Managing Cybersecurity For Small Business: Risks, Impacts, And Mitigation Strategies

Project Objective

Discuss About The Creativity For Responsible And Sustainable Business.

Technology has very rapidly become part of the world around us. Most of the things we do are technologically endorsed. Beginning from our personal level, business levels, and many other forms of technology. Both small business and huge organizations have endorsed modern technology. Such growth of technology has led to the development of activities in the business. Business operations have also improved with the coming of technology. There are several implications of what technology has done in opening up business opportunities for small businesses. Technology has also created rise of competition within the various markets. This has been done by exposing businesses to global markets without suffering huge costs. The global market is now easily reachable and readily available for simple business owners. Technology has also enhanced consumer producer communication. It is now easier for business owner to communicate with their customers through the help of communication Curran and Storey 2016.

With all this in place technology has also exposed the business into various risks. These risks are the ones that makes small business to be exposed to various threats. The threats are what is referred to as cyber security threats. Though cyber security threats have been reported by various organization. This research only focuses on the risks that the cyber security have on small businesses. The small business that undergo various threats. The cyber security threats has led to small businesses endorsing various types of modifications in their daily operations.

The research looks at the possible solution of the different form of cyber security threats. The three main cyber security threats for small business are; internet leak of crucial information, use of opaque algorithms that lose visibility into the functioning and interaction of their systems. Opaque algorithms also expose the business to unintended interactions. Lastly, the cyber security threat that is also focused upon is the silencing of any exposure reports. The reports that warn about cyber security threats to a business owner is usually silenced before the information reaches the small business owners.

The project is developed in order to look at an analytic way of cyber security threats having effect on small businesses. The project is therefore focused in finding the implication that cyber security threats have to an institution.  The projects are supposed to develop the various type’s problems and how they have affected the operations of the businesses. The objective of the project are;

Project Scope

Develop understanding of how the various types of cyber security threats affect the operations of the business. This objective will be surrounded in trying to find out, how cyber security threats are impacting on the development that technology is supposed to have in a business set up but instead affects the operations of the business.

The project will also seek to find out the cyber security issues that affect the businesses more. The ones that have grave effect to the businesses than others.

The project also will look into finding out mitigation processes that the business might undertake to salvage the situation from the possible threats. The cyber security issues that are developed and the various strategies that can be employed to help evaluate the security issues.

The project will also develop different literatures that talk about the cyber security threats on small businesses. These literature review developed by the project can be used for future references, in case a business owner is looking for mitigation ways of saving their enterprise.

The project also seeks to evaluate the various types of cyber security business threats. Moreover identifying the business threats that are more real to a particular business opportunity and the most fortunate affected operations by the particular security threats.

The project is based on trying to find out the possible effects of cyber security on business. The project therefore requires a literature review that will form a primary deliverable for the analysis that helps in highlighting the possible solution of such threats to this business organizations. The project will also focus on giving the findings and recommendations that if endorsed by the businesses will form a solution, either temporary or permanent to the cyber threats. The project scope items will therefore include;

Cyber security threats risk analysis on business: The project considers as the main problem. The project will therefore analyze various risk faced by the businesses due to lack of cyber security. Being a primary factor the project will have to look at a good number of diversified businesses. The analysis also includes prompt visitation on the benefits of technology on the business. An in-depth analysis therefore follows of the risk the business is facing despite the mentioned benefits.

Evaluation of the impact of cyber security threats; the project also looks to find the impact that these threats have had on the operations of the businesses. The particular operations include daily business operation and long term operations of the business. The project also seeks to find out the impact of the business monetary terms. The project therefore will look into the financials status of the institutions before and after the realization the cyber security threats.

Challenges of Cybersecurity in Business

Suggestions of probable solutions: the project after evaluating the various cyber threats. The project will go further to find the probable solutions that can be used to reduce the cyber security threats. The project will therefore find the solutions from previously affected business and how they came up with a lasting solution. The project will also find out possible solutions from IT experts and what they would do in case one is faced with one of three types of cyber security threats. The project also focuses on preventive measures. Preventive measures that when undertaken there is reduction of cyber security threats in the business organizations.

The project will therefore involve small business owners as the primary stakeholders. IT experts will also be engaged as the senior professionals in such a field. The project might also involve various financial analyst of the business organizations.

Lastly the project is limited to small business enterprises but might at times used established organization for references.

According to Tisdale (2015) many businesses have invested in the use of cyber facilities to improve their business operations. The literature further recognizes that effective cyber facilities have worked in favor of this businesses. Investment in cyber facilities have led to the improvement of services to the customers. According to one of the customers investment in cyber technology has made it easier for them to book services of the hotel any time of the day. This is one proof of how cyber investment has led to the development of businesses. Another customer confessed that it easier to make formal complaints through cyber enabled devices in relation to the service provided by the business. Better enough easier payments methods have also been developed through cyber enabled facilities. However with the development of web and global technology operations. There is increased growth of cyber. Security threats. These development of cyber security threat is one of the major problems facing businesses that invest in cyber developments for prosperity of their businesses.

There are three main cyber security issues. These security issues are based on the cyber-criminal activities. These cyber-criminal activities have increasingly developed in the past decade. The threats are developed from misuse of technology and the alignment of hacking operations.

According to Chertoff and Simon (2015, the first type of security threat is one that interferes with the financial systems, so that the cyber criminals can have their hands on the money of the institution, without the institution knowing. These therefore leads to the loss of the company’s profit that will eventually interfere with the profit margins of the company.

Overview of the Cybersecurity Issues and Threats

The second cyber security threat according to (Conti et al 2018.) is the use of cyber threats to harm the reputation of the business. The criminals develop web based threats that harm the legal operations of the business. These therefore destroys the operations of the business since the customers might lose trust in the business due to poor reputation. The threats therefore eventually lead to the business losses either way.

According to Rawat and Bajracharya (2015) the major issues and threats agents include software malwares, lack of cyber training, absence of proper recover plan, lack of proper cyber security policy by the enterprises and security general basics that might include settings. These are the major causative agents for cyber security threats.

The presence of cyber security threats form major hindrances on the executions of operations of the business. It does not only affect the functions of the organization but also on financial stability and legal procedures of the firm too. The impacts can be divided into three broad subsections that include;

Economic cost impact caused by cyber security threat attack.

Legal consequences of the cyber security attack.

Lee, Bhageri and Jin (2016) state that cyber-attacks are mostly done to achieve financials losses of the target business. The various financial information are stolen so that monetary values are lost from the business. The loss of corporate information and trading disruptions affect the functionality of the business. This therefore affects the economic cost of the business. According to Gupta, Agrawal and Yamaguchi 2016). The loss of corporate information affects the economic management of the company. This information can definitely lead to loss of investors and clients. Once the business has lost clients and investors then automatically affects the economic cost of the business.

 According to (Song, Fink and Jeschke 2017) reputational damage is easier done through cyber-attacks than any other methods. A cyber-criminal might use the database of a business in sending false promotional advertisements. The business shall have lost the reputation. Reputational damage cannot be repaired within a short period. This is because customers are likely to drop the business for another whose reputation is clean. The major factor of development who are the clients is also lost. Therefore the business is not likely to develop.

Problems that arise from legal obligations are very common with cyber-attacks this is according to the literature by (Carr 2016). The theft of information can when used to generate copyright problems for the business. The business will therefore struggling to clear its name legally. As they struggle with legal procedures, there is little or no time for business development.

4.5 Possible solutions to the cyber security threats

As noted by Arabo (2015), there are two possible solutions that can be developed for cyber security threats. The ones that prevent the cyber-attack and one that act as a solution to already committed attack. These methods can both assist in developing security measures for the business.

Some of the preventive measures include;

Cyber security policy implementation. According to (Buckaz and Guven 2016), the cyber-attack can be prevented if a non-penetrable wall is created. The wall therefore prevent the sites from any external attacks. The policy also prevents any external person to view information that they are not allowed to see from the business website. Therefore when the policy protects the data, it prevent any external threats of cyber-attacks.

The second preventive measure is the use monitor systems for BYOD. According to (Patrick and Fields 2017). The employees at the business can stay web connected. When they stay connected they can easily detect any body that is causing security threats. The business owner will therefore be required to install devices for every employee so that they monitor every other website user.

The other two methods are recovery plans that seek to salvage the situation after an attempted attack or a successful cyber-attack.

Data recovery plan. According to Mendel (2017) the growth of cyber security has made it possible for IT experts to develop recovery plan for lost data. When an attack is done and data has been interfered with, it’s possible for the business to recover the important plans through installing of the data recovery plan with the help of an expert.

The other method of recovering from a cyber-attack is installation of basic security features. This is the method that most business recover with from cyber-attacks as noted by (Fonseca and Rosen 2017). This method includes the development of three important cyber features. These features include; firewall, authentication and authorization. The business is therefore free to legally convict anyone who has used any of the walls and they are not authorized to do so. The person can therefore help in further recovery of the lost data.

The review has focused on the major parts of the project that include; major cyber security issues, their types, their impact on the businesses and organizations and the possible measures that can be taken against technological cyber-attacks. These analysis is therefore helpful in other parts of the projects since it broadens the scope of the problem. Most of the literatures however focus on huge enterprise institutions, which collect a lot of annual revenue. They however overlook small enterprise business that might be owned by less than one owner. This is the main gap that the project seeks to achieve.

Primary question

How does technological cyber-crimes affect profits of small enterprise businesses?

Secondary questions

• Do the small enterprise business use technology in their daily operations?
• The technology used in small business attract cyber-attacks? (Why and why not)
• Are the effects encountered in large enterprises the same as the ones encountered by small enterprises in relation to cyber-attacks and cyber security threats?

The project will explore qualitative research due to the nature of problem that we are faced with. For purposes of validity and reliability this choice research design will ensure the research is valid by using the appropriate methodology.  

The project explores action research methodology. This method makes the research valid as it will exploit findings in their appropriate context. The methodology is also appropriate since the research is seeking to find the effects of cyber threats to small enterprise business. The problem is therefore immediate and the focus is on small enterprise business. Therefore the methodology chosen of action research is the best.

The research will choose a sample size from businesses that operate within the Central Business District of major urban areas. The business owners from two businesses will be chosen at random. Another sample size will also be picked from business that operate from the city suburb areas. The IT experts will be chosen from any IT expert company. Focus will be on those that work within the city urban areas and the ones operating from the city suburb areas.

The research main method of data collection is through interviews. Interviews will be conducted to small business owners and their employees.  A similar interview will also be conducted to IT analyst in a way of trying to find their views.

The other method would be questionnaires. Questionnaires will be provide to the clients of the business enterprise. This will help in getting their opinions over use of cyber in businesses. If there are any benefits they can relate to or if there is none. Their recommendations if they have any.

The project might also consider document analysis of various IT experts as a way of collecting data.

Since the data collected is rather qualitative, the analysis will coded for various themes and meaning. After coding the analysis of the data collected will be hermeneutical. Hermeneutical analysis will be used to derive the real meaning of the oral data that the population sample gave. This will help in achieving reliability. Reliability will be achieved as hermeneutic analysis makes sense of the object study and un- earths the underlying coherence between the study and the assumption.

The independent variables in this case are the cyber threats attacks that causes change in profits and loss for the small enterprise business. The dependent variables in this case are effects that change with the introduction of cyber threat attacks. One of the dependent variables are the profits made by the business. The relationship between the two variables is therefore causal. One variable will cause an effect to the other.

The project will have limitation on how to determine the effects of cyber-attack except on profit measurement. There are very few parameters that can be measured in order to determine the direct effects of cyber-crime on small businesses. The parameters that include reputation and economic cost do not really matter for this businesses. The main parameter for measurement is profit and loss. These therefore limits the action of the research.

Profit and loss can be due to other features and not necessarily cyber-attacks. The profits can fluctuate for small businesses due to other factors. Profits can fluctuate due clients or employee behavior.  These factors are not kept constant by the project. These therefore limits the action of the research.

The profit margins are difficult to assess for businesses that have not undergone cyber-attacks. It is therefore difficult to force a cyber-attack in order to get the correct result for the research. This therefore limits the action of the research.

The research will take in five phases as specified in the table

Phase	Action	Duration
1	Developing purpose and strategy	60 days
2	Obtaining ethical clearances	3 weeks
3	Conducting the actual study	6 weeks
4	Data analysis	2 months
5	Writing of the actual research	3 months

The plan is justified to use the timelines given. The 60 days given to the first phase is justified since the formulation can be quite hard. But since there are general area of interest the duration is therefore reduced to the least possible days that is sixty days. The sixty also involves figuring out where and how to conduct the research study.

Obtaining clearances from the authority is therefore not complicated if the first process is done properly. We use the lower time limit since the study has shown ideal ways of being unique in terms of places and how to conduct the research study. Therefore the 3 weeks duration is the correct time for obtaining official clearances.

The next phase is supposed to take a lot of time since it makes the core of the research. From the process of collecting the data. The interview process will take a lot of time since the interviews involving the analysts and business have to be transcribed differently. These process therefore needs to take the longest time as provided for.

Making sense of the data will not require a lot of time if the actual study is done in the proper way. Therefore it will require a little less time than the actual study. The time duration is long since phase 3 can be quite overwhelming. The researcher will therefore need refreshing time before embarking on analysis. This justifies the time that has been allocated for analysis.

The writing plan is dependent on the other steps. If the other steps are done properly the writing will take a shorter time. The data from the collection can be managed therefore making it easier to conduct the writing within the 2 months’ time frame.

Conclusion

The course has focused on planning the project. The project has therefore developed a plan on how research on the issue of cyber security threat on small business enterprises. The project has also given estimates that can be achieved through realizing the effects cyber-attacks has had on small enterprise business. The project therefore opens up the possibility of conducting a suitable research in relation the problems.

References list

Bell, N.A., Catov, J. and Aggarwal, B., 2017. Abstract P322: The Association Between Parity and Sleep Duration: a Study From the AHA Go Red for Women Strategically Focused Research Network (SFRN).

Curran, J. and Storey, D.J. eds., 2016. Small firms in urban and rural locations. Routledge.

Gasmann, O., Frankenberger, K. and Sauer, R., 2016. Conclusion: Opening up a New Debate on BMI. In Exploring the Field of Business Model Innovation (pp. 107-111).

Herrera, A.V., Ron, M. and Rabadão, C., 2017, June. National cyber-security policies oriented to BYOD (bring your own device): Systematic review. In Information Systems and Technologies (CISTI), 2017 12th Iberian Conference on (pp. 1-4). IEEE

Lee, J., Bagheri, B. and Jin, C., 2016. Introduction to cyber manufacturing. Manufacturing Letters, 8, pp.11-15.

Lewis, S., 2015. Qualitative inquiry and research design: Choosing among five approaches. Health promotion practice, 16(4), pp.473-475.

Marshall, C. and Rossman, G.B., 2014. Designing qualitative research. Sage publications.

Masutha, M. and Rogerson, C.M., 2015, June. Business incubation for small enterprise development: South African pathways. In Urban Forum (Vol. 26, No. 2, pp. 223-241). Springer Netherlands.

Mendel, J., 2017. Smart Grid Cyber Security Challenges: Overview and Classification. e-mentor, (1 (68)), pp.55-66.

Patrick, H. and Fields, Z., 2017. A need for cyber security creativity. Collective Creativity for Responsible and Sustainable Business Practice, pp.42-61.

Rawat, D.B. and Bajracharya, C., 2015, April. Cyber security for smart grid systems: Status, challenges and perspectives. In SoutheastCon 2015 (pp. 1-6). IEEE.

Reddy, Y.B., 2015, April. Security and design challenges in cyber-physical systems. In Information Technology-New Generations (ITNG), 2015 12th International Conference on (pp. 200-205). IEEE.

Sadeghi, A.R., Wachsmann, C. and Waidner, M., 2015, June. Security and privacy challenges in industrial internet of things. In Proceedings of the 52nd annual design automation conference (p. 54). ACM.

Sajid, A., Abbas, H. and Saleem, K., 2016. Cloud-assisted iot-based scada systems security: A review of the state of the art and future challenges. IEEE Access, 4, pp.1375-1384.

Song, H., Fink, G.A. and Jeschke, S. eds., 2017. Security and Privacy in Cyber-physical Systems: Foundations, Principles, and Applications. John Wiley & Sons.

Stimmel, C.L., 2016. Big data analytics strategies for the smart grid. Auerbach Publications.

Thuraisingham, B., Kantarcioglu, M., Hamlen, K., Khan, L., Finin, T., Joshi, A., Oates, T. and Bertino, E., 2016, July. A data driven approach for the science of cyber.