A large-scale interview study on information security in and attacks against small and medium-sized enterprises

verfasst von
Nicolas Huaman, Bennet von Skarczinski, Christian Stransky, Dominik Wermke, Yasemin Acar, Arne Dreißigacker, Sascha Fahl
Abstract

Cybercrime is on the rise. Attacks by hackers, organized crime and nation-state adversaries are an economic threat for companies world-wide. Small and medium-sized enterprises (SMEs) have increasingly become victims of cyberattacks in recent years. SMEs often lack the awareness and resources to deploy extensive information security measures. However, the health of SMEs is critical for society: For example, in Germany, 38.8% of all employees work in SMEs, which contributed 31.9% of the German annual gross domestic product in 2018. Many guidelines and recommendations encourage companies to invest more into their information security measures. However, there is a lack of understanding of the adoption of security measures in SMEs, their risk perception with regards to cybercrime and their experiences with cyberattacks. To address this gap in research, we performed 5,000 computer-assisted telephone-interviews (CATIs) with representatives of SMEs in Germany. We report on their experiences with cybercrime, management of information security and risk perception. We present and discuss empirical results of the adoption of both technical and organizational security measures and risk awareness in SMEs. We find that many technical security measures and basic awareness have been deployed in the majority of companies. We uncover differences in reporting cybercrime incidences for SMEs based on their industry sector, company size and security awareness. We conclude our work with a discussion of recommendations for future research, industry and policy makers.

Organisationseinheit(en)
Fachgebiet IT-Sicherheit
Externe Organisation(en)
Helmholtz-Zentrum für Informationssicherheit (CISPA)
PricewaterhouseCoopers GmbH Wirtschaftsprüfungsgesellschaft (PwC)
Kriminologisches Forschungsinstitut Niedersachsen e.V. (KFN)
Max-Planck-Institut für Sicherheit und Privatsphäre
Typ
Aufsatz in Konferenzband
Seiten
1235-1252
Anzahl der Seiten
18
Publikationsdatum
2021
Publikationsstatus
Veröffentlicht
Peer-reviewed
Ja
ASJC Scopus Sachgebiete
Computernetzwerke und -kommunikation, Information systems, Sicherheit, Risiko, Zuverlässigkeit und Qualität
Ziele für nachhaltige Entwicklung
SDG 16 – Frieden, Gerechtigkeit und starke Institutionen
Elektronische Version(en)
https://www.usenix.org/conference/usenixsecurity21/technical-sessions (Zugang: Offen)