Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture

Abstract

Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture.Computers & Security, http://dx.doi.org/10.1016/j.cose. 2014.03.004 Access to the published version may require subscription. N.B. When citing this work, cite the original published paper. Permanent link to this version:http://urn.kb.se/resolve?urn=urn:nbn:se:kth:diva- 142630 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 AbstractThis paper presents an empirical investigation on what behavioral information security governance factors drives the establishment of information security knowledge sharing in organizations. Data was collected from organizations located in different geographic regions of the world, and the amount of data collected from two countries -namely, USA and Sweden -allowed us to investigate if the effect of behavioral information security governance factors on the establishment of security knowledge sharing differs based on national culture.The study followed a mixed methods research design, wherein qualitative data was collected to both establish the study"s research model and develop a survey instrument that was distributed to 578 information security executives. The results suggest that processes to coordinate implemented security knowledge sharing mechanisms have a major direct influence on the establishment of security knowledge sharing in organizations; the effect of organizational structure (e.g., centralized security function to develop and deploy uniform firm-wide policies, and use of steering committees to facilitate information security planning) is slightly weaker, while business-based information security management has no significant direct effect on security knowledge sharing. A mediation analysis revealed that the reason for the non-significant direct relation between business-based information security management and security knowledge sharing is the fully mediating effect of coordinating information security processes. Thus, the results disentangles the interrelated influences of behavioral information security governance factors on security knowledge sharing by showing that information security governance sets the platform to establish security knowledge sharing, and coordinating processes realize the effect of both the structure of the information security function and the alignment of information security management with business needs.A multigroup analysis identified that national culture had a significant moderating effect on the association between four of the six proposed relations. In Sweden -which is seen as a less individualist, feminine country -managers tend to focus their efforts on implementing controls that are aligned with business activities and employees" need; monitoring the effectiveness of the implemented con...

Organizational practices as antecedents of the information security management performance

“…Thus, the works that describe a great variety of factors of organizational type are incipient and with a predominant qualitative analysis. These factors are business size, sector, information security policy, information security education, training, culture, behavior and compliance with security policy, awaraness, knowledge, visibility (Flores et al, 2014;Singh et al, 2014;Cram et al, 2017;Doherty and Tajuddin, 2018). The literature highlights the need to advance in the field of knowledge not only describing but also organizing the factors and analysing in an empirical way the effect they have on the performance of information security management.…”

“…The literature highlights the need to advance in the field of knowledge not only describing but also organizing the factors and analysing in an empirical way the effect they have on the performance of information security management. It is especially necessary to do it in small and medium-sized enterprises (SMEs) where there is a greater lack of work despite the fact that they are the most numerous business organizations in the developed economies, having an important contribution for the employment and productivity (OECD, 2009;Flores et al, 2014;Safa and Von Solms, 2016).…”

A Security and Privacy Framework for e-Learning

“…This platform can serve as a basis for an effective information security strategy. Such strategy should be tied to the whole organizational strategy as it will serve to protect the organization and ensure business continuity [60]. Accordingly, the stakeholders will have their own sets of needs and resources.…”

Implantación de un sistema de gestión de seguridad de información bajo la ISO 27001: análisis del riesgo de la información

“…Existe, además, una escasez presupuestaria para el fomento de la innovación consecuencia de una predisposición cultural al cambio y a la implementación de tecnología para la administración y seguridad de la información (Kilic & Metin, 2012). De esta manera, el atraso tecnológico y la falta de adecuación de las tecnologías a las exigencias del mercado limitan su capacidad para crear productos de mejor calidad (Fenz & Ekelhart, 2009;Rocha Flores, Antonsen, & Ekstedt, 2014).…”