Selling the Dream: How Intimate Insiders and Identity-Based Attackers Disrupt Micro-businesses

Micro-businesses represent the majority of all businesses, and act as vehicles to economic freedom for many at-risk population groups. At the risk of falling behind, many microbusiness owners (MBOs) increasingly adopt platforms as their primary infrastructure, and rely heavily on recruiting friends, families, and even romantic partners for running essential operations. Despite these facts, most prior work has focused on larger corporations and enterprise cybersecurity hygiene, ignoring the cybersecurity risks that such social relationships and changes in visibility introduce.

In this work, we conduct a deep dive into the experiences of MBOs through two complementary analyses: an evaluation of case records of 38 at-risk MBOs subject to insider threats, and semi-structured interviews with 16 MBOs. Our analysis show a combination of restricted access to financial resources and disruption to relationships drove them to take greater risks in recruiting and access control, leaving them more vulnerable to malicious insider attacks. They also shared that their pursuit of market reach frequently led to an unwanted, hypervisible presence, inadvertently providing intimate insiders among other adversaries with further leverage or information needed to cause harm. We conclude by proposing avenues for eCommerce governance that address these risks, focusing on preventing insider harm within these highly visible environments.