Scp-bp Framework: Situational Crime Prevention for Managing Data Breaches in Business Processes

From a ‘people, process and technology’ viewpoint, the most overlooked area for organisational cybercrime prevention is the ‘process’ component. While there is an increase in ‘technology’ and ‘people’ approaches for organisational resilience against cybercrimes, there is a lot of opportunity for novel ‘process’-oriented interventions to prevent cybercrimes. In this work, we apply a successful criminology practice, Situational Crime Prevention (SCP), to integrate criminology principles with cybersecurity controls into Business Process Management (BPM). An SCP-based framework for managing business processes (i.e., the SCP-BP Framework) is proposed to guide cybersecurity control implementation (e.g., ISO/IEC 27002:2022) for business process participants to reduce cybercrime opportunities. A real-world data breach use case demonstrates an application of our SCP-BP Framework. The SCP-BP Framework significantly enhances cybercrime prevention efforts by (i) simplifying cybersecurity controls for business professionals, encouraging their involvement and engagement in cybercrime prevention, and facilitating collaboration with cybersecurity professionals in managing business processes. (ii) It provides cybersecurity professionals with crucial criminology knowledge, highlighting the importance of non-technical controls in BPM for effective cybercrime prevention. Furthermore, (iii) the Framework introduces criminology concepts into business process design, advocating for the integration of cybercrime prevention techniques within information systems and provides a method to incorporate cybercrime prevention practices during the redesign phase in the BPM lifecycle. It underscores the necessity of adopting a criminological perspective to BPM in the context of cybercrime prevention, highlighting the interconnectedness of various disciplines and processes as well as discussing its drawbacks and limitations in safeguarding against cybercrimes.