of devices prior to its discovery. To combat

malware exposure, computer, tablet, and mobile users must become more knowledgeable

about protecting their devices, invoke limited permission grants by not allowing the

applications to access sensitive user information, and prevent exposure to cyber criminal

activities (Tchakounté, 2014).

Business owners must find security critical computer bugs, more commonly

known as software errors or flaws, in a computer program or system before hackers and

cyber terrorists exploit the breached systems (Avgerinos et al., 2014). Likewise, NIST

(2015a, 2015b) recommended business owners keep cyber security as a top priority as

they explore opportunities created by mobile and cloud computing particularly since the

proliferation of mobile devices connecting business networks has expanded the number

of potential targets for cyber attacks. SME owners whose core competencies do not

include IT can benefit from cloud sourcing, since they can essentially outsource their IT

to an external provider (Dillon & Vossen, 2015). Additionally, cloud solutions are

attractive for a number of reasons including ease of use, pricing, availability, scalability,

and reliability (Dillon & Vossen, 2015). Implementing preventative solutions will help

SME owners reduce risk exposure and possible security breaches (NIST, 2015a, 2015b).

Recent trends of unethical Internet activity reflect instances where the social

media incited hatred and unrest, especially against government and law enforcement

authorities (Salman, Saad, & Ali, 2013). Jang-Jaccard and Nepal (2014) maintained the

exponential growth of the global Internet interconnections has led to an increased number

of cyber attacks. There is a need for government authorities to develop a set of guiding

principles to thwart unethical Internet abuse and law enforcement authorities to develop

methodology for legal enforcement (Salman et al., 2013).

SME owners have become a target for criminals looking to access sensitive data

because they have limited resources dedicated to information system security (SBA,

2014). The direct correlation to the finding is SME owners with no cyber security

policies are even more susceptible to exploitation (SBA, 2014). An SBA (2015) research

study encompassed four types of e-mail messages and correlated personal staff responses

to each message. The SBA (2015) reported each study participant was knowledgeable on

computer security yet still felt victimized by e-mail phishing and cyber exploitation

exercises. In addition, researchers conducting the study investigated information

assurance issues with SME owners to determine if there were any relationships between

leadership styles and security policies enabling SME owners to prevent cyber crime

activity (SBA, 2015). Researchers concluded SME owners needed to broaden their

leadership styles to find cost-effective approaches to preventative measures (SBA, 2015).

Cyber attackers can gain access to networked or wireless items from anywhere on

the Internet further substantiating the requirement for intrusion detection systems (IDS) to

detect intruders and prevent cyber attacks (Kim & Park, 2013; Raza et al., 2013).

Researchers reviewed and analyzed achieving maximum security results by implementing

SVELTE, a new IDS, which claims to detect all malicious nodes on

Internet Protocol version 6 (IPv6) over Low-power Wireless Personal Area Network

(6LoWPAN) networks (Raza et al., 2013). Julisch (2013) reported anomaly detection

systems are incredibly powerful tools for gaining situational awareness by reporting

deviations from normal behavior rules and policies. Additionally, B. H. Kim and Park

(2013) proposed a control system using a DNS firewall, which provides random client

access to the site for acts, which can block potential intrusion concerns thus reducing

abnormal packets by 14%.

Cyber crimes. In the past criminals were able to go into businesses with guns

and demand money. Today, criminals also digitally steal data. The tools and techniques

for launching future cyber warfare attacks are the same as for cyber crime; however, the

motives differ from political conflicts, undercover activities, and propaganda campaigns

to financial objectives (FBI, 2015a, 2015b).

Kshetri (2013) discussed cyber attacks in China where there are more than 538

million Internet users and reported 45% were victims of malware attacks, 22% had their

online accounts hacked, and 8% were victims of scammers. Symantec Corporation

reported in their latest 2013 study that cyber crimes cost companies $110 billion a year,

whereas MacAfee, Symantec’s closest competitor, reported cyber crimes were 10 times

more than what Symantec Corporation reported costing companies over one trillion

dollars a year (Hyman, 2013b; Symantec Corporation, 2013). Although these studies

reflect the exponential increase in cyber crimes and reinforce the requirement for SME

owners to develop effective and preventative strategies, Bambauer (2013) recommended

a different approach requiring the federal government to combine funding and legal

mandates to push firms to redesign their computer systems.

Computer security. Cyber crime losses in 2012 were more than $100 billion

annually and increasing, and Filshtinskiy (2013) argued criminals are more likely to

commit crimes by selling their services via cyber criminal employment portals than by

foreign adversaries paying hackers to infiltrate websites for national secrets. For

example, (a) hackers’ rates for a DoS on a website ranged from $50 to $500 per day; (b)

hacking into a private e-mail address ranged from $30 to $50 per address; (c) hacking

into databases with backdoor passwords sold for $250; and (d) hackers who sold their

own custom malware for initial application plus monthly consultation fees, maintenance,

and support charged $1,500 (Filshtinskiy, 2013). Additionally, a person does not have to

be a criminal or hacker to inflict cyber losses--a skilled project manager within a

company could easily profit from and inflict untold financial harm from cyber

employment portals (Hua & Bapna, 2013).

Researchers have conducted several studies to determine whether there are

common characteristics motivating hackers’ behaviors, how hackers get started, and how

and why they evolve from innocent behavior to criminal acts (Xu et al., 2013). Research

reports stated the epidemic of computer hacking is a direct result of advances in computer

networking technologies, such as the Internet, and extensive use of computers throughout

society (Xu et al., 2013). Some computer hackers simply do not start out as delinquents

or social deviants but often as curious and respected students fascinated by computers

who transform into hackers by association with like-minded peers, accepted tolerance by

teachers and school administrators, and their abilities to penetrate software barriers (Xu et

al., 2013).

In fact, the only reliable differentiators Xu et al. (2013) found between grey hat

and black hat hackers appeared to be their moral values and judgment. The

Communications of the ACM (CACM) Staff (2013) extended Xu et al.’s research by

discovering additional hacker motivations and concluded malicious hacking motivations

have not changed since the 1960s. Malicious hackers intended to achieve their goals

through mischievous means by causing harm to others, and some young hackers are

looking for shortcuts to very profitable careers without having to attend formal schooling

(CACM Staff, 2013). Likewise, younger participants were more likely to engage in both

hacking and malware-related behaviors, suggesting there may be an age-crime curve

relationship present for cybercrimes (Chua & Holt, 2016).

Additionally, Chua and Holt (2016) conducted a study to determine whether there

are relationships between the techniques of neutralization focused on rationalizing action

and neutralizing guilt, computer hacking, and malware use behaviors amongst college

students from South Africa, Taiwan, and the U. S. Chua and Holt (2016) discovered the

relationship between all three techniques of neutralization were significantly associated

with both simple hacking and malware-related behaviors. These discoveries validate the

need to develop and utilize preventative measures to combat these behaviors to influence

and transform hackers’ behavioral motivations from causing harm.

Security awareness. Security awareness in the cyber environment enables

organizations to make better decisions to protect their data. Cyber crimes have increased

at an alarming rate resulting in devastating impacts on the national security and economy

(FBI, 2013a). Widespread exposure provides hackers access to individual and company

sensitive information to achieve criminal gains (Grossman, 2013). The reality is while

regulation is a necessary part of the legal system, cyber space regulations must be flexible

and adaptable to address opposing threats (Bambauer, 2013).

Researchers evaluated seven articles related to situational crime prevention and

routine activity theory and their application to issues of organized crime and terrorism

(Kleemans, Soudijn, & Weenink, 2012). Special characteristics and motivation explain

organized crime activity, and investigators use situational crime analysis to help identify

circumstances, which facilitate crime (Kleemans et al., 2012). Imposing situational

analysis on organized crime efforts generates opportunities for crime prevention, and

criminal investigators are essential to preventing organized crime and terrorism activity

(FBI, 2015a).

Son and Jeong (2013) discussed society’s increasing utilization and dependency

on the Internet and the dangers associated with intrusion threats by computer hacking,

malicious code, and viruses. Users must learn hacking principles to recognize security

threats and potentially prevent a cyber hack (Hong, Kang, Kim, & Park, 2013). Business

owners are especially vulnerable and defenseless when exposed to cyber attacks if they

host their data on a third-party’s single server (Son & Jeong, 2013).

Egele et al. (2012) provided a comprehensive overview of malware and different

analysis techniques users can implement to prevent potential malware threats on their

computers and mobile devices. Malware is software, which is deliberately harmful upon

attack and includes multiple types, such as a worm, virus, bot, spyware, rootkit, and a

Trojan horse, each with the ability to hide certain information and wreak havoc on user

systems (Egele et al., 2012). Antivirus vendors commonly receive thousands of

malicious samples daily as malware threats and attacks increase (Egele et al., 2012;

Tchakounté, 2014). These exploitations usually result in significant loss of information

and data and potentially pose serious financial loss.

The most common malware attacks result from weak remote administration or

VPN authentications (Bodhani, 2013). Business owners could mitigate against zero-day

malware attacks by using a new emerging technology called whitelisting (Shahzad,

Hussain, & Khan, 2013). The whitelisting technique is simple and lightweight, leverages

existing blacklisting techniques, and allows legitimate services, processes, websites, and

trusted applications to run on a selected device while preventing other threats (Shahzad et

al., 2013).

Hackers use millions of malicious web links to distribute and propagate malware

over the Internet, and traditional security technologies are limited in their capability to

mitigate malware issues (Chang, Venkatasubramanian, West, & Lee, 2013; Tchakounté,

2014). Chang et al. (2013) reported researchers analyzed various web based malware

attacks to determine the type of attack model, the cause, and the vulnerabilities, which

enabled the attack. The research analysis identified three categories to analyze, identify,

and defend a malware infection each with its own advantages and disadvantages, which

are dependent upon the selected implementation strategy (Chang et al., 2013).

Many well-known companies are in the forefront against computer hacking

attacks and threats (Sheldon & McDonald, 2012). Motivated individuals and groups have

also begun targeting high-profile Internet companies and their websites thus exposing

security flaws. The highly publicized Sony attack illustrated new security hacking

dangers when hackers obtained Sony user data comprised of Sony PS3 usernames,

passwords, bank accounts, and credit card numbers (Sheldon & McDonald, 2012).

Conversely, Sony reported encrypting users’ credit card data, but their passwords were

not encrypted placing customers who reused the same passwords on other sites in

jeopardy (Bambauer, 2013). Additionally, Bambauer (2013) reported Sony received a

backlash from users since they did not immediately notify users of the data breach.

Investigators assessed U.S. Fortune 500 corporations’ retail e-commerce security

status using quantitative analysis to identify their strengths and weaknesses for

improvement (Zhao & Zhao, 2012). Investigators used content analysis, information

security auditing, and network security mapping for data collection and analysis, which

indicated most sites posted security policies; however, only one-third provided details on

which security measures were implemented (Zhao & Zhao, 2012). Additional data

analysis revealed many of the e-commerce sites secured user My Account login with

Secure Sockets Layer (SSL) encryption but only 16% invoked lockout after using three

failed attempts (Zhao & Zhao, 2012). Although the e-commerce sites had most of their

Internet ports filtered or behind firewalls, almost one-third of the e-commerce sites’

computer operating systems were detected from several open ports, enabling security

breaches or holes to be exploited by cyber attackers (Zhao & Zhao, 2012).

Moreover, Haichang, Wei, Fei, and Licheng (2013) reported the results of a study

focused on security aspects of existing graphical password schemes, proposed

enhancements for two-factor authorization, and examples of current cyber attack

methods. Researchers categorized existing graphical password schemes into four types

based on authentication style, and provided a comprehensive introduction and security

analysis for each scheme. Additionally, researchers categorized known attack methods

into two types, and based on phishing, pharming, or spyware attack, summarized security

password schemes used to achieve cyber attacks (Haichang et al., 2013).

Geer (2013) discussed his view about society’s global dependency on the Internet

and the quest for real time instant information. The Internet, phones, tablets, watches,

and a multitude of products are dependent upon technological availability and reliability.

Geer argued 90% of the U.S. population has become dependent on the Internet and the

embedded services requiring the need to ensure some level of manual capability to

continue normal operations. In case of a catastrophic event, data users must have a

contingency plan to recover their information.

Goldsborough (2012) stated there are multiple storage solutions, such as external

hard drives, universal serial bus (USB) devices, compact disk-read only memory

(CDROM) disks, and several cloud providers who provide free cloud backup and storage.

Despite having multiple solutions available, Goldsborough argued one of the biggest

concerns is for users to utilize the available solutions. The Internet is considered critical

to the global infrastructure and yet is not adequately protected (Geer, 2013; The White

House, 2014).

Fraudsters are business people who commit fraud for a living and are prepared to

invest time and money to create conditions where they can implement fraudulent

activities because the benefits are enormous (Yelland, 2013). Fraud methodologies will

always exist; the method of attempting to thwart them needs exploitation. Most people

think of mobile fraud as having a cell phone stolen or hacked; however, Yelland (2013)

identified seven types of basic fraud typically occurring in mobile networks. Businesses

lose approximately $60 billion a year due to fraud and lack of effective revenue

protection, which dwarfs in comparison to the issues around personal security, which

network operators suffer and often fail to acknowledge (Filshtinskiy, 2013; Yelland,

2013). Consumer advocacy groups promote increasing user and business awareness and

taking steps to reduce risk exposure (DHS, 2015a; FCC, 2014; SBA, 2014).

White hat hackers or crackers are individuals who break into computer security

systems, not for malicious nor personal gain, to identify security weaknesses and

vulnerabilities within computer systems (Fulton, Lawrence, & Clouse, 2013). Employers

are searching for college graduates who possess specific technical and social skills to

enter the cyber industry career field (Fulton et al., 2013). The thousands of cyber attacks

occurring daily highlight the need for a workforce with the requisite skills and sufficient

size to meet the growing demands (Burley, Eisenberg, & Goodman, 2014).

Global technology is a valuable commodity to people, businesses, and

governments (The White House, 2015b). Although the Internet has transformed the

entire global society by enabling information sharing and spurring economic prosperity,

cyber criminals continue to find creative ways to penetrate laptops, phones, and computer

networks resulting in numerous cyber security attacks and thefts (Tchakounté, 2014).

The key to effective cyber security is the management of organizational risk (FBI, 2014,

2015c). Companies should invest in securing their data to prevent financial loss due to

network hacking and security breaching by users whose sole purpose is to gain access

based on a user’s or system’s weakness (DHS, 2015a; FBI, 2015c).

Hackers have unlimited access to the Internet via compromised computers

because the bogus certificates appear to be authentic (Laurie & Doctorow, 2012). SME

owners are particularly vulnerable to cyber attacks, must be knowledgeable of potential

attack areas, and develop strategies to mitigate inadvertent company exposure to cyber

attacks (SBA, 2014, 2015). The global economy depends on effective cyber security

strategies to ensure individuals’, businesses’, and global governments’ infrastructure

assets remain secure (FBI, 2015a; Shackelford et al., 2015). While multiple factors

influence SME owners’ decisions to establish and implement cyber security protection

strategies and implementation plans, the literature review substantiates the need for SME

owners to be aware of cyber security threats, then develop and implement effective

strategies and preventative measures to combat cyber crimes and ensure their continued

success.

Transition

Section 1 was an introduction, which described the background of the doctoral

study of cyber security attack phenomena, and preventative measures SME owners

employed to hinder cyber attacks. Section 1 encompassed 12 major elements, which

provided the doctoral study’s overall foundation and scope. Critical areas within the

section included a background of the problem; the problem statement; the purpose

statement; nature of the study; research questions; conceptual framework; operational

terms; assumptions; limitations; delimitations; the significance of study; and

summarization of professional and scholarly works of literature.

Cyber attacks have many forms ranging from hacking, viruses, and Trojan horses,

to worms on desktops, tablets, mobile devices, automobiles, and home appliances. The

global economy depends on effective cyber security strategies to ensure individuals’,

businesses’, and global governments’ infrastructure assets remain secure (FBI, 2015a;

Shackelford et al., 2015). Cyber crimes have no boundaries fueling cyber criminal

activities, and potential occurrences for cyber attacks grow daily (FBI, 2015a). Security

awareness, prevention, and proactive actions can mitigate and possibly alleviate future

cyber attacks on small businesses.

Section 2 restates the purpose statement; provides new subsections expanding on

the roles of the researcher and participants; the research method and design; population

and sampling criteria; ethical research criteria; data collection instrument and techniques;

data organization and analysis methodologies; reliability and validity criteria

mechanisms; and transitions into Section 3. Section 3 provides the detailed data

collection analysis of the multicase doctoral study.

Section 2: The Project

Cyber security experts have reported that incidences of cyber crimes are on the

rise and increasing daily as savvy and persistent information communication attackers

find creative ways to penetrate laptops, phones, computer networks, and anything

considered a wired device (FCC, 2014; Gootman, 2016). My objective in this study was

to explore the effective cyber security strategies SME owners utilized and how these

activities potentially reduced cyber threats.

Purpose Statement

The purpose of the qualitative multicase study was to explore effective strategies

SME owners used to protect their businesses from cyber attacks. The specific population

consisted of four SME owners operating in the Melbourne, Florida area who utilized the

Internet for business operations. Additional selection criteria for the study required that

SME owners (a) were licensed to operate a retail business in Melbourne, Brevard County,