Version 1
: Received: 22 August 2024 / Approved: 23 August 2024 / Online: 23 August 2024 (07:15:44 CEST)
How to cite:
El-Hajj, M.; Mirza, Z. A. Protecting Small and Medium Enterprises: A Specialized Cybersecurity Risk Assessment Framework and Tool. Preprints2024, 2024081691. https://doi.org/10.20944/preprints202408.1691.v1
El-Hajj, M.; Mirza, Z. A. Protecting Small and Medium Enterprises: A Specialized Cybersecurity Risk Assessment Framework and Tool. Preprints 2024, 2024081691. https://doi.org/10.20944/preprints202408.1691.v1
El-Hajj, M.; Mirza, Z. A. Protecting Small and Medium Enterprises: A Specialized Cybersecurity Risk Assessment Framework and Tool. Preprints2024, 2024081691. https://doi.org/10.20944/preprints202408.1691.v1
APA Style
El-Hajj, M., & Mirza, Z. A. (2024). Protecting Small and Medium Enterprises: A Specialized Cybersecurity Risk Assessment Framework and Tool. Preprints. https://doi.org/10.20944/preprints202408.1691.v1
Chicago/Turabian Style
El-Hajj, M. and Zuhayr Aamir Mirza. 2024 "Protecting Small and Medium Enterprises: A Specialized Cybersecurity Risk Assessment Framework and Tool" Preprints. https://doi.org/10.20944/preprints202408.1691.v1
Abstract
As the number of Small and Medium Enterprises (SMEs) rises in the world, the amount of sensitive data used also increases, making them targets for cyberattacks. SMEs face a host of issues such as lack of resources, and poor cybersecurity talent, resulting in multiple vulnerabilities that increase overall risk. Cybersecurity risk assessment frameworks have been developed by multiple organizations such as the National Institute of Science and Technology (NIST) and the International Organization for Standardization (ISO), but they are complicated to understand, and challenging to implement. This research aimed to create an effective cybersecurity risk assessment framework specifically for SMEs while considering their limitations. This was achieved by first identifying common threats and vulnerabilities and categorizing them according to their importance, and risk. Secondly, popular frameworks like the NIST CSF and ISO 27001/2 were analyzed for their proficiencies and deficiencies while identifying relevant areas for SMEs. Finally, novel techniques catered to SMEs were explored and incorporated to create an effective framework for SMEs. This framework was also developed in the form of a tool, providing an interactive and dynamic environment. The tool was effective and the framework is a promising start but requires more quantitative analysis.
Computer Science and Mathematics, Information Systems
Copyright:
This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
