Can small businesses remain cyber secure while relying on personal mobile devices?
By: Renata Karpavičė and Asta Valackienė
References
- Ali, Md.I. and Kaur, S. (2021) ‘Next-generation digital forensic readiness BYOD framework’, Security and Communication Networks, 2021, article 6664426. Available at: https://doi.org/10.1155/2021/6664426
- Australian Cyber Security Centre (2023) Cyber security and Australian small businesses: results from the Australian Cyber Security Centre Small Business Survey, 2023/BYOD101. Available at: https://www.cyber.gov.au/sites/default/files/2023-03/2023_ACSC_Cyber%20Security%20and%20Australian%20Small%20Businesses%20Survey%20Results_D1.pdf (Accessed: 19 September 2025).
- Australian Cyber Security Centre (2024) Essential Eight explained. Available at: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-explained (Accessed: 19 September 2025).
- Aytulun, S.K. and Guneri, A.F. (2008) ‘Business process modelling with stochastic networks’, International Journal of Production Research, 46(10), pp. 2743–2764. Available at: https://doi.org/10.1080/00207540701543601
- Benz, M. and Chatterjee, D. (2020) ‘Calculated risk? A cybersecurity evaluation tool for SMEs’, Business Horizons, 63(4), pp. 531–540. Available at: https://doi.org/10.1016/j.bushor.2020.03.010
- Blanton, S. (2025) ‘What are NIST’s mobile device management guidelines?’ JumpCloud, 18 March. Available at: https://jumpcloud.com/blog/nist-mdm-guidelines (Accessed: 19 September 2025).
- Boeckl, K., Grayson, N., Howell, G., Lefkovitz, N., Ajmo, J., Craft, R.E. et al. (2023) Mobile device security: Bring Your Own Device (BYOD). NIST Special Publication 1800-22, volume A. US Department of Commerce. Available at: https://doi.org/10.6028/NIST.SP.1800-22
- Chandna, V. and Tiwari, P. (2023) ‘Cybersecurity and the new firm: surviving online threats’, Journal of Business Strategy, 44(1), pp. 3–12. Available at: https://doi.org/10.1108/JBS-08-2021-0146
- CISA (2021) ‘Cyber guidance for small businesses’, Cybersecurity & Infrastructure Security Agency. Available at: https://www.cisa.gov/cyber-guidance-small-businesses (Accessed: 19 September 2025).
- Cisco Umbrella (2022) Which cyber-attacks most commonly target small businesses? Available at: https://umbrella.cisco.com/blog/which-cyber-attacks-most-commonly-target-small-businesses (Accessed: 19 September 2025).
- ‘Council directive (EU) 2022/2555 of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No. 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (Text with EEA relevance)’ (2022) Official Journal L 333, 27 December, pp. 80–152.
- ‘Council regulation (EU) 2019/881 of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No. 526/2013 (Cybersecurity Act) (Text with EEA relevance)’ (2019) Official Journal L 151/15,7 June, pp. 15–69.
- ‘Council regulation (EU) 2021/887 of 20 May 2021 establishing the European Cybersecurity Industrial, Technology and Research Competence Centre and the Network of National Coordination Centres’ (2021) Official Journal L 202/1, 8 June, pp. 1–31.
- CTAC (2023) CTAC 2023 yearly report. Regional Cyber Defence Centre, Lithuania.
- DataReportal (2024a) Digital 2024: global overview report. Available at: https://datareportal.com/reports/digital-2024-global-overview-report (Accessed: 19 September 2025).
- DataReportal (2024b) Digital 2024: Lithuania. Available at: https://datareportal.com/reports/digital-2024-lithuania (Accessed: 19 September 2025).
- Downer, K. and Bhattacharya, M. (2022) ‘BYOD security: a study of human dimensions’, Informatics, 9(1), article 16. Available at: https://doi.org/10.3390/informatics9010016
- European Commission (2023) Shaping Europe’s digital future: Cyber Resilience Act. Available at: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilienceact (Accessed: 19 September 2025).
- Fezzey, T., Batchelor, J.H., Burch, G.F. and Reid, R. (2023) ‘Cybersecurity continuity risks: lessons learned from the COVID-19 pandemic’, Journal of Cybersecurity Education, Research & Practice, 2022(2). Available at: https://digitalcommons.kennesaw.edu/jcerp/vol2022/iss2/4/?utm_source=digitalcommons.kennesaw.edu%2Fjcerp%2Fvol2022%2Fiss2%2F4&utm_medium=PDF&utm_campaign=PDFCoverPages (Accesssed: 11 August 2025).
- FinancesOnline (2024) 44 basic BYOD statistics: 2024 market share analysis & data. Available at: https://financesonline.com/byod-statistics/ (Accessed: 19 September 2025).
- Franco, M.F., Künzler, F., von der Assen, J., Feng, C. and Stiller, B. (2024) ‘RCVaR: an economic approach to estimate cyberattacks costs using data from industry reports’, Computers & Security, 139, article 103737. Available at: https://doi.org/10.1016/j.cose.2024.103737
- Ganiyu, S.O. and Jimoh, R.G. (2018) ‘Characterising risk factors and countermeasures for risk evaluation of Bring Your Own Device strategy’, International Journal of Information Security Science, 7(1), pp. 49–59. Available at: https://www.researchgate.net/publication/342361828_Characterising_Risk_Factors_and_Countermeasures_for_Risk_Evaluation_of_Bring_Your_Own_Device_Strategy (Accessed: 11 August 2025).
- Harthy, K.A. (2022) A risk management framework for the BYOD environment. Doctoral thesis. Coventry University. Available at: https://pure.coventry.ac.uk/ws/portalfiles/portal/80093962/AlHarthy_2022_PhD.pdf (Accessed: 11 August 2025).
- Howell, G., Franklin, J.M., Sritapan, V., Souppaya, M. and Scarfone, K. (2023) Guidelines for managing the security of mobile devices in the enterprise. NIST Special Publication 800-124r2. US Department of Commerce. Available at: https://doi.org/10.6028/NIST.SP.800-124r2
- IBM Security (2023) Cost of a data breach report 2023. Available at: https://d110erj175o600.cloudfront.net/wp-content/uploads/2023/07/25111651/Cost-ofa-Data-Breach-Report-2023.pdf (Accessed: 19 September 2025).
- Ismail, N. (2017) ‘Mobile security in the enterprise’, Information Age, 16 September. Available at: https://www.information-age.com/mobile-enterprise-security-7731/ (Accessed: 19 September 2025).
- Jayarao, G.B., Ray, S. and Panigrahi, P.K. (2024) ‘Information security threats and organizational readiness in nWFH scenarios’, Computers & Security, 140, article 103745. Available at: https://doi.org/10.1016/j.cose.2024.103745
- Ma, Y., Cao, Y., Li, L., Zhang, J. and Prince Clement, A. (2021) ‘Following the flow: exploring the impact of mobile technology environment on user’s virtual experience and behavioral response’, Journal of Theoretical and Applied Electronic Commerce Research, 16(2), pp. 170–187. Available at: https://doi.org/10.4067/S0718-18762021000200112
- Mierzwa, S.J. and Klepacka, A. (2023) ‘Practical approaches and guidance to small business organization cyber risk and threat assessments’, Journal of Strategic Innovation & Sustainability, 18(2). Available at: https://doi.org/10.33423/jsis.v18i2.6255
- National Cyber Security Centre UK (2020) Cyber security: small business guide. Available at: https://www.ncsc.gov.uk/files/NCSC_A5_Small_Business_Guide_v4_OCT20.pdf (Accessed: 19 September 2025).
- Center for Internet Security (2017) CIS Controls implementation guide for small-and medium-sized enterprises (SMEs). Available at: https://www.cisecurity.org/-/media/project/cisecurity/cisecurity/data/media/files/uploads/2017/09/CIS-Controls-Guide-for-SMEs.pdf (Accessed: 19 September 2025).
- Palanisamy, R., Norman, A.A. and Mat Kiah, L. (2021) ‘BYOD security risks and mitigation strategies: insights from IT security experts’, Journal of Organizational Computing & Electronic Commerce, 31(4), pp. 320–342. Available at: https://doi.org/10.1080/10919392.2022.2028530
- Podvezko, V. (2005) ‘Agreement of expert estimates’, Technological and Economic Development of Economy, 11(2), pp. 101–107. Available at: https://doi.org/10.3846/13928619.2005.9637688
- Porter, M.E. (1985) Competitive advantage: creating and sustaining superior performance. The Free Press.
- Rathnayaka, R.P.P.S., Swarnamali, I.S., Piyasekara, W.D.C., Karunathilaka, N.A., Abewardena, K.Y. and Yapa, K. (2023) ‘Enhancing security in a corporate BYOD environment’, International Research Journal of Innovations in Engineering and Technology, 7(11), pp. 329–334. Available at: https://doi.org/10.47001/IRJIET/2023.711045
- Research and Markets (2020) Report. Available at: https://www.researchandmarkets.com/?srsltid=AfmBOoqdV1dZk4GfDUGZFbCSwxlMuZVFHU6ptbytv298PQLt5F_7PSlh (Accessed: 19 September 2025).
- Research and Markets (2025) BYOD and enterprise mobility: global strategic business report. Available at: https://www.researchandmarkets.com/reports/4804695/byod-and-enterprise-mobility-global-strategic (Accessed: 19 September 2025).
- StrongDM (2024) Small business cyber security statistics for 2024. Available at: https://www.strongdm.com/blog/small-business-cyber-security-statistics (Accessed: 19 September 2025).
- Sukumar, A., Mahdiraji, H.A. and Jafari-Sadeghi, V. (2023) ‘Cyber risk assessment in small and medium-sized enterprises: a multilevel decision-making approach for small e-tailors’, Risk Analysis: An International Journal, 43(10), pp. 2082–2098. Available at: https://doi.org/10.1111/risa.14092
- UK Government (2025) Cyber security breaches survey 2025. Available at: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025 (Accessed: 19 September 2025).
- Van de Weijer, S., Leukfeldt, R. and Moneva, A. (2023) ‘Cybercrime during the COVID-19 pandemic: prevalence, nature and impact of cybercrime for citizens and SME owners in the Netherlands’, Computers & Security, 139, article 103693. Available at: https://doi.org/10.1016/j.cose.2023.103693
- Verizon (2024) Data breach investigations report. Available at: https://www.verizon.com/business/resources/reports/2024-dbir-data-breach-investigations-report.pdf (Accessed: 19 September 2025).
- Wang, J., Ho, C.Y. and Shan, Y.G. (2024) ‘Does cybersecurity risk stifle corporate innovation activities?’ International Review of Financial Analysis, 93, article 103028. Available at: https://doi.org/10.1016/j.irfa.2023.103028
- Wiechetek, Ł. and Mędrek, M. (2018) ‘Synergizing logistics processes and process management—framework of BPM course based on business cases, BPM standards and tools’, Annales H-Oeconomia, 52(5), pp. 95–112. Available at: https://doi.org/10.17951/h.2018.52.5.95-112
- Zuhaira, B. and Ahmad, N. (2021) ‘Business process modeling, implementation, analysis, and management: the case of business process management tools’, Business Process Management Journal, 27(1), pp. 145–183. Available at: https://doi.org/10.1108/BPMJ-06-2018-0168
- Drazich, B.F., Lee, J.W., Bowles, K.H., Taylor, J.L., Shah, S., Resnick, B., Kim, N., and Szanton, S.L. (2023) ‘Pandemic-related changes in technology use among a sample of previously hospitalized older adult New Yorkers: observational study’, JMIR Aging, 6, article e41692. Available at: https://doi.org/10.2196/41692
DOI: https://doi.org/10.2478/bjes-2026-0030 | Journal eISSN: 2674-4619 (formerly 2228-0596) | Journal ISSN: 2674-4600 (formerly 2228-0596)
Language: English
Published on: Oct 26, 2026
Published by: Tallinn University of Technology
In partnership with: Paradigm Publishing Services
Related subjects:
© 2026 Renata Karpavičė, Asta Valackienė, published by Tallinn University of Technology
This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.