The Mundane Art of Cybersecurity: Living with Insecure IT in Danish Small- and Medium-Sized Enterprises

Small-and medium-sized enterprises (SMEs) are an essential part of the global economy and paramount to local communities and employment markets. They are also considered to be particularly vulnerable to cyberattacks as they lack technical competencies, strict controls, and organizational routines. We present the results of an ethnographic study of 30 SMEs in Denmark to further our understanding of how companies in this segment handle cybersecurity in their daily practices. We suggest that cybersecurity is dealt with as a mundane art: instead of striving for solutions, SMEs must leave things undone, endure partially broken systems, and resort to making things slightly better or worse but never good. In line with CSCW scholarship on care in broken worlds, we emphasize the various tactics of living with insecure technologies. In a broken world, securing is often not about assurance or following rules but about handling dilemmas, breaking things a little but not a lot, or waiting things out.

CCS Concepts: • Security and privacy → Social aspects of security and privacy; • Human-centered computing → Empirical studies in collaborative and social computing.