Over the last decade, the number of small and medium (SME) businesses suffering data breaches has risen at an alarming rate. Knowing how to respond to inevitable data breaches is critically important. A number of guidelines exist to advise organisations on the steps necessary to ensure an effective incident response. These guidelines tend to be unsuitable for SMEs, who generally have limited resources to expend on security and incident responses. Qualitative interviews were conducted with SMEs to probe current data breach response practice and to gather best-practice advice from SMEs themselves. The interviews revealed no widespread de facto approach, with a variety of practices being reported. A number of prevalent unhelpful-practice themes emerged from the responses, which we propose specific mitigation techniques to address. We therefore propose a SME-specific incident response framework that is simple yet powerful enough to inform and guide SME responses to data breach incidents.
|Title of host publication||AISB 2018|
|Subtitle of host publication||Symposium on Digital Behaviour Interventions for Cyber-Security|
|Publisher||Society for the Study of Artificial Intelligence and Simulation for Behaviour (AISB)|
|Number of pages||8|
|Publication status||Published - 5 Apr 2018|
|Event||2018 AISB Convention: Symposium on Digital Behaviour Intervention for Cyber Security - University of Liverpool, Liverpool, United Kingdom|
Duration: 4 Apr 2018 → 6 Apr 2018
|Other||2018 AISB Convention|
|Period||4/04/18 → 6/04/18|
Kapoor, K., Renaud, K., & Archibald, J. (2018). Preparing for GDPR: helping EU SMEs to manage data breaches. In AISB 2018: Symposium on Digital Behaviour Interventions for Cyber-Security (pp. 13-20). Society for the Study of Artificial Intelligence and Simulation for Behaviour (AISB).