Cyber-Security Policy Decisions in Small Businesses

Cyber-Security Policy Decisions in Small Businesses by Joanna Patterson MBA, Saint Leo University, 2013 BS, Bellevue University, 2011 Doctoral Study Submitted in Partial Fulfillment of the Requirements for the Degree of Doctor of Business Administration Walden University November 2017 Abstract Cyber-attacks against small businesses are on the rise yet small business owners often lack effective strategies to avoid these attacks. The purpose of this qualitative multiple case study was to explore the strategies small business owners use to make cyber-security decisions. Bertalanffy’s general systems theory provided the conceptual framework for this study. A purposive sample of 10 small business owners participated in the interviewCyber-attacks against small businesses are on the rise yet small business owners often lack effective strategies to avoid these attacks. The purpose of this qualitative multiple case study was to explore the strategies small business owners use to make cyber-security decisions. Bertalanffy’s general systems theory provided the conceptual framework for this study. A purposive sample of 10 small business owners participated in the interview process and shared their decision-making methodologies and influencers. The small business owners were vetted to ensure their strategies were effective through a series of qualification questions. The intent of the research question and corresponding interview questions was to identify strategies that successful small business owners use to make cyber-security decisions. Data analysis consisted of coding keywords, phrases, and sentences from semi structured interviews as well as document analysis. The following themes emerged: government requirements, peer influence, budgetary constraints, commercial standards, and lack of employee involvement. According to the participants, budgetary constraints and peer influence were the most influential factors when making decisions regarding cyber-security strategies. Through exposing small business owners to proven strategies, the implications for social change include a reduction of their small business operating costs and assistance with compliance activities. Cyber-Security Policy Decisions in Small Businesses by Joanna Patterson MBA, Saint Leo University, 2013 BS, Bellevue University, 2011 Doctoral Study Submitted in Partial Fulfillment of the Requirements for the Degree of Doctor of Business Administration Walden University November 2017 Dedication If we all limited ourselves to what others thought of our abilities the world would be a shell of what it is today. To Nina (from the house of Nina’s), thank you for being an unwavering light in the dark. Thank you for never giving up and always believing I could be more. To my mom, thank you for giving me every opportunity you possibly could. I never took it for granted, and I hope it shows. Acknowledgements To my professors, especially my committee chair, Dr. Elisabeth Musil, thank you for your guidance, wisdom, and tolerance. I hope to one day pay it forward. Thank you to my second committee member, Dr. Alexandre Lazo, and my university research reviewer, Dr. Scott Burrus, for their contributions made to my study. I would also like to thank all the participants who participated, ultimately making this study possible. Lastly, I am thankful for my co-workers, family, and friends who gave me encouragement and strength to complete my doctoral degree. Never underestimate the words of encouragement that you give to someone.