A Conceptual Model of an Intelligent Platform for Security Risk Assessment in SMEs

Abstract

SMEs are increasingly targeted by cyberattacks and usually less in control of their Information Security Management System than larger organizations due to a lack of resources. Risk assessment can help them to determine which changes are needed bearing in mind their constraints. However, common frameworks for risk assessments are more suitable for large organizations. Some of them have been designed specifically for SMEs but still target an audience of information security experts and are considered as time-consuming by SMEs. This article aims at tackling those issues by introducing a conceptual model of an Intelligent Platform for supporting SMEs in security risk assessment process. The design research method was used to develop a model taking into account the inputs from relevant stakeholders collected via interviews. The model was validated and improved with case studies where quick security risk assessments in three different SMEs have been performed following the activities that the proposed model is supposed to perform.