Abstract
Small and medium enterprises (SMEs) make up a significant part of European economies. Despite their economic importance, they are often described as poorly placed to deal with cyber risks because of resource constraints or commercial interests. Providing appropriate tooling would facilitate a greater appreciation of the risks and provide mitigation strategies. In a series of workshops demonstrating visualization tools for cybersecurity, constructs from healthcare models such as awareness, self-efficacy, and a willingness to engage were investigated to throw light on the likelihood that the technologies would be adopted. Although most constructs were validated, it turns out that self-efficacy could more appropriately be interpreted as a desire to understand a broader company narrative rather than empowering any individual to identify and manage cyber risk. As part of an ongoing examination of technology acceptance, this work provides further evidence that technology must be contextualised to make sense for the individual as part of the SME rather than as individual employee.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
The work reported here was approved by the Faculty of Engineering and Physical Science Research Ethics Committee (Ref ERGO/FEPS/62067).
References
Abraham, C., Sheeran, P.: The health belief model. Predict. Health Behav. 2, 28–80 (2005)
Ajzen, I.: The theory of planned behavior. Organ. Behav. Hum. Decis. Process. 50(2), 179–211 (1991)
Bell, S., et al.: Cybersecurity is not just a ‘big business’ issue. Gov. Dir. 69(9), 536 (2017)
Blythe, J.: Cyber security in the workplace: understanding and promoting behaviour change. In: Proceedings of CHI taly 2013 Doctoral Consortium, vol. 1065, pp. 92–101. CEUR Workshop Proceedings (2013)
Boletsis, C., Halvorsrud, R., Pickering, B., Phillips, S., Surridge, M.: Cybersecurity for SMEs: introducing the human element into socio-technical cybersecurity risk assessment. In: Proceedings of the IVAPP 2021 Conference, vol. to appear. Scitepress (2021)
Browne, S., Lang, M., Golden, W.: Linking threat avoidance and security adoption: A theoretical model for SMEs (2015)
Carpenter, C.J.: A meta-analysis of the effectiveness of health belief model variables in predicting behavior. Health Commun. 25(8), 661–669 (2010)
Champion, V.L., Skinner, C.S.: The health belief model. In: Glanz, K., Rimer, B.K., Viswanath, K. (eds.) Health Behavior and Health Education: Theory, Research, and Practice, pp. 45–65. John Wiley & Sons, 4th edn. (2008)
Conner, M., Norman, P.: Predicting Health Behaviour, 2nd edn. Open University Press, Maidenhead (2005)
Davis, F.D.: A technology acceptance model for empirically testing new end-user information systems: Theory and results. Ph.D. thesis, Massachusetts Institute of Technology (1985)
Davis, F.D., Bagozzi, R.P., Warshaw, P.R.: User acceptance of computer technology: a comparison of two theoretical models. Manag. Sci. 35(8), 982–1003 (1989)
Fishbein, M., Ajzen, I.: Belief, attitude, intention, and behavior: an introduction to theory and research. J. Bus. Ventur. 5, 177–189 (1977)
Halvorsrud, R., Haugstveit, I.M., Pultier, A.: Evaluation of a modelling language for customer journeys. In: Proceedings of IEEE Symposium on Visual Languages and Human-Centric Computing (VL/HCC), pp. 40–48. IEEE (2016)
Jackson, J., Allum, N., Gaskell, G.: Perceptions of risk in cyberspace. Technical report, London School of Economics and Politics (2004). Cyber trust & crime prevention project (04/1157)
Lewis, R., Louvieris, P., Abbott, P., Clewley, N., Jones, K.: Cybersecurity information sharing: a framework for information security management in UK SME supply chains. In: Proceedings of the 22nd European Conference on Information Systems, pp. 1–15 (2014)
Martin, G., Ghafur, S., Kinross, J., Hankin, C., Darzi, A.: WannaCry - a year on. BMJ 361, k2381 (2018)
May, C., et al.: Normalization Process Theory On-line Users’ Manual, Toolkit and NoMAD instrument (2015). http://www.normalizationprocess.org. Accessed 11 Feb 2021
May, C., Finch, T.: Implementing, embedding, and integrating practices: an outline of normalization process theory. Sociology 43(3), 535–554 (2009)
May, C.R., et al.: Development of a theory of implementation and integration: normalization process theory. Implement. Sci. 4, 29:1–29:9 (2009)
Montaño, D.E., Kasprzyk, D.: Theory of reasoned action, theory of planned behavior, and the integrated behavioral model. Health Behav. Theor. Res. Pract. 70(4), 231 (2015)
Pickering, B., Bartholomew, R., Nouri Janian, M., López Moreno, B., Surridge, M.: Ask me no questions: increasing empirical evidence for a qualitative approach to technology acceptance. In: Kurosu, M. (ed.) HCII 2020, Part I. LNCS, vol. 12181, pp. 125–136. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-49059-1_9
Pickering, B., Janian, M.N., López Moreno, B., Micheletti, A., Sanno, A., Surridge, M.: Seeing potential is more important than usability: revisiting technology acceptance. In: Marcus, A., Wang, W. (eds.) HCII 2019, Part IV. LNCS, vol. 11586, pp. 238–249. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-23535-2_18
Pope, C., Halford, S., Turnbull, J., Prichard, J., Calestani, M., May, C.: Using computer decision support systems in NHS emergency and urgent care: ethnographic study using normalisation process theory. BMC Health Serv. Res. 13, 111:1–111:13 (2013)
Rogers, E.M.: Diffusion of Innovations, 5th edn. Free Press, New York (2010)
Rokkas, T., Neokosmidis, I.: Factors affecting the market adoption of cyber-security products in energy and electrical systems: the case of spear. In: Proceedings of the 15th International Conference on Availability, Reliability and Security, pp. 1–8 (2020)
Sharma, K., Singh, A., Sharma, V.P.: SMEs and cybersecurity threats in e-commerce. EDPACS EDP Audit Control Secur. Newsl. 39(5–6), 1–49 (2009)
Simon, J.: Attitudes of Hungarian asthmatic and COPD patients affecting disease control: empirical research based on health belief model. Front. Pharmacol. 4, 135 (2013)
Surridge, M., et al.: Modelling compliance threats and security analysis of cross border health data exchange. In: Attiogbé, C., Ferrarotti, F., Maabout, S. (eds.) MEDI 2019. CCIS, vol. 1085, pp. 180–189. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-32213-7_14
Vakakis, N., Nikolis, O., Ioannidis, D., Votis, K., Tzovaras, D.: Cybersecurity in SMEs: the smart-home/office use case. In: 2019 IEEE 24th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), pp. 1–7. IEEE (2019)
Venkatesh, V., Morris, M.G., Davis, G.B., Davis, F.D.: User acceptance of information technology: toward a unified view. MIS Q. 27(3), 425–478 (2003)
Von Solms, R., Van Niekerk, J.: From information security to cyber security. Comput. Secur. 38, 97–102 (2013)
Ward, K.: Social networks, the 2016 US presidential election, and Kantian ethics: applying the categorical imperative to Cambridge analytica’s behavioral microtargeting. J. Media Ethics 33(3), 133–148 (2018)
Warkentin, M., Johnston, A.C., Shropshire, J., Barnett, W.D.: Continuance of protective security behavior: a longitudinal study. Decis. Support Syst. 92, 25–35 (2016)
Acknowledgements
This work was supported by the EU H2020 project CyberKit4SME (Grant agreement: 883188).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2021 Springer Nature Switzerland AG
About this paper
Cite this paper
Pickering, B., Boletsis, C., Halvorsrud, R., Phillips, S., Surridge, M. (2021). It’s Not My Problem: How Healthcare Models Relate to SME Cybersecurity Awareness. In: Moallem, A. (eds) HCI for Cybersecurity, Privacy and Trust. HCII 2021. Lecture Notes in Computer Science(), vol 12788. Springer, Cham. https://doi.org/10.1007/978-3-030-77392-2_22
Download citation
DOI: https://doi.org/10.1007/978-3-030-77392-2_22
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-77391-5
Online ISBN: 978-3-030-77392-2
eBook Packages: Computer ScienceComputer Science (R0)