NEED OF PARADIGM SHIFT IN CYBERSECURITY IMPLEMENTATION FOR SMALL AND MEDIUM ENTERPRISES (SMES)

The increasing digitization of small and medium enterprises (SMEs) has significantly increased their attack surface, creating opportunities for various cyberthreats. In the global market, there are various cybersecurity standards and frameworks available, but there are still many cyber news stories from each corner of the world talking about increasing sophisticated cyber-attacks among organizations. According to recent studies, one out of five cyberattacks is targeting SMEs. Even though SMEs are relatively smaller as individuals, they are responsible for maximum contribution towards the betterment of the global economy, including the highest role in GDP and various employment opportunities. As compared to large organizations, SMEs generally have limited resources and funds and always have their own priorities for specific business domains. Existing cybersecurity standards and frameworks are generic in nature and are not in alignment with the business domain's goals of SMEs. Also, those are demanding the implementation of the hundreds of cybersecurity controls by SME to get certified to a certain level of global cybersecurity maturity. Using an international research study, in this paper the authors are going to assess the current cybersecurity posture of SMEs and problems faced by them with regards to the implementation of cybersecurity. Also, the authors will propose a new cybersecurity framework to resolve those problems, considering prioritization in the CIA Triad and Defense in Depth concepts.