# The Good, The Bad and The Missing: A Narrative Review of Cyber-security Implications for Australian Small Businesses

**Authors:** Tracy Tam, Asha Rao, Joanne Hall  
**arXiv:** [2109.00733](https://arxiv.org/abs/2109.00733)  
**Date:** 2021-09-02  
**Summary page:** https://www.summarizepaper.com/en/paper/2109.00733v1/

## Key points

- Small businesses with 0-19 employees are increasingly targeted by cyber-criminals
- They struggle to implement effective cyber-security measures compared to larger businesses
- This poses a significant threat as small businesses employ a substantial portion of the workforce
- Existing literature often fails to distinguish small businesses as a separate cohort in the broader cyber-security landscape
- Factors such as resource constraints, organizational process maturity, and legal structures impact small business cyber-resilience
- Characteristics like agility and piecemeal IT architecture could be leveraged to improve cyber-security within small businesses
- Legal and policy interventions are needed to help small enterprises become more resilient against cyber threats

## Summary

Small businesses with 0-19 employees are increasingly becoming targets for cyber-criminals. However, they struggle to implement effective cyber-security measures that larger businesses routinely deploy. This poses a significant threat as small businesses employ a substantial portion of the workforce. In this paper, we delve into the challenges faced by small businesses in terms of cyber-security within an Australian context. Through a comprehensive keyword search across academic search engines such as Scopus, ProQuest, Science Direct, SpringerLink and IEEE Xplore, we identified 22 relevant papers that exclusively discussed cyber-security in the context of small businesses or SMEs. By comparing our research aims with selected review papers, we found that existing literature often fails to distinguish small businesses as a separate cohort in the broader cyber-security landscape. Our study highlights the unique characteristics of small businesses that can either hinder or facilitate their ability to enhance cyber-security measures. Factors such as resource constraints, organizational process maturity and legal structures play a crucial role in determining a small business's cyber-resilience. We also explore how certain characteristics like agility and piecemeal IT architecture could potentially be leveraged to improve cyber-security within small businesses. Overall, our research reveals a gap in current studies on small business cyber-security and underscores the need for legal and policy interventions to help these enterprises become more resilient against cyber threats. By addressing both technical and non-technical challenges faced by small businesses in implementing robust cyber-security measures, we aim to contribute towards developing effective and suitable solutions tailored specifically for this vulnerable sector of the economy.