A Threat-Based Cybersecurity Risk Assessment Approach Addressing SME Needs

International Conference on Availability, Reliability and Security (ARES), pp. 1–12

Abstract

Cybersecurity incidents are commonplace nowadays, and Small- and Medium-Sized Enterprises (SMEs) are exceptionally vulnerable targets. The lack of cybersecurity resources available to SMEs implies that they are less capable of dealing with cyber-attacks. Motivation to improve cybersecurity is often low, as the prerequisite knowledge and awareness to drive motivation is generally absent at SMEs. A solution that aims to help SMEs manage their cybersecurity risks should therefore not only offer a correct assessment but should also motivate SME users. From Self-Determination Theory (SDT), we know that by promoting perceived autonomy, competence, and relatedness, people can be motivated to take action. In this paper, we explain how a threat-based cybersecurity risk assessment approach can help to address the needs outlined in SDT. We propose such an approach for SMEs and outline the data requirements that facilitate automation. We present a practical application covering various user interfaces, showing how our threat-based cybersecurity risk assessment approach turns SME data into prioritised, actionable recommendations.

Authors 6

1. Max van Haastrecht

   Utrecht University

   Affiliation as printed

   Utrecht University, Netherlands

2. Injy Sarhan

   Utrecht University · Arab Academy for Science, Technology, and Maritime Transport

   Affiliation as printed

   Utrecht University; Arab Academy for Science, Technology and Maritime Transport (AASTMT), Netherlands

   Utrecht University

3. Alireza Shojaifar

   FHNW University of Applied Sciences and Arts Northwestern Switzerland

   Affiliation as printed

   Fachhochschule Nordwestschweiz (FHNW), Switzerland

4. Louis Baumgartner

   FHNW University of Applied Sciences and Arts Northwestern Switzerland

   Affiliation as printed

   Fachhochschule Nordwestschweiz (FHNW), Switzerland

5. Wissam Mallouli

   Montimage (France)

   Affiliation as printed

   Montimage, France

6. Marco René Spruit Aachen

   Leiden University · Utrecht University · Leiden University Medical Center

   Affiliation as printed

   Leiden University Medical Centre (LUMC); Leiden University; Utrecht University, Netherlands

   Leiden University

   Utrecht University, Netherlands