Holistic framework for evaluating and improving information security culture

Abstract

PurposeThe objective of this research was to propose and validate a holistic framework for information security culture evaluation, built around a novel approach, which includes technological, organizational and social issues. The framework's validity and reliability were determined with the help of experts in the information security field and by using multivariate statistical methods.Design/methodology/approachThe conceptual framework was constructed upon a detailed literature review and validated using a range of methods: first, measuring instrument was developed, and then content and construct validity of measuring instrument was confirmed via experts' opinion and by closed map sorting method. Convergent validity was confirmed by factor analysis, while the reliability of the measuring instrument was tested using Cronbach's alpha coefficient to measure internal consistency.FindingsThe proposed framework was validated based upon the results of empirical research and the usage of multivariate analysis. The resulting framework ultimately consists of 46 items (manifest variables), describing eight factors (first level latent variables), grouped into three categories (second level latent variables). These three categories were built around technological, organizational and social issues.Originality/valueThis paper contributes to the body of knowledge in information security culture by developing and validating holistic framework for information security culture evaluation, which does not observe information security culture in only one aspect but takes into account its organizational, sociological and technical component.

Cyber4Dev Security Culture Model for African Countries

“…Only factors with more than 10 citations were included. [36], [48], [49], [12], [38], [44], [50], [15], [16] Compliance and trust 11 [47], [36], [48], [51], [12], [52], [37], [46], [39], [43], [41] Information security policy/regulations 16 [47], [36], [48], [51], [49], [52], [37], [46], [38], [21], [10], [53], [45], [15], [11] Top management/leadership support 18 [47], [36], [48], [51], [49], [52], [37], [46], [38], [21], [54], [39], [10], [43], [55], <...…”

Towards a Cybersecurity Culture-Behaviour Framework: A Rapid Evidence Review

“…A similar multi-factor measure developed through a comprehensive mixed methods approach identified three main factors (organisational measures, sociological factors and technical measures) (Arbanas et al, 2021). This measure is not recommended due to the lack of evidence of its use in another sample and the inclusion of a technical dimension in the culture measure.…”