# The Good, The Bad and The Missing: A Narrative Review of Cyber-security
Implications for Australian Small Businesses

Tracy Tam, Asha Rao and Joanne Hall

(RMIT University,
124 Latrobe St,
Melbourne 3000,
Australia.)

###### Abstract

Small businesses (0-19 employees) are becoming attractive targets for cyber-
criminals, but struggle to implement cyber-security measures that large
businesses routinely deploy. There is an urgent need for effective and
suitable cyber-security solutions for small businesses as they employ a
significant proportion of the workforce.

In this paper, we consider the small business cyber-security challenges not
currently addressed by research or products, contextualised via an Australian
lens. We also highlight some unique characteristics of small businesses
conducive to cyber-security actions.

Small business cyber-security discussions to date have been narrow in focus
and lack re-usability beyond specific circumstances. Our study uses global
evidence from industry, government and research communities across multiple
disciplines. We explore the technical and non-technical factors negatively
impacting a small business’ ability to safeguard itself, such as resource
constraints, organisational process maturity, and legal structures. Our
research shows that some small business characteristics, such as agility,
large cohort size, and piecemeal IT architecture, could allow for increased
cyber-security.

We conclude that there is a gap in current research in small business cyber-
security. In addition, legal and policy work are needed to help small
businesses become cyber-resilient.

Keywords: Cyber-security, Small Business, SME, Security Culture, Literature
Review

##  1 Introduction

Businesses around the world are under pressure to use and adopt technology,
with the COVID-19 pandemic accelerating this need [1]. At the same time,
cyber-crimes are becoming increasingly sophisticated [2] with the Australian
Government [3] estimating the cost of cyber-crime to the Australian economy at
over AU$15 billion annually. Small businesses employ nearly half of the
Australian private sector workforce [4] and need to be supported against
cyber-criminals.

Anecdotes [5, 6, 7], industry [8, 2] and government [9] studies indicate that
small businesses and individuals are increasingly becoming cyber-crime
targets. A small business can lose data and customers, and incurs compliance
penalties from a cyber-security incident. These penalties include fines
greater of 4% of global turnover or 20 million for non-compliance to the
General Data Protection Regulation (GDPR) [10] in the European Union, and
levies up to US$1.8 million per violation [11] of HIPAA [12] in the US. In
Australia, most small businesses with less than AU$3 million turnover are
exempt from the Privacy Act [13], but this exemption may not remain in the
future [14, 15]. Beyond these penalties, the importance and practicalities of
small businesses preparing for and recovering from cyber-incidents are still
poorly articulated and communicated.

Previous research has considered the Australian small and medium enterprise
(SME) cyber-security situation from different perspectives. Valli et al [16]
survey Western Australian SMEs and call for cyber-security education for SMEs,
while Dojkovki et al. [17, 18, 19] highlight the influence of Australian
culture on SME cyber-security. Internationally, reviews of SME cyber-security
(albeit with different size definitions) emphasise ineffective security
management practices [20] and differences between SMEs and large corporations
[21, 22]. Other research offers global insights into culture [23], strategies
[24], policies [25] and specific technologies [26]. Several surveys on cyber-
security, for example [9, 27, 28], focus on self-reported data on cyber-
security from Australian SMEs.

This paper uses existing global research as well as evidence from multiple
disciplines to identify gaps and opportunities for Australian small business
cyber-security. We look in detail at the characteristics of Australian small
businesses that may be impeding their cyber-security posture. We find that
certain characteristics could help small businesses better secure themselves.

The definition we use here, of 0-19 employees, covers a significant proportion
of business communities around the world. In 2015, around 29 million US firms
employed 0-19 employees [29, 30], while in 2019, in the UK over 98% of private
sector businesses employed 0-49 people [31]. Thus, this research has relevance
to small businesses from other countries with similar societal profiles to
Australia [32, 33], since human owners run small businesses [34, 35].

This paper is structured as follows: In the next section we examine the
background to business cyber-security and the Australian small business
context. Section 3 looks at existing review articles and compares them to our
study. Section 4 discusses the difficulties in research and data collection
for small business cyber-security. Section 5 looks at the constraints faced by
small businesses in implementing cyber-security, while section 6 highlights
potential opportunities that unique small business characteristics present
with respect to cyber-security. We end with a conclusion and suggestions for
future work.

##  2 Background to Small Business Cyber-security

Small business cyber-security has some commonalities with large business
cyber-security. The traditional aim of cyber-security is to protect business
IT infrastructure, and the information essential for the business’ day to day
operations. However evidence has since emerged that the benefit of business
cyber-security extends beyond this, to its people, processes and assets.

The cyber-security industry is currently worth over US$100 billion globally
[36]. While cyber-security previously focused on maintaining the
confidentiality, integrity and availability [37] of information systems and
data, current best practice includes non-technical aspects such as the people
using the information (security culture) [38, 39]. A one-size-fits-all cyber-
security solution does not exist [40, 41, 42]. Large businesses have adopted a
variety of measures to secure their information and IT assets [43] against
cyber-security threats.

The benefits of securing a business extends beyond protecting the assets owned
directly by the business. The disruptions to individuals from data breaches
such as Equifax [44] and Ticketmaster [45] highlight the societal cost. The
financial cost of an incident can severely disrupt the personal lives of small
business owners, putting livelihoods in jeopardy [46]. The high level of
codependency between people, technologies and processes has resulted in modern
security standards/frameworks including “processes, organisational structures,
policies and procedures, information flows, culture and behaviors, skills and
infrastructure” [47, P.13].

###  2.1 The Australian Small Business Context

In Australia, over 40% of private sector employment is from micro (0-4
employees) and small (5-19 employees) businesses [4]. The Australian Bureau of
Statistics (ABS) defines a small business as one with 0-19 employees [48]. In
2016, 42% of Australian small businesses believed limiting online presence
protected their business [28]. In the 2018/19 financial year, only 40.3% of
small businesses received orders via the Internet111Note: This includes any
sale of services or goods that have been committed to/ordered via the
Internet. [49].

Technology avoidance is no longer a feasible strategy for managing cyber-
security risks. Online sales are becoming more attractive, influenced by
market forces and official bodies [50] with the social distancing requirements
of COVID-19 only hastening this [1, 51].

With nearly half of Australian small businesses allocating less than AU$500
annually to cyber-security [9], they cannot afford cyber-security expertise.
Without external help, small businesses cannot secure themselves, and not just
in times of emergency [52].

##  3 Existing Reviews

There is considerable literature, both academic and industry, on small and
medium business (or SME) cyber-security. Here we identify the literature
examining cyber-security challenges.

###  3.1 Search Method

A keyword search was conducted within 5 academic search engines, namely
Scopus, ProQuest, Science Direct, SpringerLink and IEEE Xplore. The keywords
used were kept broad to maximise the number of results returned and
constructed from the core concepts of “small business”, “cyber-security” and
“literature review”. These are listed below:

  1. 1.

Small business - “small business”, “small enterprise” or “SME”.

  2. 2.

Cyber security - Various spellings of “cyber-security”, “IT security” or
“information security”.

  3. 3.

Literature review - “review” or “survey” with “literature”

The keyword pertaining to “literature review” (3) was replaced with a search
filter of review articles where this option was offered by the database. Where
possible, the search was limited to title, abstract and keywords. To ensure
relevance to today’s context, the search was restricted to publications dated
on or after 2016. No filtering was done based on journal or conference
ranking.

Due to the general nature of the keywords, the initial searches returned a
total of 2759 papers. Each of these papers was examined to determine whether
the primary focus was small business (or SME) cyber-security. Most
importantly, we looked for papers that exclusively discussed their cyber-
security topic in a small business/SME context, rather than treating the
cohort as a sub-discussion. Based on this criteria 22 papers were shortlisted.
A detailed examination of these papers gave us one very relevant review paper
[20], and three partially relevant papers [21, 53, 26].

###  3.2 Comparing Research Aims

Table 1 compares the aims of our paper to the selected review papers, based on
the following contexts:
A Restricts context to small business. B Critical examines landscape of
existing small business cyber-security research. C Examines potential
technical issues with small business use of cyber-security solutions. D
Examines potential human issues for small business. E Identifies structural
opportunities for small businesses.

Table 1: Existing Literature, Reviews and Focus Comparison on Small Business
Cyber-security. (✓denotes areas addressed. ~denotes areas partially addressed.
Blank denotes areas not addressed.)
See page A for criteria used for comparison.  Paper |  Literature Type |  Focus |  A |  B |  C |  D |  E
---|---|---|---|---|---|---|---
Alahmari & Duncan [20] |  Academic |  Review |  |  |  |  ✓ |  ~
Heidt et al. [21] |  Academic |  IT Security Investment |  |  ~ |  |  |
Suryotrisongko & Musashi [53] |  Academic |  Cyber-security Research Taxonomy Review |  |  ~ |  |  ~ |
Salleh et al. [26] |  Academic |  Cloud Adoption in SME |  |  |  ~ |  |
Our Paper |  Academic & Industry |  Small Business Cyber-security |  ✓ |  ✓ |  ✓ |  ✓ |  ✓

From Table 1, the shortlisted reviews do not distinguish small business as a
separate cohort, despite the large proportion of small businesses present in
global economies. Small business is often grouped together with medium
businesses in the wider cyber-security context. In this article, we examine
the problems arising from such grouping.

Alahmari and Duncan [20] provide an overview of existing research on cyber-
security risk management within the SME cohort. They identify lack of
skills/knowledge, lack of appropriate management behaviours and sub-par
defence as common themes, but do not explore how such situations arise. In
this paper, we trace these symptoms back to possible contributing factors,
which could enable better security solutions.

Heidt et al. [21] point out that differences between SME and their larger
cousins potentially contributes to difficulties in generalising cyber-security
results to SMEs. They find that data is often obtained from non-representative
enterprises (e.g. larger or industry specific groups). We re-examine the
sampling issue within the industry context and find this trend extends beyond
academia to industry and government. Given the lack of industry standard
terminologies, we discuss how both cyber-security self-reporting and lack of
agreed definitions are contributing to confusion.

As demonstrated by Suryotrisongko & Musashi [53], there are a wide variety of
topic areas and technologies within the study of cyber-security. Reviews that
focus on specific topics [24, 23, 25, 26] provide little room for exploration
of alternative solutions, e.g. a technical problem solved via a process. In
this paper, we explore cross field opportunities in the context of small
business cyber-security.

In conclusion, there are no broad-based reviews exploring small business
organisational characteristics that can impact their cyber-security posture,
both negatively and positively. We address these gaps in this paper.

##  4 Research Data Challenges

Given the importance of micro/small business in global economies, there is
limited research into the cyber-security posture of, and corresponding
solutions for small businesses in the 0-19 employee range. While there is much
research in large enterprise cyber-security from various countries, the
transferability of this research to small business is problematic.

Each developed country is at a different stage in the small business cyber-
security research journey. In the USA, CISA (Cyber-security and Infrastructure
Security Agency) conducted an online survey in 2019, on providing assistance
with cyber-security issues, to small businesses [54], but results are still
awaited. In Europe, Eurostat breaks down enterprise size across multiple
variables in its most recent 2020 ICT Security in Enterprise security report
[55]. Businesses with 0-9 employees are excluded from the above Eurostat
report, highlighting the research data gap within the small business cohort.
This lack of inclusion also occurs in the Australian Bureau of Statistics’
business characteristics surveys [48]. These surveys ask IT and cyber-security
questions, but explicitly exclude non-employers/sole traders from the
respondent pool.

The cyber-security surveys conducted in Australia include:

  * •

The Australian Bureau of Statistics (ABS) annual business characteristics
survey asks detailed IT usage and cyber incident questions [48].

  * •

The NSW small business commissioner CyberAware survey studied SME cyber-
security [28] in 2017, in collaboration with various small business related
commissions around Australia.

  * •

The Australian Cyber Security Centre’s (ACSC) online survey in 2019, looked at
the usage of IT, security incidents and knowledge [9].

Each of the above surveys has its own focus, producing results within its own
scope. Some of these scopes overlap. Some results appear to contradict others.
For example, in answer to whether small businesses have encountered a
breach/attack/cyber-crime, the percentage of people that answered in the
affirmative varied based on the survey (Table 2).

Table 2: Small Business Self-Reported Breach Results. Source |  Percentage of respondents answering affirmative/neutral for experiencing breaches |  Reference
---|---|---
ACSC Small Business Survey |  62% |  [9]
Business Characteristics Survey |  Micro Businesses: 8.7% (+17.4% “Don’t know”) |  [48]
|  Small Businesses: 13.4% |
|  (+17.1% “Don’t know”) |

The discrepancies are not necessarily due to deliberate actions or errors.
They appear to be a symptom of the difficulty in reaching and obtaining
comparable data from the disparate and technically inexperienced cohort that
is small business.

Discrepancies in the survey results also extend past national borders. In the
Hiscox report [8], the average business cyber-security spend in European
countries for organisations with 9 or less employees was US$7,000. In
contrast, the ACSC survey [9] found close to half of Australian small
businesses spent less than AU$500 annually on cyber-security. This order of
magnitude difference in expenditure from seemingly similar socio-economic
cohorts requires further analysis. While there is speculation [56] that
complexity within the cyber-security field accounts for the disparity in
results, it is possible these are due to challenges in getting accurate data
from small businesses.

###  4.1 The Elusive Cohort

The inability to gather data from diverse small businesses is a significant
barrier to cyber-security research [16, 57, 58, 59, 22]. Consistently low
response rates to broad-based voluntary surveys highlight the difficulty in
obtaining a comprehensive sample. This is exacerbated by a lack of public
domain data, especially where mandatory breach reporting regulations are
immature. There is dis-incentive to self-reporting due to fear of reputational
damage [60], given the low possibility of prosecution [61, Fig 6.7].

This difficulty in reaching the small business cohort could result in
convenience sampling, which is known to introduce its own set of limitations
and challenges [62, 63]. The impact and bias arising from such sampling must
be accounted for and discussed in research findings.

###  4.2 Disparate Technical Terms

Numerous industry cyber-security reports address the gap in business cyber-
security [43, 64, 8, 2, 65]. However, there are few standard definitions,
structures and classifications within cyber-security. Data and findings are
often adhoc, incomplete and focused on headline worthy items. For example,
Symantec reports [2] that globally, in 2018, small and medium businesses were
more likely to be hit with “Formjacking”. Formjacking is Symantec’s term for
“use of malicious JavaScript code to steal credit card details and other
information from payment forms on the checkout web pages of e-commerce sites”
[2]. Formjacking is a subset of code injection attacks [66], where code is
injected for various purposes, and not just on e-commerce sites. The use of
specialised terms such as “formjacking” makes comparisons between different
reports difficult.

###  4.3 Size Does Matter

The differing definitions of small buisness worldwide makes data comparison
difficult, see Table 3.

[b]

Table 3: Small Business Definitions Around the World

Official Business Labels |  0 Employees |  Micro Business |  Small Business |  Sources
---|---|---|---|---
Australia |  Sole Traders |  0-4 |  5-19 |  [67]
UK |  No-Employee Business |  1-9 |  10-49 |  [68]
European Union1 |  Not Applicable |  0-9 |  10-49 |  [69]
US |  Not Applicable |  Not Applicable |  $<$250 or 1,500 or industry specific annual receipt2 |  [70]

  * 1

Prior to 2020, all European Union data includes the UK. Any data 2020 and
beyond, does not include UK statistics. Where relevant, this is noted in the
discussion.

  * 2

Industry dependent.

Each research entity adopts the local small business convention or presents a
brand new definition [58]. This disparity across the globe changes the context
of findings. Clearly, an organisation managing 200 employees operates and
communicates very differently to one with less than 10 employees [71, 72, 73].
Given the significant influence communication and human factors have on
attacks such as phishing, email fraud, etc, size matters in any cyber-security
discussion.

Few researchers acknowledge the potential complexity of the large range of
small business sizes. The Ponemon Institute’s data breach report [64]
extrapolates small business data breach costs from incident costs for
businesses employing 500-1000. This cost figure is discussed as the cost for
“smaller organisations”. The bundling of small businesses with larger (in
size) cohorts hampers the ability to action the lessons learnt.

###  4.4 Self-Reporting Fallacies

Self-reporting of data is another problem. The accuracy of self-reported
cyber-incidents by small business owners needs examining. Non-technical
persons find it difficult to report subtle cyber attacks. In addition, there
are psychological self-reporting biases [74, 75]. Thus, self-reported breaches
can only be a starting point data set for analysis.

Self-reporting surveys require business owners to be aware of cyber breaches.
Common detectable symptoms of an incident, from a non-technical user’s
perspective, are unavailability of computer systems or data. For example,
ransomware renders a computer unusable. Many attacks have no obvious symptoms.
Active monitoring is required for subtle attacks such as data ex-filtration,
man in the middle, spyware etc. System owners may not be aware of a breach for
months or even years [64, 76, 60]. While large enterprises can detect subtle
attacks using active traffic monitoring systems, few small businesses can
afford this monitoring [9]. The under-detection can be exacerbated by the lack
of technical knowledge among small business owners (see section 5.2).

In Australia, the Privacy Act, the main legislation governing data, does not
apply to organisations with less than AU$3 million annual turnover [13], i.e.
most Australian small businesses. As such there are no legislative
repercussions or financial incentives to report any breaches or cyber-
incidents. Embarrassment in victims of online fraud [77] is another powerful
reason for Australian small businesses not reporting incidents.

Symantec [2] avoids this self-reporting gap by using known threat detection
software installed within an end user’s computer. Eliminating human
interaction increases accuracy by recording incident details automatically.
However, the proprietary nature of this software and reporting results in only
Symantec customers and devices being included. This leads to a bias towards
people willing (and able) to pay for Symantec’s services. Detailed analysis
and strategy design requires a more comprehensive small business sector view.

In conclusion, alternative data collection strategies are needed to supplement
existing self-reporting surveys.

###  4.5 Business versus IT Perspectives

The under-representation of non-technical respondents in online surveys
deserves scrutiny. Studies targeting technically savvy businesses often reach
very different conclusions to those including a broader range.

Cyber-security research relies heavily on online surveys due to logistical
ease, and the assumption potential respondents use the internet for business
purposes. In contrast, less than 40% of Australian small and micro-businesses
used the internet for business development or monitoring market information in
the 2017-18 financial year [48].

Self-selection bias is enhanced by a particular group’s comfort level to a
survey method. More respondents are likely to complete surveys that use
familiar technology [78]. Cyber-security studies tracking industry breakdowns
show IT/technical industry respondents are over-represented [8, 28, 22].

Challenges exist around demographic representation in samples with online
surveys as the sole method of data collection. “Younger, male, avid Internet
users, and those with greater technological sophistication” [79] are more
likely to complete online surveys compared to surveys done via traditional
mail. In contrast, in 2016, over half of small business owners in Australia
were over 45 [80].

A survey with more technically literate respondents can introduce significant
biases in results. Studies with input from technical experts [17, 81, 82]
identified different concerns compared to general small business owners [83,
84, 85, 86]. A series of interviews from a single study [87] shows that small
scale IT users have constraints in security decision making that are not
expected by technical security providers. Australian small businesses in
information, media and telecommunication, and professional, scientific and
technical services categories made up less than 14% of all businesses, by
business count, in 2019 [88].

In summary, the majority of small business owners in Australia cannot be
assumed to intuitively understand the technical fundamentals central to cyber-
security. Exclusively sourcing data from voluntary online surveys favours
respondents comfortable with technology. Results from surveys must account for
and reconcile any gaps between sample respondents versus small business
profiles, from both demographic and technology literacy perspectives.

##  5 Challenges Faced by Small Businesses

Large enterprises have been amongst the earliest adopters of cyber-security
technologies. Current business cyber-security solutions favour these
businesses in terms of scale, cost and usage.

Today’s cyber-security lessons and conventions are a result of early large-
scale incidents e.g. NotPetya, Equifax, Wikileaks etc affecting mostly large
organisations. With new threats constantly emerging, large enterprises are
ideal customers for vendors, with a higher likelihood of return on investment.
Consequently cyber-security industry best practices, standards and products
are heavily influenced by the needs of larger organisations.

Small business cyber-security cannot be “cut and paste” from large scale
solutions. Resource availability, technical landscape and operational
processes of small business need careful consideration. Small businesses face
some common challenges that need to be accounted for in cyber-security
strategies since cyber-criminals are looking for smaller targets [2, 89, 90].

###  5.1 Technical Challenges

The technical landscape of a small business can potentially be very different
to that of a large enterprise [22], making it impractical to apply solutions
for the larger enterprises to smaller scale users. The small business IT
technical landscape (“architecture”) in which the cyber-security solution must
function is a barrier to adopting a solution.

Current industry practice tests changes in an environment separate from
customer-facing sites and systems to ensure the changes do not impact IT
system availability for live customers. A test or staging environment is a
copy that mirrors the customer-facing (“live”) business system in hardware,
software and configuration. Testing in a separate environment is recommended
by many application providers before software upgrade processes [91, 92]. This
testing ensures unintended consequences of changes/tests do not affect the
business’ live systems, keeping them “safe” and operational. A test
environment can be used to conduct destructive testing such as disaster
recovery scenarios.

Cyber-security solutions designed to test a response to debilitating events
require a safe testing environment. For example, denial of service (DoS)
simulation tools [93, 94] simulate a service overwhelmed with requests
resulting in legitimate requests not getting through. A DoS simulator, if
implemented on a live system, would render the business IT infrastructure,
e.g. website, unavailable to customers, or worse, jeopardise overall system
integrity. Live environments cannot be used for stress-inducing tests.
Consequently, businesses without a test environment will never be able to test
the full suite of catastrophic scenarios as part of their incident response
training.

A test environment requires substantial technical knowledge, time and ongoing
maintenance. Australian and New Zealand small and medium enterprises spend
only 6% of their total revenue [58] on IT. For 2016, the median Australian
small business had an average turnover of AU$125,000 [80], translating to an
annual IT spend of about AU$7,500. This budget covers all IT spend, including
hardware, software, network services, IT personnel and other incidentals,
making a test environment just one of many competing priorities. While cloud
technologies have reduced costs associated with test environments, the
technical knowledge required is still substantial. Less than a quarter of
Australian small businesses have in-house, qualified IT support personnel
(with roughly a third using contractors/consultants as needed) [48]. There is
no mention of small business testing environments for off-line testing in the
literature.

The small business move towards cloud infrastructure and services makes large
enterprise cyber-security solutions unsuitable. Over a third of micro
businesses and half of small businesses used cloud based services in 2018
[48]. This demand is expected to increase [95] and accelerated due to the
COVID19 pandemic [96]. While official statistics on cloud services adoption
during the pandemic are still pending, anecdotally the uptake of third party
IT services in general has increased substantially [97], many of which are
enabled through the cloud [98]. This move away from private, or on premise,
infrastructure (i.e. IT equipment set up and owned by the business) is driven
by the associated set-up and maintenance costs [95], a proposition especially
attractive for resource constrained smaller businesses.

Cloud infrastructure presents challenges for traditional cyber-security
products. For example, general network scanning [99] assumes the
infrastructure is local and/or reachable for scanning purposes, an assumption
valid only for private infrastructure. The increasing suite of cloud-based
network perimeter scanning services [100, 101, 102] require explicit input
from users on the target devices to be scanned. Targeted device scanning is a
subset of a complete network scanning solution and cannot discover private
assets (e.g. printers) with external interfaces left accidentally unsecured.
This potential gap could be addressed by other technical or process remedies,
and needs further examination by individual businesses - a task requiring
technical knowledge and resources that many small businesses do not have.

Scanning in the cloud is a challenge for shared computing resources. Any
customer sharing the same target computing resource will be affected if the
targeted application is overwhelmed. Cloud infrastructure providers impose
strict conditions on security-related testing activities [103, 104], with the
notable exception being Google Cloud [105].

Nearly 90% [48] of small business cloud users utilise software in the cloud.
Many application providers explicitly prohibit activities interfering with
their service, preventing customers from pro-actively discovering any
vulnerability in their service provider. Indemnity and liability around use of
an outsourced function needs clarification [106, 107].

It is necessary to address when testing and monitoring of privately owned
devices is permissible. Mixed-use personal and company-owned assets, e.g.
mobile devices, are common amongst small businesses [108, 85, 22]. Mobile
device management (MDM) software [109, 110] allows businesses to monitor data
and software residing on and transiting through devices. MDM can freeze
certain functions and/or data, and, if needed, reset the entire device. Many
large enterprises routinely deploy MDM on devices issued to staff. The level
of access that MDM requires raises questions of the extent of non-work
information shared with work IT administrators [111] when a device is not a
work exclusive device.

To address the privacy concerns of MDM, mobile application management (MAM)
offers a subset of the functions of MDM [112, 113]. MAM functions require
business trade-offs and must be paired with mitigating policies based on the
sensitivity of business data. This requires expert guidance and is at odds
with other revenue generating priorities for a small business.

Clearly, re-using cyber-security solutions designed for large scale
infrastructures is not a feasible strategy for small businesses. More
appropriate cyber-security products are needed for small business given their
mix of stand alone and shared IT resources. The liability arising from small
business’ use of cloud service needs clarification.

###  5.2 Human Challenges

Small business cyber-security human resources are very different to those of
large enterprises. A qualified and accountable IT department is common in
large enterprises but not in small businesses.

In a European & US survey [84] less than 30% of small businesses, and less
than 5% of micro businesses, indicated existence of a security administrator
or any formal IT security qualifications. Approximately 10-25% of Australian
micro and small businesses have no IT support at all [48].

In Australia, most small business support comes from external
contractor/consultants, suppliers of software/hardware or non-IT qualified
staff [48]. External contractors are engaged for specific tasks. They do not
undertake cyber-security risk assessments unless contracted specifically.
Suppliers only support supplied software and/or hardware, unless an extra
support contract has been purchased. Small businesses’ constrained resources
and the low number of devices used imply support contracts are unlikely.

Cyber-security requires risk analysis and mitigation of the entire IT system,
not just individual components. The small IT budgets of small businesses do
not cover the salary of an IT administrator [114].

Furthermore, small business owners are at a knowledge disadvantage in
advocating for their cyber-security needs. In the start-up phase of a small
business, owner-managers have to perform any functions that they cannot afford
financially, or haven’t had the time, to outsource or hire. As discussed
previously, given small business’ small IT budget, these include being the IT
support person, and by extension the cyber-security person. Some tasks, such
as cleaning, physical security etc. can conceivably be done by a person with
limited experience. A cyber-security assessment cannot be done effectively by
a novice.

The age demographic of Australian small business owners indicates less
exposure to technology. Nearly 60% of Australian small business owners were
born before 1971 [80] \- well before publicly available Internet [115]. This
technical skills gap is reflected in OECD testing [116] with less than 40% of
Australian adults scoring within levels 2 or 3 (out of maximum 3 levels) of
OECD’s computer problem-solving skills scale. This percentage falls to 17.2%
within the 55-65 age group.

The timing of technology introduction places Australian business owners at a
disadvantage when dealing with cyber-security. Assistance must be designed
taking into account this lack of experience and cater to non-technical small
business owners. However, training in a receptive format is well received by
small businesses [117]. In section 6.1 we discuss the advantages inherent in
this demographic.

###  5.3 Organisational/Process Maturity

Cyber-security requires ongoing effort in education, process and investment
and is effected by the IT maturity of organisations. In Australia,
approximately a third of small businesses operating in June 2015 did not
survive to June 2019 [88]. The small business sector constantly has new
entrants. Small businesses in early inception and survival stages do not focus
on processes [118]. In these early phases, owners/managers usually have direct
oversight of business tasks with formal processes coming in as the business
matures and expands. This is at odds with a well-rounded cyber defence posture
[119] requiring business policies and controls. This lack of clarity on
process details (for example on IT fix times and specific responsibilities
around patching) leaves the organisation exposed to opportunistic cyber-
criminals.

Research on small business behaviour in the early stages of business is
required. Any cyber-security solutions or policies for small business must
consider that the business’ focus may not be on the management of cyber-
security processes and rules.

###  5.4 Industry Standards

The bewildering variety and complexity of industry standards is a challenge
that small business owners face. Some examples of cyber-security standards and
frameworks include:

  * •

NIST [120]

  * •

COBIT [121]

  * •

ISO27001 [122]

  * •

Australian Government Information Security Manual [123]

When used by a technical stakeholder such as a Chief Information Officer,
these guidelines and standards fit any business wishing to protect itself from
cyber attackers. The base assumption of many standards is a technically
literate person being available to guide the business through analysis and
implementation. Few small businesses can justify such a resource especially in
the initial phase of setting up the business. Simplified versions of the above
standards are available [124], for example, the Australian Signals
Directorate’s (ASD) Essential 8 [125] and the small business cyber-security
guide [126]. However, the range of available summarised resources vary in
depth and format. More importantly, these resources have limited comparability
between each other or existing security standards. It is unclear how a small
business’ cyber-security work fits in with other advice and standards once one
list is completed.

The complex relationships between the different standards leaves non-technical
small business owners with a very low sense of self-efficacy, or sense of
control. The relationship between self-efficacy and action is a well-
established driver of human behaviour [127]. In addition, low self-efficacy in
cyber-security could be a factor in an owner rationalising inaction [128].

Industry bodies have recognised the difficulties faced by small businesses.
ISACA, the governing body for COBIT, indicates small and medium enterprises
will be catered for as part of their COBIT 2019 standards [129].
Unfortunately, to date, this focus area is still under review and not
available.

Until cyber-security standards recognise small business’ constraints, small
business will find it hard to contextualise cyber-security within their own
business, or implement the necessary controls.

###  5.5 Cyber Insurance

Cyber insurance is a challenge for smaller businesses. Traditionally,
insurance policies are used to protect a business against disruption or loss,
ranging from natural disasters to theft. Business cyber insurance is a
relatively new phenomenon, with many variations offered by different
providers.

Various providers in Australia offer cyber insurance to their small business
customers [130]. Each insurer appears to require slightly different levels of
due diligence from the small business, while each policy provides coverage
based on disparate internal standards and policies [131, 132, 133]. Further
study and research is needed to provide clarity to small businesses around
standards applied across insurers.

Cyber insurance coverage has been called into question. One highly publicised
debate [134, 135] surrounds the insurance exemption for “act of war” or
“terrorism”. In most politically stable countries, a clause to exclude
coverage of catastrophic events, e.g. war/terrorism is employed to manage
underwriting exposure [135]. Most insurance policy takers usually accept an
act of war in a developed country to be a remote, acceptable business risk.

The effectiveness of such cyber insurance came under scrutiny when Mondelez
submitted a claim on suffering US$700 million in damage from NotPetya malware
in 2017 [134]. Zurich Insurance denied the claim, citing the attack as an act
of terrorism, as NotPetya was designed to cause maximum damage as opposed to
financial gain. The situation was further exacerbated when the US government
attributed NotPetya to Russian origins. The ongoing conflict between Russia
and Ukraine further strengthened the terrorism case as Mondelez had
infrastructure in Ukraine. The decision by Zurich continues to be challenged
in court by Mondelez, and other insured companies. The issue of terrorism is
so contentious that Lloyd’s of London [136] explicitly excludes terrorism
related scenarios in its cyber insurance cost analysis.

“It is difficult to attribute a cyber-attack to a particular group or actor”
[136, P.17]. The difficulty stems partly from code from one malware author
being reused by another. When malware code is examined forensically, it may
contain artefacts of authors other than the criminal. For example, the
NotPetya malware contains code stolen from the US National Security Agency
(NSA) [137]. Thus the malware contains signatures indicative of US origin,
despite the attack being attributed to Russia. Accurate attack attribution is
out of reach of the average organisation, especially small business. This lack
of attribution makes it difficult to prove an insurance claim as non-
terrorism.

Small businesses and personal computers are often collateral damage of large
scale cyber-attacks. The NotPetya malware wiped clean 10% of all computers in
Ukraine [134], along with many other international companies (including
bouncing back into a company in Russia itself [137]). Many small businesses
were highly likely to have been caught up in this fallout. Numerous Australian
SME and large corporations were impacted by the 2016 Petya attack [28], from
which the NotPetya malware is derived.

In addition to the Mondolez owned Cadbury factory in Hobart, NotPetya affected
companies with an Australian presence such as DLA Piper, Maersk, TNT etc [138,
139]. Unfortunately, following the Australian government’s attribution of
NotPetya to Russia, and NotPetya’s classsification as malware [140], any
Australian businesses’ with an act of terrorism insurance exception would
reasonably find themselves not covered by their cyber insurance policy.

The battles still being fought through the international judicial system
indicate that cyber insurance is not mature enough for Australian small
businesses to use effectively. For cyber insurance to be a risk mitigation
tool for small business, significant industry, regulatory and assistance
efforts are needed to clarify and provide adequate coverage to small
businesses in case of a breach.

###  5.6 Legal Remediation

Despite the act of breaking into computers being covered under various
legislations in different countries [61], cyber-criminals continue to operate
with impunity. One reason for this perceived lack of consequences is the legal
complexity of investigating and prosecuting cyber-crimes.

Criminal and remediation processes are complicated when the pepetrators are
under a different legal jurisdiction to the victims and properties and hence,
subject to different legal processes and laws. The ease with which attacks can
be launched over the internet makes cross-jurisdictional cyber-crime possible
for criminals with minimal resources. Over half the countries responding to a
2013 United Nation’s (UN) survey described a transnational element in the
majority of the cyber-crimes reported [61, P.117].

This cross jurisdictional complication is discussed in the 2014 Australian
government [141] study on online fraud. The negative impact of transnational
barriers on investigations and judicial outcomes for victims continues today
[46]. Jurisdictional complications possibly contribute to the overall low
conviction rate (10%) of police recorded cyber-crimes [61, P.172]. However,
international co-operation in fighting cyber-crime is beneficial [142] in
overcoming structural barriers to prosecuting international cyber-crime.

The low conviction rate is exacerbated by the low rate of reporting. Most
cyber-crimes are not likely to be reported [61, P.119]. In Australia, the top
3 reasons [77] for non-reporting of online fraud include embarrassment, belief
police cannot find offender and uncertainty of right reporting authority.
Given these factors, the overall redress that actually occurs is even smaller.

Even in the remote event a cyber-crime results in a conviction, the loss of
confidentiality of data is a major issue. Once a receiver has stolen data,
this knowledge/data cannot be removed from the receiver. Even where data can
be located, the ease with which copies can be made and distributed makes
containment difficult. One such example is the classified data taken from the
United States National Security Agency (NSA) by an insider [143]. Despite
investigations and knowledge of the locations of the document caches,
information from this breach is still available on the Internet [144].

Outside of legislative penalties, there is little incentive for Australian
small businesses to report cyber-crime. With low remediation rates and
investigative difficulties, reporting to authorities is replaced by the
priority of recovering from the cyber-incident. Without dedicated legal
personnel to follow up and navigate the complex systems involved, legal
remediation remains out of reach of most small businesses.

Substantial work is still needed on the cyber-crime legal framework to
convince small businesses that it is effective in delivering remediation when
needed.

###  5.7 Cost of a Data Breach

The gap in knowledge of the cost of inaction makes investing in cyber-security
a difficult decision for small businesses. A small business needs to weigh up
each investment decision against perceived benefits/loss. Existing data breach
costing studies around the globe have primarily focused on larger businesses
[43, 60, 64].

Small businesses (1-49 employees) suffer an average loss of US$14,000 per year
per firm [8] across the US and some European countries. Despite a low small
business sample size, a US Government report [60] speculates the impact/cost
of a breach on small business is possibly more devastating than for a large
business due to the loss of customers. There is no data available for
Australian businesses in the 0-19 employee range. In a survey by ACSC [9],
about half of small business owners predicted it would take a few days to
recover from a hypothetical cyber attack.

Until relevant cyber-breach cost data is available, it will be hard to
persuade small business owners to invest in managing cyber-security risks [3].
Scientific and industry research is needed to examine ways of determining
actual costs to small businesses from cyber breaches, similar to larger
enterprises [60, 64].

##  6 Advantages For Small Businesses

The small business cohort has advantages over larger enterprises, despite the
many challenges they face. With the right assistance, a small business can
become a less attractive target to cyber-criminals.

###  6.1 Small Business Agility

Two advantages for small businesses over their larger counterparts are their
flexibility and willingness to learn. The COVID-19 pandemic showcased the
agility with which small businesses adapted to fluid situations [145, 146,
147, 148, 149]. Small business owners possess qualities allowing them to react
with agility [150, 151].

The older demographic of small business owners comes with advantages. Creative
and critical thinking related digital skills actually improve faster within
older age groups with this improvement attributed to everyday hands-on
experience of working with technology [152].

Flexibility, willingness to learn and creative thinking are important cyber-
security skills [153, 154, 155]. However small business owners, dominated by
older but adventurous learners [156, 34], still struggle with cyber-security
[86, 128]. Creative thinking skills cannot be used effectively when the basic
information needed to create solutions is unavailable in an accessible format.
Unlike conventional IT knowledge, e.g. productivity software and mass-market
hardware, cyber-security knowledge is still highly technical and inaccessible
to the public. In Australia, small business owners are largely offered adhoc
cyber-security workshops and resources via disparate small business training
and communication channels, e.g. [124, 157, 158]. With research showing that
cyber-security needs to be a gradual, ongoing and persuasive effort [159,
160], alternative formats and continuous approaches to small business cyber-
security training need to be examined.

A targeted capacity building curriculum, encompassing both prevention and
response, can be used to take advantage of small businesses’ agility. Building
practical coping skills appeals to creative problem solvers like small
business owners, without relying on formal processes [151]. A good starting
point would be cyber-security advice for small businesses focusing on
prevention, e.g. password policies, spotting phishing etc. This advice should
extend to other aspects of a cyber-incident’s lifecycle such as incident
response, record keeping, technical recovery strategies etc.

Victim assistance facilities (as part of incident response) like IDCare [161],
ACSC Report [162], Scamwatch [163] etc do exist in Australia but public
awareness is not ubiquitous [77]. Increased education around crime reporting
processes and forensic practices will improve response to breaches by small
business owners.

Further research is needed to enable cyber-security education to take
advantage of small business owners’ agility. Solutions need to be tailored to
[117], and take advantage of, the unique abilities of small business owners.

###  6.2 Small Business Networking and Alliances

An alliance between small business owners would enable data collection and
advanced intelligence sharing, as well as peer support. This real time
knowledge of trending threats and attack methods would help small businesses
to be vigilant to emerging threats.

International large enterprises [164, 165] have formed cyber-security
alliances allowing members to gain advanced intelligence and work
collaboratively, and forming a cyber-security feedback loop. In Australia,
alliances between industry, government and research such as AusCERT [166] and
ACSC Partners [167] exist. Unfortunately these alliances target organisations
with dedicated cyber-security IT personnel/budgets. For small businesses such
an alliance would provide easily accessible intelligence and affordable
skills. [168].

A cyber-security alliance of small business owners could allow law
enforcement, legislators and technical support companies to respond rapidly to
emerging threats. Each small business could contribute cyber-security
incidents and intelligence into a central database providing cyber-security
peer support to each other. Education and awareness act as extensions of such
an alliance, leading to it becoming a trusted authority on small business
cyber-security.

Technical and administrative facilitators are needed to overcome existing
communication barriers between small businesses and facilitate such an
alliance. The exact facilitation and support needed to start and maintain such
a new alliance needs to be researched and clarified.

###  6.3 Advantages of Zero Trust Model

Suitable security models differ due to the scale of organisations. The low
requirement for IT homogeneity makes zero trust security models [169] a prime
framework for small business. Small businesses have limited large scale
technical legacy to undo and their scattered IT operations suit a zero trust
model.

The traditional network perimeter safeguards an IT eco-system that is
relatively obstacle-free internally, leading to the analogy of a hard shell
enclosing a chewy centre [170]. The problem of an attacker having free reign
once a perimeter is bypassed has been demonstrated in large scale breaches
[44, 171].

Google [172], as well as other stakeholders [173], have recognised the
futility of safeguarding an ever changing network perimeter [174, 175], and
have adopted zero trust principles in their services in their BeyondCorp
design. The zero trust security model [176] is a network model for defence
that presumes an attacker has gained access inside the hardened perimeter. In
a zero trust model, access control is no longer performed at the network
surrounding the IT systems, but focused on authentication and authorisation of
user access to individual services.

Small businesses have difficulty with perimeter defence as they don’t own many
of the IT services used. In many ways, the zero trust architecture is one
small businesses have been managing for many years. Zero trust allows focus on
individual service protection, thus limiting impacts even if an individual
service gets breached.

However, small businesses need assistance with implementing a zero trust
model. Each new device needs arduous processes of set-up for multiple services
rather than one perimeter [177]. Abstracting security into a layer/functional
component [178] allows standardisation and re-use across multiple businesses.
This creates an opportunity for a reusable design/platform that small
businesses can implement in their unique IT environments.

Currently there are very few products and little research in this context.
Despite implementation within large international companies such as Google and
Akamai, zero trust has yet to see significant momentum within the Australian
business landscape. Development of zero trust IT ecosystems for small business
could bring high returns due the large number of end users.

###  6.4 Open Source Cyber-security Tools

Open source software & hardware (OSSH) is developed and (usually) released for
free by a community of software makers and hardware designers. OSSH is an
option used by IT professionals when paid IT products, including cyber-
security products, do not meet technical or cost requirements. In embracing
OSSH, Australian small businesses would be following in the footsteps of
Australian government authorities. Various Australian government departments
have encouraged use of OSS software as well as making software open source in
general [179, 180, 181, 182]. However, a lack of technical expertise has
hampered small business’ ability to take advantage of free OSSH security
solutions [183, 184, 185].

The ethos of open contribution by volunteers results in OSSH products being
released under broad licenses (e.g. GNU general public use [186], creative
commons license[187] etc.) that permit most uses. In some cases, this includes
commercial use with nothing more than attribution. OSSH has produced popular
projects such as the MySQL database, Fedora Linux operating system, Arduino
microcontroller etc which enable the development of commercial products. A
variety of free OSSH cyber-security tools are now available [188].

However, characterising OSSH as free or low cost ignores the overall cost of
ownership beyond initial financial outlay for supporting equipment and setup
effort [189]. Both the Equifax breach [44] and industry standards like ITIL
[190] have demonstrated the critical role played by post-implementation
operational support in securing an IT environment.

To enable ongoing maintenance, enterprise versions of OSSH are sold by third
party vendors including items such as on-going support, updates,
certifications etc. For example, RedHat Enterprise Linux is based on OSSH
Fedora Linux [191] and offers the support options that Fedora does not. In
larger businesses, where enterprise level OSSH products may not exist, in-
house support is enabled by internal staff with dedicated responsibilities. A
lack of technical expertise and financial resources in a small business is an
impediment to the use of OSSH.

OSSH presents an opportunity for technical security solutions for small
business owners. OSSH provides many benefits for small businesses including:

  * •

On-going reviews minimising security vulnerabilities from human error [192].

  * •

Reducing vendor lock-in [189].

  * •

Being part of the software community with a stake as users in the software
development [193].

  * •

Encouraging good cyber-security hygiene habits by enabling adoption in the
early stages of the business lifecycle.

Australian small businesses could leverage the expertise of developers active
in open source development. They could participate in local open source
communities like PyCon [194] and Linux Australia [195] to make their business
needs met and their voices heard. Building bridges between the OSSH and small
business communities could provide value for both.

Given the importance of cyber-security in business, further research is needed
to analyse the suitability of OSSH security products into the Australian small
business landscape and the obstacles to be negotiated to remove entry
barriers.

##  7 Discussion

There are few reviews dedicated to the small business cyber-security
landscape. Our research reveals many constraints in small business adoption of
cyber-security practices, but also advantages in the cohort that should be
leveraged.

###  7.1 Data Collection

As Table 4 illustrates, data collection in small business cyber-security
research requires improvements in regards to scope, consistency and respondent
range.

Table 4: Cyber-security Data Collection Practice Issues and Desired Outcomes

Section |  Current Challenge |  Proposed Solution |  Proposed Responsible Bodies
---|---|---|---
4 & 4.1 |  Lack of focus [55, 48] on micro businesses in research. |  Focused research on $<$20 employee businesses to capture the operational behaviour of small businesses. |  Government; Research
4.2 |  Use of novel technical [2] terminologies. |  Standard terminologies used to ensure language describes the same phenomenon. |  Standards Bodies; Industry
4.3 |  Use of disparate [58] grouping sizes. |  Acknowledgement of group size range impacts in findings. |  Industry; Research
4.4 |  Unaccounted self-reporting bias [74, 75] in results. |  Social desirability and awareness adjustments incorporated into self-reported statistics to account for bias from collection method, both technical and psychological. |  Statistical Collection; Research
|  Over reliance on surveys [9, 28, 48] as a data gathering instrument. |  Detection based small business monitoring to reduce reliance on self-reported statistics. |  Industry; Government
4.5 |  Survey instruments [78] favouring technically savvy [8, 28] cohorts. |  Demographically representative respondents of the small business landscape sourced to obtain relevant understanding of gaps and priorities. |  Government; Statistical Collection
Note: In the rapidly evolving field of cyber-security, research is advanced by
a combination of different parties: scientific, government, industry,
journalistic etc. The“research” bodies referenced here, and in subsequent
tables, include all who investigate the cyber-security challenge in question.

From our review of the literature, current cyber-security research lacks
representative results and insights on small business only cohorts due to
being bundled with better resourced medium businesses. Comparison between
widely disparate groups introduces difficulties in producing focused learnings
that can be applied to micro businesses and sole traders. Further research is
needed on the sub 20 employee cohort to produce targeted findings.

Our research shows that the wide variety of language and definitions used
within the cyber-security industry poses issues with interpretation of
survey/research findings. Mismatched cohort sizes make comparisons difficult,
and sometimes misleading. Standardisation of both group definitions and
terminologies is needed within cyber-security research and industry to enable
useful comparison and longitudinal use of research data.

The heavy use of self-reported surveys introduces social desirability and
awareness bias in results. Rather than relying solely on self-reported data
for small business research on quantitative matters e.g. breach rate,
technology involved, we suggest a wider deployment of detection based
collection. For qualitative research, researchers should actively account and
compensate for self-reporting bias, if possible, as part of their results.

Finally as our research highlights, distortion in research results is worsened
by the technical methods by which many surveys are conducted. Technical data
collection channels such as online surveys, result in samples biased towards
respondents comfortable with using technology. Demographic data shows small
business owners are not all technically savvy. Surveys need to be accessible
and promoted towards both technically savvy and non-technical respondents to
ensure all types of business owners are represented.

###  7.2 Small Business Challenges

In addition to the research challenges listed above that being a small
business poses many hurdles in understanding and implementing cyber-security,
as summarised in Table 5.

Table 5: Cyber-security Challenges for Small Businesses Section |  Current Situation |  The Way Forward |  Best Responsible Bodies
---|---|---|---
5.1 |  Lack of clarity on application user liability [106, 107] in the event of a breach. |  Clarification of breach liability if small business uses an external IT service. |  Professional Bodies; Government
|  Small number of cyber-security solutions that take into account mixed physical ownership [108, 85] IT environments. |  Small business mode of operation research and product development that recognises the need for hybrid IT environments. |  Research; Industry
|  Effective reuse of current cyber-security solutions are prevented by existing differences between large and small enterprise IT architectures [Section 5.1]. |  Small business common IT architecture research and tailored resources built for small businesses leading to fit-for-purpose cyber-security tools and advice. |  Research; Government
5.2 |  Small business owners have several challenges in technical knowledge to effectively use cyber-security information today. |  Development of material suitable for small business knowledge level and mode of learning |  Government
5.3 |  Small businesses are likely to be in an inception state [88] with immature processes and organisation [118]. |  Further development of standards and tools that takes organisational immaturity into account. |  Industry; Research
5.4 |  Industry standards [120, 121, 122, 123] require a high level of technical expertise to follow. |  Standards that are targeted towards a small business audience recognising external constraints [129] with a migration path to existing full standards. |  Standards Bodies; Research; Government
5.5 |  Lack of clarity [134] around insurance requirements and coverage. |  Further research, product development and guidance for small business on all aspects of cyber insurance to enable informed choices and adequate coverage. |  Research; Government
5.6 |  Lack of small business self-efficacy around legal remediation [61] from cyber-crime. |  Further clarification, research and development around legal aspects of cyber-crime and associated remediation for small businesses. |  Government
5.7 |  Lack of relevant data [60] on costs associated with cyber breaches for small business. |  Further research to clarify the cost of data breaches for comparable small business cohort, to enable accurate risk based decisions making from small business. |  Research; Statistical Collection

Our research found that small businesses tend to operate differently from
large corporations due to their size, leading to different IT usage pattern.
One phenomenon is the tendency to mix personal and business use in devices and
securing these devices using traditional security solutions such as MDM and
MAM pose ethical and logistical dilemmas. The rising use of cloud services by
small business also raises questions around liability and the control and
visibility a small business actually has over its IT security.

Through demographic statistics we found that small businesses and their owners
are at a disadvantage in regards to experience with and knowledge of
technology. Given the older demographic, the majority of small business owners
have spent a smaller proportion of their working lives on the internet, when
compared to younger generations. This lower level of technical literacy needs
to be accounted for in training and standards. It is unrealistic to expect
non-technical people to self-drive and implement the highly technical security
standards available today.

Small businesses’ tendency to be at an inception stage is also at odds with
the process and oversight driven cyber-security standards, with research
showing early stage businesses do not have many established processes and
management practices. Standards and solutions for small businesses need to
factor in this mode of operation.

The general lack of maturity around cyber insurance, judicial processes and
cost data all contribute to the state of confusion in cyber-security for small
businesses. The ongoing litigation between insurance providers and larger
corporations shows cyber insurance is not yet an effective risk management
tool for small business. Furthermore, the lack of comparable cyber-incident
data leaves business owners with little understanding of the potential loss
they are insuring against. Compounding this are the general difficulties in
successfully prosecuting cyber-criminals, leaving small business owners with a
lack of self-efficacy in the judicial system. The low sense of self-efficacy
leads to inaction and is reflected in the low rate of reporting.
Unfortunately, a low rate of reporting leads to cyber-criminals continuing to
operate with impunity.

Our examination reveals the need to better understand small business IT usage,
demographics, mode of operation and structural constraints. By understanding
the differences and challenges involved, the discussion around cyber-security
could match small business users’ needs and expectations.

###  7.3 Opportunities

By taking a step back to look at small business as a whole, our research
(summarised in Table 7) found opportunities for small business with regards to
cyber-security. These opportunities take advantage of the unique landscape and
characteristics of small businesses and their owners, and if leveraged, would
lead to more resilient small businesses.

Table 7: Small Business Cyber-security Advantages

Section |  Advantages |  Opportunities |  Best Responsible Bodies
---|---|---|---
6.1 |  Agility and resilience of small businesses [150, 151] in the face of challenges - take advantage of traditional flexibility that small businesses present. |  Support [117] for small business to develop capabilities around ongoing cyber hygiene and response to breaches. |  Government
6.2 |  Cohort size - leverage the large number of small businesses. |  Further research into feasibility and assistance required in forming networks [164, 165] that can be an early warning system within small business cohort. Sharing of knowledge to enable peer support. |  Government
6.3 |  Zero Trust Model [170] \- make use of similarities between zero trust model and common small business architecture. |  Further technical research to clarify how the use of zero trust principles can fit into small business’ highly hybridised IT environments; Identification of opportunities and development of solutions to leverage overlaps. |  Research; Industry
6.4 |  Open Source Security Products [183, 184, 185] \- repurpose existing low cost solutions to fit small business needs. |  Further research into the possibilities and logistics required to leverage open source security products to match small business’ operating model and constraints, making use of advantages [192, 189, 193] that open source offers. |  Research

Our research found a small business owner’s agility and responsiveness could
lead to better cyber-security responses. Rather than focus on formal and
process based security standards, a more effective method would be to teach
the skills/capabilities a small business needs to both protect itself as well
as respond to an incident. Focusing on the skills needed taps into the natural
ways in which small businesses excel at solving problems.

Small businesses could use their large numbers to their advantage by
establishing alliances. Cyber-security alliances are not new and have been
shown to benefit members. To date, alliances have formed between large
organisations. Small business would obtain definite advantages from such an
alliance, especially in terms of peer support, early intelligence and
education.

Our research identified a couple of technical cyber-security solutions that
could be leveraged for small business cyber-security with the right
collaboration and product development. A zero trust model, by assuming no safe
network boundaries, aligns the base IT architecture closer to the small
businesses mode of operation. By discarding a need to ring-fence disparate IT
systems, a zero trust model would drive a realistic security architecture plan
to protect small businesses. In a similar manner, open source cyber-security
software would give small businesses opportunities both in overcoming
financial barriers to entry and having their needs met.

###  7.4 International Implications

In this study we detailed the effects of cyber-security decisions/actions by
organisations (legal or otherwise) on countries outside their geographical
boundaries. Within countries with similar societal profile to Australia, such
as UK and US, a similarity in cyber-security has been observed in the evidence
produced. The parallels ranged from research approaches e.g. survey,
interviews, sole trader/micro business exclusion, to government actions e.g.
advisories, frameworks etc. These similarities extended to small business
dominance of economy, owners’ awareness of cyber-security knowledge gaps, as
well as comparable technology skill levels.

Given technology landscapes are also very similar across these countries, it
is not inconceivable that small businesses in other countries with similar
societal profiles to Australia, such as the UK and US, share similar human
struggles with cyber-security. As such any solutions shown to work in
Australia would merit further examinations in other such countries.

The important role of human influence on small business cyber-security leads
us to conclude that the small business challenges and characteristics
discussed in this paper are not unique to Australian small businesses.

##  8 Conclusion

The urgent need to protect small businesses from cyber-criminals is driven by
increasing pressures on small businesses to use technology. Small businesses
face pressure to adopt technology from multiple fronts, ranging from customer
expectations to world events. Through our examination of evidence from both
research and industry, we have identified gaps in the pursuit of cyber-
security for small businesses at multiple levels.

At a data level, further efforts are needed to clarify and improve
understanding around small and micro businesses’ ways of working, their IT
architecture and real world small business breach loss statistics. The
understanding must be gained through representative small and micro business
samples and communicated using standardised security terminologies, so that
data and lessons can be transferred in a wider context.

In addition, we discussed small business constraints that impacts on small
business’s ability to protect themselves. These range from availability of
technical knowledge within the business, organisational maturity and mixed IT
ownership. Uncertainties around external factors such as cyber-insurance,
legal remediation and cost of cyber-incidents also make small business
decisions around cyber-security difficult.

Through our overview approach, opportunities to apply non-traditional
solutions to cyber-security are also becoming apparent. Promising
characteristics including alliances, a new security paradigm and open source
community for helping small businesses to build up their defences were also
identified.

With the right research and support, a more coherent understanding of small
business cyber-security needs and risks can lead to more resilient small
businesses. It is through a combination of these insights that cyber-security
solutions can be made accessible to fit better with small businesses, rather
than expect small businesses to fit into current cyber-security solutions.
Industry, government and society at large also benefit from the reduced
investigative and human costs of cyber-incidents. Supporting small business
cyber-security has far reaching benefits, to the economy, the community and
national security.

##  9 Acknowledgement

This research is supported by an Australian Government Research Training
Program (RTP) Scholarship.

##  10 Authors Biographies

Tracy Tam is a doctoral candidate (Mathematical Science) within the School of
Science at RMIT University. She holds a Bachelor degree (with Honours) in
Telecommunications Engineering from Monash University. She worked for a decade
as an engineer within the IT industry. She also has experience in managing her
own small business. Her research interests include cyber-security within small
business context, cyber-security human factors and security risk management.

Prof. Asha Rao is Professor and Associate Dean (Mathematical Sciences) within
the School of Science at RMIT University, Australia. She is an Australian
2019-2020 Superstar of STEM. She has won over AUD 3.5M in grants since 2007
from Government and Industry to research a variety of issues including insider
threat and continuous authentication. As a trans-disciplinary researcher, she
works on a variety of problems, ranging from designing better codes for
communication, exploring the mathematics behind quantum cryptography, finding
links between various combinatorial structures, to cybersecurity problems such
as risk management for SME, detecting insider threats, and money laundering.

Joanne Hall is a Senior Lecturer in mathematics and cybersecurity at RMIT.
With a background in abstract algebra, her research is on quantum key
distribution and post quantum cryptography. Dr Hall completed her PhD at RMIT
in 2011 on quantum key distribution. She has held research and teaching
positions at Charles University in Prague and the Queensland University of
Technology. As the internships coordinator for the Master of Cybersecurity
Degree, Dr Hall has a keen interest in the cybersecurity needs of businesses.

## References

  * ABC News [2020] ABC News, “NT Chief Minister Delivers Emotional Address to Territorians About Coronavirus Shutdown — ABC News Video,” 2020. [Online]. Available: https://www.youtube.com/watch?v=QBV1gfcectU
  * Symantec [2019] Symantec, “Internet Security Threat Report,” 2019. [Online]. Available: https://img03.en25.com/Web/Symantec/%7B984e78e2-c9e5-43b8-a6ee-417a08608b60%7D_ISTR_24_2019_April_en.pdf
  * Australian Government [2016] Australian Government, “Australia’s Cyber Security Strategy - Enabling innovation, growth and prosperity,” 2016. [Online]. Available: https://cybersecuritystrategy.homeaffairs.gov.au/AssetLibrary/dist/assets/images/PMC-Cyber-Strategy.pdf
  * Department of Parliamentary Services [2018] Department of Parliamentary Services, “Small Business Sector Contribution to the Australian Economy,” 2018. [Online]. Available: https://parlinfo.aph.gov.au/parlInfo/download/library/prspub/6272043/upload_binary/6272043.pdf
  * Armstrong [2019] D. Armstrong, “I Lost My Identity to a Fraudster, and It Took Six Years to Clean Up the Mess,” _Bloom. Businessweek_ , vol. 2019, Aug 2019. [Online]. Available: https://www.bloomberg.com/news/articles/2019-08-12/i-lost-my-identity-to-a-fraudster-and-it-took-six-years-to-clean-up-the-mess
  * BBC News [2019] BBC News, “Margaret Atwood says thieves targeted Handmaid’s Tale sequel,” _BBC News_ , Sep 2019. [Online]. Available: https://www.bbc.com/news/entertainment-arts-49635236
  * Bainbridge and Florance [2020a] A. Bainbridge and L. Florance, “Victims to Vigilantes,” _ABC News_ , Sep 2020. [Online]. Available: https://www.abc.net.au/news/2020-09-20/puppy-scams-cost-australians-1.3m-but-victims-are-fighting-back/12611646?nw=0
  * Hiscox [2019] Hiscox, “Hiscox Cyber Readiness Report 2019,” p. 20, 2019. [Online]. Available: https://www.hiscox.co.uk/sites/uk/files/documents/2019-04/Hiscox_Cyber_Readiness_Report_2019.PDF
  * Australian Cyber Security Centre and Australian Signals Directorate [2020] Australian Cyber Security Centre and Australian Signals Directorate, “Cyber Security and Australian Small Businesses,” 2020. [Online]. Available: https://www.cyber.gov.au/sites/default/files/2020-07/ACSCSmallBusinessSurveyReport.pdf
  * Council of The European Union [2016] Council of The European Union, “GDPR Legislative Act,” 2016. [Online]. Available: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN
  * Azar [2020] A. Azar, “Department of Health and Human Services, Annual Civil Monetary Penalties Inflation Adjustment,” in _Fed. Regist. / Friday, January 17, 2020 / Rules Regul._ , 2020, vol. 85, no. 12, pp. 2869–2887. [Online]. Available: https://www.govinfo.gov/content/pkg/FR-2020-01-17/pdf/2020-00738.pdf
  * Centers for Disease Control and Prevention [2018] Centers for Disease Control and Prevention, “Health Insurance Portability and Accountability Act of 1996 (HIPAA),” 2018. [Online]. Available: https://www.cdc.gov/phlp/publications/topic/hipaa.html
  * Office of Parliarmentary Counsel [2019] Office of Parliarmentary Counsel, “Privacy Act 1988,” 2019. [Online]. Available: https://www.legislation.gov.au/Details/C2019C00241
  * Kelkar and Rao [2013] A. Kelkar and A. Rao, “Co-designing compliance to the Anti-Money Laundering Act within the small and medium enterprise sector,” _J. Financ. Regul. Compliance_ , vol. 21, no. 1, pp. 84–101, 2013.
  * Newbury [2017] M. Newbury, “Designated non-financial businesses and professions: The weak link in Australia’s AML/CTF regime,” _J. Money Laund. Control_ , vol. 20, no. 3, pp. 247–261, 2017.
  * Valli et al. [2014] C. Valli, I. Martinus, and M. Johnstone, “Small to Medium Enterprise Cyber Security Awareness: an initial survey of Western Australian Business,” in _Proc. Int. Conf. Secur. Manag._ , C. Valli, Ed., 2014, p. 1.
  * Dojkovski et al. [2010] S. Dojkovski, S. Lichenstein, and M. Warren, “Enabling Information Security Culture: Influences and Challenges for Australian SMEs,” in _Australas. Conf. Inf. Syst._ , vol. 61. Association for Information Systems (AISeL), 2010. [Online]. Available: http://aisel.aisnet.org/acis2010/61
  * Dojkovski et al. [2007] ——, “Fostering Information Security Culture in Small and Medium Size Enterprises: An Interpretive Study in Australia,” in _Eur. Conf. Inf. Syst._ , vol. 120. Association for Information Systems Electronic Library (AISeL), 2007, pp. 1560–1571. [Online]. Available: http://aisel.aisnet.org/ecis2007/120
  * Dojkovski et al. [2006] S. Dojkovski, S. Lichtenstein, and M. Warren, “Challenges in fostering an information security culture in australian small and medium sized enterprises,” _5th Eur. Conf. Inf. Warf. Secur. 2006, ECIW 2006_ , pp. 31–40, 2006. [Online]. Available: http://hdl.handle.net/10536/DRO/DU:30006079
  * Alahmari and Duncan [2020] A. Alahmari and B. Duncan, “Cybersecurity Risk Management in Small and Medium-Sized Enterprises: A Systematic Review of Recent Evidence,” _2020 Int. Conf. Cyber Situational Awareness, Data Anal. Assessment, Cyber SA 2020_ , 2020.
  * Heidt et al. [2019] M. Heidt, J. P. Gerlach, and P. Buxmann, “Investigating the Security Divide between SME and Large Companies: How SME Characteristics Influence Organizational IT Security Investments,” _Inf. Syst. Front._ , vol. 21, no. 6, pp. 1285–1305, 2019.
  * Osborn and Simpson [2017] E. Osborn and A. Simpson, “On small-scale IT users’ system architectures and cyber security: A UK case study,” _Comput. Secur._ , vol. 70, pp. 27–50, 2017. [Online]. Available: https://doi.org/10.1016/j.cose.2017.05.001
  * Ruhwanya and Ophoff [2019] Z. Ruhwanya and J. Ophoff, _Information Security Culture Assessment of Small and Medium-Sized Enterprises in Tanzania_. Springer International Publishing, 2019, vol. 551. [Online]. Available: http://dx.doi.org/10.1007/978-3-030-18400-1_63
  * Bryan [2020] L. L. Bryan, “Effective Information Security Strategies for Small Business,” _Int. J. Cyber Criminol._ , vol. 14, no. 1, pp. 341–360, 2020\.
  * Almeida et al. [2018] F. Almeida, I. Carvalho, and F. Cruz, “Structure and Challenges of a Security Policy on Small and Medium Enterprises,” _KSII Trans. Internet Inf. Syst._ , vol. 12, no. 2, pp. 747–763, 2018.
  * Salleh et al. [2018] N. A. Salleh, H. Hussin, M. A. Suhaimi, and A. Md Ali, “A Systematic Literature Review of Cloud Computing Adoption and Impacts Among Small Medium Enterprises (SMEs),” _Proc. - Int. Conf. Inf. Commun. Technol. Muslim World 2018, ICT4M 2018_ , pp. 278–284, 2018.
  * Cynch Security et al. [2021] Cynch Security, Deakin University, RMIT University, and AustCyber, “Big cyber security questions for small business The state of cyber fitness in Australian small businesses,” 2021. [Online]. Available: https://static1.squarespace.com/static/576a6006f5e23175ba4e41d8/t/601b2bcc8724d11f1c78b95c/1612393427067/Cynch+-+Big+cyber+security+questions+for+small+business+-+White+paper.pdf
  * NSW Government [2017] NSW Government, “Cyber Aware,” 2017. [Online]. Available: https://www.smallbusiness.nsw.gov.au/sites/default/files/2019-07/Cyber-Aware-full-report.pdf
  * Luque et al. [2019] A. Luque, R. Bhaskar, J. Noon, K. Rinz, and Victoria Udalova, “Nonemployer Statistics by Demographics (NES-D): Using Administrative and Census Records Data in Business Statistics,” 2019. [Online]. Available: https://www2.census.gov/ces/wp/2019/CES-WP-19-01.pdf
  * US Census [2015] US Census, “2015 SUSB Annual Datasets by Establishment Industry - Data by Enterprise Employment Size,” 2015. [Online]. Available: https://www2.census.gov/programs-surveys/susb/datasets/2015/us_state_6digitnaics_2015.txt
  * British Crown [2019] British Crown, “Business Population Estimates for the UK and Regions 2019,” 2019. [Online]. Available: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/852919/Business_Population_Estimates_for_the_UK_and_regions_-_2019_Statistical_Release.pdf
  * Hofstede [2001] G. H. Hofstede, _Culture’s Consequences : Comparing Values, Behaviors, Institutions, and Organizations Across Nations_ , 2nd ed. Thousand Oaks, Calif.: Sage Publications, 2001.
  * Organisation for Economic Co-operation and Development (2018) [OECD] Organisation for Economic Co-operation and Development (OECD), “Key Facts Survey of Adult Skills ( PIAAC ): Full Selection of Indicator - UK, US, Australia and OECD Data Table,” 2018. [Online]. Available: https://gpseducation.oecd.org/IndicatorExplorer
  * Moran [1998] P. Moran, “Personality Characteristics and Growth-orientation of the Small Business Owner-manager,” _Int. Small Bus. J. Res. Entrepeursh._ , vol. 16, no. 3, pp. 17–38, 1998. [Online]. Available: http://hjb.sagepub.com.proxy.lib.umich.edu/content/9/2/183.full.pdf+html
  * Kickul and Gundry [2002] J. Kickul and L. Gundry, “Prospecting for Strategic Advantage: The Proactive Entrepreneurial Personality and Small Firm Innovation,” _J. Small Bus. Manag._ , vol. 40, no. 2, pp. 85–97, 2002.
  * IDC [2019] IDC, “Worldwide Spending on Security Solutions Forecast to Reach $103.1 Billion in 2019, According to New IDC Spending Guide,” 2019. [Online]. Available: https://www.idc.com/getdoc.jsp?containerId=prUS44150518
  * Kaur and Mustafa [2013] J. Kaur and N. Mustafa, “Examining the Effects of Knowledge, Attitude and Behaviour on Information Security Awareness: A Case on SME,” in _Int. Conf. Res. Innov. Inf. Syst. ICRIIS_ , vol. 2013. IEEE, 2013, pp. 286–290.
  * Cheng et al. [2013] L. Cheng, Y. Li, W. Li, E. Holm, and Q. Zhai, “Understanding the Violation of IS Security Policy in Organizations: An Integrated Model Based on Social Control and Deterrence Theory,” _Comput. Secur._ , vol. 39, no. PART B, pp. 447–459, 2013. [Online]. Available: http://dx.doi.org/10.1016/j.cose.2013.09.009
  * Sawaya et al. [2017] Y. Sawaya, M. Sharif, N. Christin, A. Kubota, A. Nakarai, and A. Yamada, “Self-Confidence Trumps Knowledge : A Cross-Cultural Study of Security Behavior,” in _Proc. 2017 CHI Conf. Hum. Factors Comput. Syst._ , Denver, 2017, pp. 2202–2214.
  * Von Solms and Von Solms [2004] B. Von Solms and R. Von Solms, “The 10 Deadly Sins of Information Security Management,” _Comput. Secur._ , vol. 23, no. 5, pp. 371–376, 2004\.
  * D’Arcy and Hovav [2009] J. D’Arcy and A. Hovav, “Does One Size Fit All? Examining the Differential Effects of Is Security Countermeasures,” _J. Bus. Ethics_ , vol. 89, no. SUPPL. 1, pp. 59–71, 2009.
  * Bernik and Prislan [2016] I. Bernik and K. Prislan, “Measuring information security performance with 10 by 10 model for holistic state evaluation,” _PLoS One_ , vol. 11, no. 9, pp. 1–33, 2016.
  * Deloitte [2019a] Deloitte, “The Future of Cyber Survey 2019,” 2019. [Online]. Available: https://www2.deloitte.com/us/en/pages/advisory/articles/future-of-cyber-survey.html
  * 115th Congress Oversight & Government Reform Committee [2018] 115th Congress Oversight & Government Reform Committee, “Congressional Report, The Equifax Data Breach, Majority Staff Report,” 2018. [Online]. Available: https://republicans-oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
  * Chau [2018] D. Chau, “Ticketmaster admits customer details may have been stolen in hack,” _ABC News_ , 2018. [Online]. Available: https://www.abc.net.au/news/2018-06-28/ticketmaster-contacts-customers-personal-details-data-breach/9919124
  * Bainbridge and Florance [2020b] A. Bainbridge and L. Florance, “Tradies Frustrated by Banks as Business Email Scam Costs Them $51000,” _ABC News_ , Nov 2020.
  * ISACA [2019a] ISACA, _COBIT 2019 Framework: Introduction and methodology_ , 2019.
  * Australian Bureau of Statistics [2019] Australian Bureau of Statistics, “8167.0 Selected Characteristics of Australian Business,” 2019. [Online]. Available: https://www.abs.gov.au/AUSSTATS/abs@.nsf/allprimarymainfeatures/C575766838376FA0CA2573E1000E3F2F?opendocument
  * Australian Bureau of Statistics [2020a] ——, “8167.0 - Characteristics of Australian Business, 2018-19,” 2020. [Online]. Available: https://www.abs.gov.au/statistics/industry/technology-and-innovation/characteristics-australian-business/latest-release
  * Australian Productivity Commission and New Zealand Productivity Commission [2019] Australian Productivity Commission and New Zealand Productivity Commission, “Growing the Digital Economy in Australia and New Zealand. Maximising Opportunities for SMEs,” 2019. [Online]. Available: https://www.pc.gov.au/research/completed/growing-digital-economy/growing-digital-economy.pdf
  * State Government of Victoria [2020] State Government of Victoria, “Stage 4 restrictions,” pp. 1–7, 2020. [Online]. Available: https://www.dhhs.vic.gov.au/stage-4-restrictions-covid-19
  * Woschke et al. [2017] T. Woschke, H. Haase, and J. Kratzer, “Resource Scarcity in SMEs: Effects on Incremental and Radical Innovations,” _Manag. Res. Rev._ , vol. 40, no. 2, pp. 195–217, 2017.
  * Suryotrisongko and Musashi [2019] H. Suryotrisongko and Y. Musashi, “Review of Cybersecurity Research Topics, Taxonomy and Challenges: Interdisciplinary Perspective,” _Proc. 2019 IEEE 12th Conf. Serv. Comput. Appl. SOCA 2019_ , pp. 162–167, 2019.
  * US Small Business Administration [2019] US Small Business Administration, “Participants Sought For Survey On Small And Mid-Size Business Cybersecurity Issues,” 2019. [Online]. Available: https://advocacy.sba.gov/2019/10/21/participants-sought-for-survey-on-small-and-mid-size-business-cybersecurity-issues/
  * Eurostat [2020a] Eurostat, “ICT Security in Enterprises,” 2020. [Online]. Available: https://ec.europa.eu/eurostat/statistics-explained/pdfscache/9132.pdf
  * Sommestad et al. [2014] T. Sommestad, J. Hallberg, K. Lundholm, and J. Bengtsson, “Variables Influencing Information Security Policy Compliance: A Systematic Review of Quantitative Studies,” _Inf. Manag. Comput. Secur._ , vol. 22, no. 1, pp. 42–75, 2014.
  * Abid et al. [2011] A. A. Abid, M. Rahim, and H. Scheepers, “Experienced Benefits and Barriers of e-Business Technology Adoption by SME Suppliers,” _Commun. IBIMA_ , vol. 2011, no. October, pp. 1–11, 2011. [Online]. Available: https://www.researchgate.net/publication/260426111
  * Deloitte Australia [2016] Deloitte Australia, “SMBs In the Digital Race for the Customer,” 2016. [Online]. Available: http://www2.deloitte.com/au/en/pages/economics/articles/SMBs-race-digital-customer.html
  * Gupta and Hammond [2005] A. Gupta and R. Hammond, “Information Systems Security Issues and Decisions for Small Businesses: An Empirical Examination,” _Inf. Manag. Comput. Secur._ , vol. 13, no. 4, pp. 297–310, 2005.
  * US Government [2018] US Government, “The Cost of Malicious Cyber Activity to the U.S. Economy,” Tech. Rep. February, 2018. [Online]. Available: https://www.whitehouse.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf
  * United Nations Office on Drugs and Crime [2013] United Nations Office on Drugs and Crime, “Comprehensive Study on Cybercrime,” 2013. [Online]. Available: http://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_EG.4_2013/CYBERCRIME_STUDY_210213.pdf
  * Kam et al. [2007] C. D. Kam, J. R. Wilking, and E. J. Zechmeister, “Beyond the ”Narrow Data Base”: Another Convenience Sample for Experimental Research,” _Polit. Behav._ , vol. 29, no. 4, pp. 415–440, 2007.
  * Acar et al. [2019] Y. Acar, C. Stransky, D. Wermke, M. L. Mazurek, and S. Fahl, “Security Developer Studies With GitHub Users: Exploring a Convenience Sample,” _Proc. 13th Symp. Usable Priv. Secur. SOUPS 2017_ , no. Soups, pp. 81–95, 2019.
  * Ponemon Institute and IBM Security [2019] Ponemon Institute and IBM Security, “Cost of a Data Breach Report,” Ponemon Institute, IBM, Tech. Rep., 2019. [Online]. Available: https://www.ibm.com/security/data-breach
  * Vistage et al. [2018] Vistage, Cisco, and National Center for The Middle Market, “Cyberthreats and Solutions for Small and Midsize Businesses,” 2018. [Online]. Available: https://www.sap.com/uk/solution/sme-business-software/analytics.html
  * Watson et al. [2018] C. Watson, T. Zaw, I. Andriushchenko, G. M. Justiniano, and M. Tesauro, _OWASP Automated Threat Handbook Web Applications_. Bel Air, United States: OWASP, 2018. [Online]. Available: https://www.owasp.org/images/3/33/Automated-threat-handbook.pdf
  * Australian Bureau of Statistics [2001] Australian Bureau of Statistics, “1321.0 - Small Business in Australia, 2001,” 2001. [Online]. Available<EMAIL_ADDRESS>  * British Crown [2015] British Crown, “Small Business Survey 2014: SME Employers,” London, 2015. [Online]. Available: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/414963/bis-15-151-small-business-survey-2014-sme-employers_v1.pdf
  * Eurostat [2020b] Eurostat, “Small and medium-sized enterprises (SMEs),” 2020. [Online]. Available: https://ec.europa.eu/eurostat/web/structural-business-statistics/structural-business-statistics/sme
  * U.S. Small Business Administration [2017] U.S. Small Business Administration, “Table of Small Business Standards Matched to North American Industry Classification System Codes,” 2017. [Online]. Available: https://www.sba.gov/sites/default/files/files/Size_Standards_Table_2017.pdf
  * Cruz et al. [1997] M. Cruz, F. Boster, and J. Rodriguez, “The Impact of Group Size and Proportion of Shared Information on the Exchange and Integration of Information in Groups,” _Communic. Res._ , vol. 24, no. 3, pp. 291–313, 1997.
  * Bales et al. [1951] R. F. Bales, F. L. Strodtbeck, T. M. Mills, and M. E. Roseborough, “Channels of Communication in Small Groups,” _Am. Sociol. Rev._ , vol. 16, no. 4, pp. 461–468, 1951.
  * Steinheider and Al-Hawamdeh [2004] B. Steinheider and S. Al-Hawamdeh, “Team Coordination, Communication and Knowledge Sharing in Smes and Large Organisations,” _J. Inf. Knowl. Manag._ , vol. 3, no. 3, pp. 223–232, 2004.
  * Donaldson and Grant-Vallone [2002] S. I. Donaldson and E. J. Grant-Vallone, “Understanding Self-Report Bias in Organizational Behavior Research,” _J. Bus. Psychol._ , vol. 17, no. 2, pp. 245–260, 2002.
  * Fisher and Katz [2000] R. Fisher and J. Katz, “Social-Desirability Bias and the Validity of Self-Reported Values,” _Psychol. Mark._ , vol. 17, no. 2, pp. 105–120, 2000\.
  * Redscan [2019] Redscan, “Most ICO Data Breach Reports Late and Incomplete Prior to GDPR, Reveals Redscan FOI,” 2019. [Online]. Available: https://www.redscan.com/press-release/most-ico-data-breach-reports-late-and-incomplete-prior-to-gdpr-reveals-redscan-foi/
  * Emami et al. [2019] C. Emami, R. G. Smith, and P. Jorna, “Online Fraud Victimisation in Australia: Risks and Protective Factors,” 2019. [Online]. Available: https://www.aic.gov.au/sites/default/files/2020-05/rr16_online_fraud_victimisation_in_australia-v3.pdf
  * Boynton [2004] P. M. Boynton, “Administering, Analysing, and Reporting Your Questionnaire,” _BMJ(Clinical Res. Ed._ , vol. 328, no. 7452, pp. 1372–1375, 2004. [Online]. Available: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC420299/
  * Kwak and Radler [2002] N. Kwak and B. Radler, “A Comparison Between Mail and Web Surveys: Response Pattern, Respondent Profile, and Data Quality,” _J. Off. Stat._ , vol. 18, no. 2, p. 257, 2002.
  * Commonwealth of Australia and Australian Small Business and Family Enterprise Ombudsman [2019] Commonwealth of Australia and Australian Small Business and Family Enterprise Ombudsman, “Small Business Counts, Small Business in the Australian Economy,” 2019. [Online]. Available: http://www.asbfeo.gov.au/sites/default/files/Small_Business_Statistical_Report-Final.pdf
  * Coertze and Von Solms [2013] J. Coertze and R. Von Solms, “A Software Gateway to Affordable and Effective Information Security Governance in SMMEs,” in _2013 Inf. Secur. South Africa - Proc. ISSA 2013 Conf._ IEEE, 2013, pp. 1–8.
  * Panjwani et al. [2017] M. Panjwani, M. Jantti, and J. Sormunen, “IT Service Management From a Perspective of Small and Medium Sized Companies,” in _Proc. - 2016 10th Int. Conf. Qual. Inf. Commun. Technol. QUATIC 2016_. IEEE, 2017, pp. 210–215.
  * Bada and Nurse [2019] M. Bada and J. Nurse, “Developing Cybersecurity Education and Awareness Programmes for Small- and Medium-Sized Enterprises (SMEs),” _Inf. Comput. Secur._ , vol. 27, no. 3, pp. 393–410, 2019.
  * Dimopoulos et al. [2004] V. Dimopoulos, S. Furnell, M. Jennex, and I. Kritharas, “Approaches to IT Security in Small and Medium Enterprises,” in _Proc. 2nd Aust. Inf. Secur. Manag. Conf. Secur. Futur. Perth, West. Aust. Novemb. 26th, 2004_ , 2004, pp. 73–82. [Online]. Available: https://www.researchgate.net/publication/221148270_Approaches_to_IT_Security_in_Small_and_Medium_Enterprises
  * Almubayedh et al. [2018] D. Almubayedh, M. A. Khalis, G. Alazman, M. Alabdali, R. Al-Refai, and N. Nagy, “Security Related Issues in Saudi Arabia Small Organizations: A Saudi Case Study,” in _21st Saudi Comput. Soc. Natl. Comput. Conf. NCC 2018_. Ar Riyad, Saudi Arabia: IEEE, 2018, pp. 1–6.
  * Laleh et al. [2013] E. Laleh, Y. Masoudi, F. Fathy, and S. Ghorbani, “Influencing Factors of Information Security Management in Small- and Medium- Sized Enterprises and Organizations,” in _Proc. - 2013 Int. Conf. Commun. Syst. Netw. Technol. CSNT 2013_. IEEE, 2013, pp. 445–449.
  * Osborn and Simpson [2018] E. Osborn and A. Simpson, “Risk and the Small-Scale Cyber Security Decision Making Dialogue - A UK Case Study,” _Comput. J._ , vol. 61, no. 4, pp. 472–495, 2018.
  * Australian Bureau of Statistics [2020b] Australian Bureau of Statistics, “8165.0 - Counts of Australian Businesses, including Entries and Exits, June 2015 to June 2019,” 2020. [Online]. Available: https://www.abs.gov.au/AUSSTATS/abs@.nsf/DetailsPage/8165.0June2015toJune2019?OpenDocument
  * Smith [2016] M. Smith, “Huge Rise in Hack Attacks as Cyber-Criminals Target Small Businesses,” _Guard._ , Feb 2016. [Online]. Available: https://www.theguardian.com/small-business-network/2016/feb/08/huge-rise-hack-attacks-cyber-criminals-target-small-businesses
  * McDonald [2019] C. McDonald, “A Whopping 78% of Small Business Are Being Targeted by Cyber Criminals. Here’s How to Stay Ahead,” 2019. [Online]. Available: https://www.smartcompany.com.au/finance/fraud/cyber-crime-stay-ahead/
  * Microsoft [2017a] Microsoft, “Planning the Development, Testing, Staging, and Production Environments,” 2017. [Online]. Available: https://docs.microsoft.com/en-us/biztalk/technical-guides/planning-the-development-testing-staging-and-production-environments
  * Raul [2020] H. Raul, “Setting up Systems for a Staged Upgrade,” 2020. [Online]. Available: https://docs.bmc.com/docs/brid91/en/setting-up-systems-for-a-staged-upgrade-825210729.html
  * Iyamuremye and Shima [2018] B. Iyamuremye and H. Shima, “Network Security Testing Tools for SMEs (Small and Medium Enterprises),” in _Proc. 4th IEEE Int. Conf. Appl. Syst. Innov. 2018, ICASI 2018_. IEEE, 2018, pp. 414–417.
  * Rapid7 [2019] Rapid7, “Metasploit Framework,” 2019. [Online]. Available: https://metasploit.help.rapid7.com/docs/msf-overview
  * Deloitte [2019b] Deloitte, “The economic value of cloud services in Australia,” 2019. [Online]. Available: https://www2.deloitte.com/content/dam/Deloitte/au/Documents/Economics/deloitte-au-economics-value-cloud-services-australia-230719.pdf
  * Gartner Inc [2020] Gartner Inc, “Gartner Forecasts Worldwide Public Cloud End-User Spending to Grow 18% in 2021,” 2020. [Online]. Available: https://www.gartner.com/en/newsroom/press-releases/2020-11-17-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-grow-18-percent-in-2021
  * Chiappetta [2020] M. Chiappetta, “Uber Eats Demand Soars Due To COVID-19 Crisis,” _Forbes_ , Mar 2020. [Online]. Available: https://www.forbes.com/sites/marcochiappetta/2020/03/25/uber-eats-demand-soars-due-to-covid-19-crisis
  * Dignan [2019] L. Dignan, “Uber vs. Lyft: How the Rivals Approach Cloud, AI, and Machine Learning,” _ZDNet_ , May 2019. [Online]. Available: https://www.zdnet.com/article/uber-vs-lyft-how-the-rivals-approach-cloud-ai-machine-learning/
  * Detken et al. [2013] K. O. Detken, M. Jahnke, H. Birkholz, and C. Dwertmann, “Design and Implementation of Virtual Security Appliances (VSA) for SME,” in _Proc. 2013 IEEE 7th Int. Conf. Intell. Data Acquis. Adv. Comput. Syst. IDAACS 2013_ , vol. 1, no. September. IEEE, 2013, pp. 30–35.
  * Spyse [2020] Spyse, “Spyse Subscriptions,” 2020. [Online]. Available: https://spyse.com/user/subscription
  * Tenable [2020] Tenable, “Purchase Tenable Solutions,” 2020. [Online]. Available: https://www.tenable.com/buy
  * Intruder [2020] Intruder, “External Vulnerability Scanner,” 2020. [Online]. Available: https://www.intruder.io/
  * Amazon AWS [2020] Amazon AWS, “AWS Customer Support Policy for Penetration Customer Service Policy for Penetration Testing,” 2020. [Online]. Available: https://aws.amazon.com/security/penetration-testing/
  * Microsoft [2020] Microsoft, “Microsoft Cloud Penetration Testing Rules of Engagement,” pp. 1–3, 2020. [Online]. Available: https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement?rtc=1
  * Google [2020a] Google, “Cloud Security FAQ,” 2020. [Online]. Available: https://support.google.com/cloud/answer/6262505?hl=en
  * August and Tunca [2011] T. August and T. I. Tunca, “Who Should Be Responsible for Software Security? a Comparative Analysis of Liability Policies in Network Environments,” _Manage. Sci._ , vol. 57, no. 5, pp. 934–959, 2011.
  * Selznick and LaMacchia [2018] L. Selznick and C. LaMacchia, “Cybersecurity Liability: How Technically Savvy Can We Expect Small Business Owners to Be?” _J. Bus. Technol. Law_ , vol. 13, no. 2, p. 217, 2018.
  * Australian Communications and Media Authority (2013) [ACMA] Australian Communications and Media Authority (ACMA), “The Connected Business - ACMA research snapshot,” 2013. [Online]. Available: https://www.youtube.com/watch?v=etjjds2PIN0
  * Harris and Patten [2014] M. A. Harris and K. P. Patten, “Mobile Device Security Considerations for Small- and Medium-Sized Enterprise Business Mobility,” _Inf. Manag. Comput. Secur._ , vol. 22, no. 1, pp. 97–114, 2014.
  * Google [2020b] Google, “GSuite by Google Cloud Endpoint Management,” 2020. [Online]. Available: https://gsuite.google.com/products/admin/endpoint/
  * Perez [2019] S. Perez, “Apple Is Making Corporate ‘BYOD’ Programs Less Invasive to User Privacy,” _TechCrunch_ , Jun 2019. [Online]. Available: https://techcrunch.com/2019/06/10/apple-is-making-corporate-byod-programs-less-invasive-to-user-privacy/
  * Microsoft [2017b] Microsoft, “Technology decisions for BYOD with EMS — Microsoft Docs,” pp. 1–5, 2017. [Online]. Available: https://docs.microsoft.com/en-gb/intune/fundamentals/byod-technology-decisions
  * Google [2020c] Google, “Overview : Manage devices with Google endpoint management Tailor your basic mobile device management,” 2020. [Online]. Available: https://support.google.com/a/answer/1734200?hl=en-AU
  * Glassdoor [2019] Glassdoor, “Average IT Administrator Salaries,” 2019. [Online]. Available: https://www.glassdoor.com.au/Salaries/it-administrator-salary-SRCH_KO0,16.htm
  * Taylor [2014] L. Taylor, “Happy 25 years of the internet, Australia,” _SBS News_ , Jun 2014. [Online]. Available: http://www.sbs.com.au/news/article/2014/06/24/happy-25-years-internet-australia
  * Organisation for Economic Co-operation and Development (2019) [OECD] Organisation for Economic Co-operation and Development (OECD), “Survey of Adult Skills (PIAAC): Full selection of indicators,” Paris, 2019. [Online]. Available: https://gpseducation.oecd.org/IndicatorExplorer
  * Walker et al. [2007] E. Walker, J. Redmond, B. Webster, and M. Le Clus, “Small Business Owners: Too Busy to Train?” _J. Small Bus. Enterp. Dev._ , vol. 14, no. 2, pp. 294–306, 2007.
  * Scott and Bruce [1987] M. Scott and R. Bruce, “Five Stages of Growth in Small Business,” _Long Range Plann._ , vol. 20, no. 3, pp. 45–52, 1987.
  * Alqatawna [2014] J. Alqatawna, “The Challenge of Implementing Information Security Standards in Small and Medium e-Business Enterprises,” _J. Softw. Eng. Appl._ , vol. 7, no. 10, p. 883, 2014.
  * National Institute of Standards and Technology [2018] National Institute of Standards and Technology, “NIST Framework for Improving Critical Infrastructure Cybersecurity,” 2018. [Online]. Available: https://doi.org/10.6028/NIST.CSWP.04162018
  * ISACA [2019b] ISACA, “COBIT 2019 Publications & Resources,” 2019. [Online]. Available: http://www.isaca.org/COBIT/Pages/COBIT-2019-Publications-Resources.aspx
  * Standards Australia Limited [2015] Standards Australia Limited, “AS ISO/IEC 27001 Australian Standard Information Technology - Security Techniques - Information Security Management Systems - Requirements,” 2015.
  * Australian Signals Directorate and Australian Cyber Security Centre [2020] Australian Signals Directorate and Australian Cyber Security Centre, “Australian Government Information Security Manual,” Jun 2020. [Online]. Available: https://www.cyber.gov.au/sites/default/files/2020-06/AustralianGovernmentInformationSecurityManual%28June2020%29.pdf
  * Commonwealth of Australia [2017] Commonwealth of Australia, “Cyber Security: The Small Business Best Practice Guide,” 2017. [Online]. Available: https://www.asbfeo.gov.au/sites/default/files/documents/ASBFEO-cyber-security-research-report.pdf
  * Australian Cyber Security Centre [2019a] Australian Cyber Security Centre, “Australian Signal Directorate Essential Eight Maturity Model,” 2019. [Online]. Available: https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
  * Australian Cyber Security Centre [2020] ——, “Small Business Cyber Security Guide,” 2020. [Online]. Available: https://www.cyber.gov.au/acsc/view-all-content/publications/small-business-cyber-security-guide
  * Maddux and Rogers [1983] J. E. Maddux and R. W. Rogers, “Protection Motivation and Self-Efficacy: A Revised Theory of Fear Appeals and Attitude Change,” _J. Exp. Soc. Psychol._ , vol. 19, no. 5, pp. 469–479, 1983.
  * Renaud [2016] K. Renaud, “How Smaller Businesses Struggle With Security Advice,” _Comput. Fraud Secur._ , vol. 2016, no. 8, pp. 10–18, 2016. [Online]. Available: http://dx.doi.org/10.1016/S1361-3723(16)30062-8
  * ISACA [2019c] ISACA, _COBIT 2019 : Design Guide Designing an Information and Technology Governance Solution_ , Information Systems Audit and Control Association, Ed. Rolling Meadows, IL: ISACA, 2019.
  * Insurance Business Australia [2020] Insurance Business Australia, “Cyber Insurance Products,” pp. 1–4, 2020. [Online]. Available: https://www.insurancebusinessmag.com/au/commercial-insurance-coverage-area/cyber-12/
  * Cyber Insurance Australia [2020] Cyber Insurance Australia, “Cyber Insurance Australia Quote Form,” 2020. [Online]. Available: https://www.cyberinsuranceaustralia.com.au/
  * BizCover [2019] BizCover, “Fact sheet Cyber Liability Insurance,” 2019. [Online]. Available: https://www.bizcover.com.au/wp-content/uploads/2019/12/BC1243_FactSheet_CyberLiability_Nov19_FINAL-5.pdf
  * Davenport [2017] A. Davenport, “Is Cyber Insurance Really Worth It?” _CRN Mag._ , Feb 2017\. [Online]. Available: https://www.crn.com.au/feature/is-cyber-insurance-really-worth-it-451442/page0
  * Satariano and Perlroth [2019] A. Satariano and N. Perlroth, “Big Companies Thought Insurance Covered a Cyberattack. They May Be Wrong. - The New York Times,” _New York Times_ , pp. 3–5, 2019. [Online]. Available: https://www.nytimes.com/2019/04/15/technology/cyberinsurance-notpetya-attack.html
  * Organisation for Economic Co-operation and Development (2017) [OECD] Organisation for Economic Co-operation and Development (OECD), “Enhancing the Role of Insurance in Cyber Risk Management,” 2017.
  * Lloyds of London [2017] Lloyds of London, “Counting the Cost: Cyber Exposure Decoded,” 2017. [Online]. Available: https://www.lloyds.com/news-and-insight/risk-insight/library/technology/countingthecost
  * Greenberg [2018] A. Greenberg, “The Untold Story of NotPetya, the Most Devastating Cyberattack in History,” _Wired_ , Aug 2018. [Online]. Available: https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/
  * ABC News [2017] ABC News, “Petya Cyber Attack: Ransomware Virus Hits Computer Servers Across Globe, Australian Office Affected,” _ABC News_ , Jun 2017. [Online]. Available: https://www.abc.net.au/news/2017-06-28/ransomware-virus-hits-computer-servers-across-the-globe/8657626
  * Crozier [2018] R. Crozier, “DLA Piper Paid 15000 Hours of IT Overtime after NotPetya Attack,” _ITNews_ , Mar 2018. [Online]. Available: https://www.itnews.com.au/news/dla-piper-paid-15000-hours-of-it-overtime-after-notpetya-attack-490495
  * Taylor [2018] A. Taylor, “Australian Government attribution of the ’NotPetya’ cyber incident to Russia,” 2018. [Online]. Available: https://www.dfat.gov.au/sites/default/files/australia-attributes-cyber-incident-to-russia.pdf
  * Cross et al. [2014] C. Cross, R. G. Smith, and K. Richards, “Challenges of Responding to Online Fraud Victimisation in Australia,” 2014. [Online]. Available: https://www.aic.gov.au/sites/default/files/2020-05/tandi474.pdf
  * Reitano et al. [2015] T. Reitano, T. Oerting, and M. Hunter, “Innovations in international cooperation to counter cybercrime: The Joint Cybercrime Action Taskforce,” _Eur. Rev. Organ. Crime_ , vol. 2, no. 2, pp. 142–154, 2015.
  * Bamford [2014] J. Bamford, “The Most Wanted Man in The World,” _Wired Mag._ , Jun 2014\. [Online]. Available: https://www.wired.com/2014/08/edward-snowden/
  * Szoldra [2016] P. Szoldra, “This Is Everything Edward Snowden Revealed in One Year of Unprecedented Top-Secret Leaks,” _Bus. Insid. India_ , Sep 2016. [Online]. Available: https://www.businessinsider.in/This-is-everything-Edward-Snowden-revealed-in-one-year-of-unprecedented-top-secret-leaks/articleshow/54367926.cms
  * Khadem [2020] N. Khadem, “Coronavirus wreaks havoc on wedding industry as Chinese factories remain closed and workers quarantined,” _ABC News_ , Feb 2020. [Online]. Available: https://www.abc.net.au/news/2020-02-27/coronavirus-closes-chinese-factories-affecting-wedding-industry/12002854
  * Broadsheet [2020] Broadsheet, “Live List: Melbourne Restaurants Pivoting to Takeaway Due to Coronavirus,” 2020. [Online]. Available: https://www.broadsheet.com.au/melbourne/guides/live-list-melbourne-restaurants-pivoting-takeaway-due-coronavirus
  * Gallagher [2020] N. Gallagher, “One of KC’s Best Craft Cocktail Bars Adapts With Bottled Drinks and Kits During Coronavirus Quarantine,” _Kansas City Mag._ , Mar 2020. [Online]. Available: https://www.kansascitymag.com/cocktail-hour-during-coronavirus-outbreak/
  * Longbottom [2020] J. Longbottom, “Coronavirus forces businesses to adapt to survive the COVID-19 pandemic,” _ABC News_ , Mar 2020. [Online]. Available: https://www.abc.net.au/news/2020-03-19/how-businesses-adapting-to-survive-covid-19-coronavirus/12068696
  * Gray [2020] D. Gray, “Craft Brewer Pivots to Hand Sanitiser as Firms Rise to Virus Challenge,” _Age (Omaha)._ , Mar 2020. [Online]. Available: https://www.theage.com.au/business/companies/craft-brewer-pivots-to-hand-sanitiser-as-firms-rise-to-virus-challenge-20200327-p54ehh.html
  * De Vries and Shields [2006] H. De Vries and M. Shields, “Towards a Theory of Entrepreneurial Resilience : A Case Study Analysis of New Zealand SME Owner Operators,” _Appl. Res. J._ , vol. 5, no. 1, pp. 33–44, 2006.
  * Branicki et al. [2018] L. J. Branicki, B. Sullivan-Taylor, and S. R. Livschitz, “How Entrepreneurial Resilience Generates Resilient SMEs,” _Int. J. Entrep. Behav. Res._ , vol. 24, no. 7, pp. 1244–1263, 2018.
  * Eshet-Alkalai and Chajut [2010] Y. Eshet-Alkalai and E. Chajut, “You Can Teach Old Dogs New Tricks: The Factors That Affect Changes over Time in Digital Literacy,” _J. Inf. Technol. Educ. Res._ , vol. 9, pp. 173–181, 2010.
  * Freed [2014] S. E. Freed, “Examination of Personality Characteristics Among Cybersecurity and Information Technology Professionals,” Masters, University of Tennessee at Chattanoog, 2014. [Online]. Available: https://scholar.utc.edu/theses/127/
  * Bashir et al. [2015] M. Bashir, A. Lambert, J. M. C. Wee, and B. Guo, “An Examination of the Vocational and Psychological Characteristics of Cybersecurity Competition Participants,” _USENIX Summit Gaming, Games, Gamification Secur. Educ._ , pp. 1–8, 2015.
  * Hall and Rao [2020] J. L. Hall and A. Rao, “Non-Technical Skills Needed by Cyber Security Graduates,” in _IEEE Educ. Conf._ Porto, Portugal: IEEE Education Society, 2020, pp. 14–18.
  * Zhao and Seibert [2006] H. Zhao and S. E. Seibert, “The Big Five Personality Dimensions and Entrepreneurial Status: A Meta-Analytical Review,” _J. Appl. Psychol._ , vol. 91, no. 2, pp. 259–271, 2006.
  * Business Victoria [2019] Business Victoria, “Small Business Workshops and Events,” 2019. [Online]. Available: https://www.business.vic.gov.au/events
  * Australian Cyber Security Centre [2019b] Australian Cyber Security Centre, “Small Business Cyber Security Guide,” 2019\. [Online]. Available: https://www.cyber.gov.au/sites/default/files/2019-10/SmallBusinessCyberSecurityGuide.pdf
  * Vroom and Von Solms [2004] C. Vroom and R. Von Solms, “Towards Information Security Behavioural Compliance,” _Comput. Secur._ , vol. 23, no. 3, pp. 191–198, 2004.
  * Von Solms and Van Niekerk [2013] R. Von Solms and J. Van Niekerk, “From Information Security to Cyber Security,” _Comput. Secur._ , vol. 38, pp. 97–102, 2013. [Online]. Available: http://dx.doi.org/10.1016/j.cose.2013.04.004
  * IDCare [2019] IDCare, “IDCare,” 2019. [Online]. Available: https://www.idcare.org
  * [162] Australian Cyber Security Centre, “ReportCyber, Are You a Victim of Cybercrime?” [Online]. Available: https://www.cyber.gov.au/acsc/report
  * Australian Competition and Consumer Commission [2019] Australian Competition and Consumer Commission, “ScamWatch,” 2019. [Online]. Available: https://www.scamwatch.gov.au/
  * Verizon [2019] Verizon, “2019 Data Breach Investigations Report,” 2019. [Online]. Available: https://enterprise.verizon.com/resources/reports/2019-data-breach-investigations-report.pdf
  * Abolhassan [2017] F. Abolhassan, _Cyber Security. Simply. Make it Happen. Leveraging Digitization Through IT Security_ , 1st ed. Springer International Publishing : Imprint: Springer, 2017.
  * AusCERT [2019] AusCERT, “AusCERT Become a Member,” 2019. [Online]. Available: https://www.auscert.org.au/become-a-member/
  * Australian Cyber Security Centre [2021] Australian Cyber Security Centre, “Become a Partner,” 2021. [Online]. Available: https://www.cyber.gov.au/partner-hub/become-a-partner#no-back
  * Yanpiboon and Schjoedt [2017] T. Yanpiboon and L. Schjoedt, “The Effect of Strategic Alliance on Small Business Performance: A Meta- Analysis,” in _ICSB World Conf. Proc._ , Washington, 2017.
  * Rose et al. [2020] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero Trust Architecture \- NIST Special Publication 800-207,” 2020. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207-draft2.pdf
  * Kindervag [2016] J. Kindervag, “No More Chewy Centers: The Zero Trust Model Of Information Security Vision: The Security Architecture And Operations Playbook,” 2016. [Online]. Available: http://crystaltechnologies.com/wp-content/uploads/2017/12/forrester-zero-trust-model-information-security.pdf
  * Australian National University [2019] Australian National University, “Incident Report on the Breach of the Australian National University Administrative Systems,” 2019. [Online]. Available: https://imagedepot.anu.edu.au/scapa/Website/SCAPA190209_Public_report_web_2.pdf
  * BeyondCorp [2014] BeyondCorp, “Beyondcorp : A New Approach to Enterprise Security,” 2014. [Online]. Available: www.beyondcorp.com
  * Curran [2016] J. Curran, “Chaffetz Urges ’Zero-Trust Model’ For Network Security,” _Cybersecurity Policy Rep._ , Sep 2016.
  * Ward and Beyer [2014] R. Ward and B. Beyer, “Beyondcorp : A New Approach to Enterprise Security,” _;login Mag. USENIX SAGE_ , vol. 39, no. 6, pp. 6–11, 2014. [Online]. Available: https://storage.googleapis.com/pub-tools-public-publication-data/pdf/43231.pdf
  * SE Radio [2019] SE Radio, “SE Radio: Episode 385: Evan Gilman and Doug Barth on Zero-Trust Networks,” 2019. [Online]. Available: https://www.youtube.com/watch?v=ES-6zAQo1WU
  * Kindervag [2010] J. Kindervag, “Build Security Into Your Network’s DNA: The Zero Trust Network Architecture,” 2010. [Online]. Available: http://www.virtualstarmedia.com/downloads/Forrester_zero_trust_DNA.pdf
  * Escobedo et al. [2017] V. Escobedo, B. Beyer, M. Saltonstall, and F. Zyzniewski, “BeyondCorp 5: The User Experience,” _;login Mag. USENIX SAGE_ , vol. 42, no. 3, pp. 38–43, 2017. [Online]. Available: https://storage.googleapis.com/pub-tools-public-publication-data/pdf/c8da594124dab1f91e6750995e2b7805403b19f1.pdf
  * Cittadini et al. [2016] L. Cittadini, B. Spear, B. Beyer, and M. Saltonstall, “BeyondCorp Part III: The Access Proxy,” _;login Mag. USENIX SAGE_ , pp. 28–33, 2016. [Online]. Available: https://storage.googleapis.com/pub-tools-public-publication-data/pdf/45728.pdf
  * Queensland Government [2020] Queensland Government, “Open source software guideline Guideline,” 2020. [Online]. Available: https://www.qgcio.qld.gov.au/documents/open-source-software-guideline
  * [180] Digital Transformation Agency, “Simple, clear and fast public services.” [Online]. Available: https://www.dta.gov.au/help-and-advice/digital-service-standard/digital-service-standard-criteria
  * [181] Victorian Government, “Vic Open Source Policy.pdf.” [Online]. Available: https://www.vic.gov.au/make-your-project-open-source-digital-standards
  * Australian Government Information Management Office [2011] Australian Government Information Management Office, “A Guide to Open Source Software for Australian Government Agencies,” 2011. [Online]. Available: https://www.ghdonline.org/uploads/AGuidetoOpenSourceSoftware.pdf
  * Cisco [2020] Cisco, “Snort Intrusion Detection System,” 2020. [Online]. Available: https://www.snort.org/
  * Welte and Ayuso [2014] H. Welte and P. N. Ayuso, “The netfilter.org Project,” 2014. [Online]. Available: https://netfilter.org/
  * Lyon [2019] G. Lyon, “NMap Tool,” 2019. [Online]. Available: https://nmap.org/
  * Free Software Foundation [2007] Free Software Foundation, “GNU General Public License,” 2007. [Online]. Available: https://www.gnu.org/licenses/gpl-3.0.en.html
  * Creative Commons [2020] Creative Commons, “Creative Commons,” pp. 1–7, 2020. [Online]. Available: https://creativecommons.org/
  * CyberX [2018] CyberX, “Free CyberSecurity Tools : The Ultimate List (2018),” 2018. [Online]. Available: https://cyberx.tech/free-cybersecurity-tools/
  * Ven et al. [2008] K. Ven, J. Verelst, and H. Mannaert, “Should You Adopt Open Source Software?” _IEEE Softw._ , vol. 25, no. 3, pp. 54–59, 2008.
  * Alojail [2013] M. A. Alojail, “ITIL usage, and use of ITIL recommended practices and the IT outsourcing relationship quality,” Ph.D. dissertation, RMIT, 2013.
  * RedHat [2020] RedHat, “What’s the difference between Fedora and Red Hat Enterprise Linux?” 2020. [Online]. Available: https://www.redhat.com/en/topics/linux/fedora-vs-red-hat-enterprise-linux
  * Ebart [2008] C. Ebart, “Open Source Software in Industry,” _IEEE Softw._ , vol. 25, no. 3, pp. 52–53, 2008.
  * Wesselius [2008] J. Wesselius, “The Bazaar inside the Cathedral: Business Models for Internal Markets,” _IEEE Softw._ , vol. 25, no. 3, pp. 60–66, 2008.
  * PyCon AU [2021] PyCon AU, “Pyconlineau,” 2021. [Online]. Available: https://2021.pycon.org.au/
  * [195] Linux Australia, “Linux Australia.” [Online]. Available: https://linux.org.au/