Skip to main content
SpringerLink
Log in

SMEs’ Confidentiality Concerns for Security Information Sharing

  • Conference paper
  • First Online:
Human Aspects of Information Security and Assurance (HAISA 2020)

Part of the book series: IFIP Advances in Information and Communication Technology ((IFIPAICT,volume 593))

Abstract

Small and medium-sized enterprises (SME) are considered an essential part of the EU economy; however, highly vulnerable to cyber-attacks. SMEs have specific characteristics which separate them from large companies and influence their adoption of good cybersecurity practices. To mitigate the SMEs’ cybersecurity adoption issues and raise their awareness of cyber threats, we have designed a self-paced security assessment and capability improvement method, CYSEC. CYSEC is a security awareness and training method that utilises self-reporting questionnaires to collect companies’ information about cybersecurity awareness, practices, and vulnerabilities to generate automated recommendations for counselling. However, confidentiality concerns about cybersecurity information have an impact on companies’ willingness to share their information. Security information sharing decreases the risk of incidents and increases users’ self-efficacy in security awareness programs. This paper presents the results of semi-structured interviews with seven chief information security officers (CISOs) of SMEs to evaluate the impact of online consent communication on motivation for information sharing. The results were analysed in respect of the Self-Determination Theory (SDT). The findings demonstrate that online consent with multiple options for indicating a suitable level of agreement improved motivation for information sharing. This allows many SMEs to participate in security information sharing activities and supports security experts to have a better overview of common vulnerabilities.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD 54.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Cranor, L.F.: A framework for reasoning about the human in the loop. In: 1st Conference on Usability, Psychology and Security. San Francisco, CA, USA (2008)

    Google Scholar 

  2. Shojaifar, A., Fricker, S., Gwerder, M.: Elicitation of SME requirements for cybersecurity solutions by studying adherence to recommendations. In: REFSQ Workshops (2018)

    Google Scholar 

  3. Lewis, R., Louvieris, P., Abbott, P., Clewley, N., Jones, K.: Cybersecurity information sharing: a framework for sustainable information security management in UK SME supply chains. In: Proceedings of the European Conference on Information Systems (ECIS) (2014)

    Google Scholar 

  4. Ryan, R.M., Deci, E.L.: Self-determination theory and the facilitation of intrinsic motivation, social development, and well-being. Am. Psychol. 55(1), 68–78 (2000)

    Article  Google Scholar 

  5. Deci, E.L., Connell, J.P., Ryan, R.M.: Self-determination in a work organisation. J. Appl. Psychol. 74(4), 580–590 (1989)

    Article  Google Scholar 

  6. Christopherson, K.M.: The positive and negative implications of anonymity in Internet social interactions: ‘‘On the Internet, Nobody Knows You’re a Dog’’. Comput. Hum. Behav. 23(6), 3038–3056 (2007)

    Article  Google Scholar 

  7. Deci, E.L., Ryan, R.M.: Intrinsic Motivation and Self-determination in Human Behaviour. Plenum Publishing Co, New York (1985)

    Book  Google Scholar 

  8. Gefen, D.: E-Commerce: The role of familiarity and trust. Omega 28(6), 725–737 (2000)

    Article  Google Scholar 

  9. Robinson, N., Disley, E.: Incentives and challenges for information sharing in the context of network and information security. In: European Network and Information Security Agency (ENISA) (2010)

    Google Scholar 

  10. Yin, R.K.: Case Study Research: Design and Methods. Sage, Thousand Oaks, CA (2009)

    Google Scholar 

  11. Furnell, S.M., Gennatou, M., Dowland, P.S.: A prototype tool for information security awareness and training. Log. Inf. Manag. 15(5/6), 352–357 (2002)

    Article  Google Scholar 

  12. Muller, P., Julius, J., Herr, D., Koch, L., Peycheva, V., McKiernan, S.: Annual report on European SMEs 2016/2017: Focus on self-employment. European Commission (2017)

    Google Scholar 

  13. Gupta, A., Hammond, R.: Information systems security issues and decisions for small businesses. Inf. Manag. Comput. Secur. 13(4), 297–310 (2005)

    Article  Google Scholar 

  14. Runeson, P., Höst, M., Rainer, A., Regnell, B.: Case Study Research in Software Engineering - Guidelines and Examples. Wiley, Hoboken (2012)

    Book  Google Scholar 

  15. Choo, K.-K.R.: The cyber threat landscape: Challenges and future research directions. Comput. Secur. 30(8), 719–731 (2011)

    Article  Google Scholar 

  16. West, R.: The psychology of security. CACM 51(4), 34–40 (2008)

    Article  Google Scholar 

  17. Kurpjuhn, T.: The SME security challenge. Comput. Fraud Secur. 2015(3), 5–7 (2015)

    Article  Google Scholar 

  18. Gal-Or, E., Chose, A.: The economic incentives for sharing security information. Inf. Syst. Res. 16(2), 186–208 (2005)

    Article  Google Scholar 

  19. Rhee, H., Kim, C., Ryu, Y.: Self-efficacy in information security: It’s influence on end users’ information security practice behavior. Comput. Secur. 28(8), 816–826 (2009)

    Article  Google Scholar 

  20. Puhakainen, P., Siponen, M.: Improving employees’ compliance through information systems security training: an action research study. MIS Q. 34(4), 757–778 (2010)

    Article  Google Scholar 

  21. Bedrijfsrevisoren, D., Muynck, J.D., Portesi, S.: Cyber security information sharing: An overview of regulatory and non-regulatory approaches. In: The European Union Agency for Network and Information Security (ENISA) (2015)

    Google Scholar 

  22. Beebe, N.L., Rao, V.S.: Examination of organizational information security strategy: A pilot study. In: Americas Conference on Information Systems (AMCIS), USA (2009)

    Google Scholar 

  23. Birkás, B., Bourgue, R.: EISAS-european information sharing and alerting system. In: European Union Agency for Network and Information Security (2013)

    Google Scholar 

  24. Osborn, E.: Business versus technology: Sources of the perceived lack of cyber security in SMEs. In: The 1st International Conference on Cyber Security for Sustainable Society (2014)

    Google Scholar 

  25. Hosmer, L.T.: Trust: The connecting link between organisational theory and philosophical ethics. Acad. Manag. Rev. 20(2), 379–403 (1995)

    Article  MathSciNet  Google Scholar 

  26. Yoon, C., Rolland, E.: Knowledge-sharing in virtual communities: familiarity, anonymity and self-determination theory. Behav. Inf. Tech. 31(11), 1133–1143 (2012)

    Article  Google Scholar 

  27. Vallerand, R.J.: Toward a hierarchical model of intrinsic and extrinsic motivation. Adv. Exp. Soc. Psychol. 29, 271–360 (1997)

    Article  Google Scholar 

  28. Chang, H.H., Chuang, S.: Social capital and individual motivations on knowledge sharing: Participant involvement as a moderator. Inf. Manag. 48(1), 9–18 (2011)

    Article  Google Scholar 

  29. Deci, E.L., Ryan, R.M.: The General Causality Orientations Scale: Self-determination in personality. J. Res. Pers. 19(2), 109–134 (1985)

    Article  Google Scholar 

  30. Geer Jr., D., Hoo, K.S., Jaquith, A.: Information security: Why the future belongs to the quants. IEEE Secur. Priv. 1(4), 24–32 (2003)

    Article  Google Scholar 

  31. European Commission. What is an SME? https://ec.europa.eu/growth/smes/business-friendly-environment/sme-definition_en

Download references

Acknowledgments

This work has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreements No. 740787 (SMESEC), No. 883588 (GEIGER), and the Swiss State Secretariat for Education‚ Research and Innovation (SERI) under contract number 17.00067. The opinions expressed and arguments employed herein do not necessarily reflect the official views of these funding bodies.

Author information

Authors and Affiliations

  1. FHNW, IIT, 5210, Windisch, Switzerland

    Alireza Shojaifar & Samuel A. Fricker

  2. Department of Information and Computing Sciences, Utrecht University, Utrecht, The Netherlands

    Alireza Shojaifar

  3. Blekinge Institute of Technology, SERL-Sweden, 37179, Karlskrona, Sweden

    Samuel A. Fricker

Authors
  1. Alireza Shojaifar
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Samuel A. Fricker
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Alireza Shojaifar .

Editor information

Editors and Affiliations

  1. University of Plymouth, Plymouth, UK

    Nathan Clarke

  2. University of Plymouth, Plymouth, UK

    Steven Furnell

Rights and permissions

Reprints and permissions

Copyright information

© 2020 IFIP International Federation for Information Processing

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Shojaifar, A., Fricker, S.A. (2020). SMEs’ Confidentiality Concerns for Security Information Sharing. In: Clarke, N., Furnell, S. (eds) Human Aspects of Information Security and Assurance. HAISA 2020. IFIP Advances in Information and Communication Technology, vol 593. Springer, Cham. https://doi.org/10.1007/978-3-030-57404-8_22

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-57404-8_22

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-57403-1

  • Online ISBN: 978-3-030-57404-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Societies and partnerships

Search

Navigation