What problem does this paper attempt to address?

This paper focuses on the cyber security risks faced by small businesses and the asset modeling problem. Existing cyber security tools and standards often assume technical expertise and time resources, which is not practical for small businesses. Small business owners typically wear multiple hats, including janitorial, sales, and IT support, so cyber security is just one of many competing priorities. The paper proposes a new unified modeling language (UML) class model called Small IT Data (SITD) model, aiming to assist small businesses in dealing with the chaotic information gathering phase when entering the field of cyber security for the first time. The SITD model adopts generic classes and structures that can evolve and remain relevant with changes in technology and environment. It emphasizes the relationship between business strategy tasks and IT infrastructure to ensure that security decisions align with the scale of the enterprise. The paper also formulates a set of design principles to meet the cyber security needs of small businesses and validates the effectiveness of the model and design principles through empirical case studies. The model components are designed to meet the needs of small businesses by simplifying non-technical terminology and presentation styles, encouraging continuous involvement of all stakeholders rather than just technical participants. Through the SITD model, security vulnerability information can be displayed, such as demonstrating the use of the NotPetya incident. The paper points out that current cyber security tools and standards are too complex for small businesses and calls for a more understandable and implementable solution. The SITD model aims to approach cyber security analysis from a business perspective, placing more emphasis on business priorities while considering the scale and resource constraints of small businesses. In this way, the paper aims to reduce the barriers for small businesses to participate in cyber security management and enhance their cyber security capabilities.

Structuring the Chaos: Enabling Small Business Cyber-Security Risks & Assets Modelling with a UML Class Model

The good, the bad and the missing: A Narrative review of cyber-security implications for australian small businesses

Development of a threat modelling framework and a web-based threat modelling tool for micro businesses

Cyber security threat modeling based on the MITRE Enterprise ATT&CK Matrix

CYBER-AIDD: A novel approach to implementing improved cyber security resilience for large Australian healthcare providers using a Unified Modelling Language ontology

Building Security Awareness of Interdependent Services, Business Processes, and Systems in Cyberspace

Improving the Cybersecurity of Critical National Infrastructure using Modelling and Simulation

A Survey on the Cyber Security of Small-to-Medium Businesses: Challenges, Research Focus and Recommendations

Modeling Business for MDA Software Paradigm

Modeling and Assessment of IoT Supply Chain Security Risks: The Role of Structural and Parametric Uncertainties

QuantTM: Business-Centric Threat Quantification for Risk Management and Cyber Resilience

Classifying SMEs for Approaching Cybersecurity Competence and Awareness

ProtectingSmall and Medium Enterprises: A Specialized Cybersecurity Risk Assessment Framework and Tool

Effective cybersecurity risk management practices for small and medium-sized enterprises: A comprehensive review

Understanding enterprise cybersecurity information sharing: a theoretical model and empirical analysis

Cyber risk assessment in small and medium‐sized enterprises: A multilevel decision‐making approach for small e‐tailors

Building a Cybersecurity Risk Metamodel for Improved Method and Tool Integration

Modeling Attack, Defense and Threat Trees and the Cyber Kill Chain, ATT&CK and STRIDE Frameworks as Blackboard Architecture Networks

Assessing Risks and Modeling Threats in the Internet of Things

Management and Business Model Risk Profile in Security Systems Development

Network Security Modeling and Cyber Attack Simulation Methodology