Tool Supported Management of Information Security Culture

Abstract

Key words:In this paper, we present a management process we have developed for an Information Security Culture. It is based theoretically on action research and practically on expert interviews and group discussions. A Decision Support System, which supports the process, allows quick survey of the existing Information Security Culture in an organization and analysis of the results, thus discovering strong and weak points. This tool recommends, based on stored measures and rules, actions to improve the weak points. It helps security officers to do their work and to improve the Information Security Culture in their organizations. The application of the process and the Decision Support System in a Private Bank is presented here and major findings are discussed.

A framework and assessment instrument for information security culture

“…further used the organisational culture levels of Schein to compile a framework to better understand information security culture. Schlienger and Teufel (2005), Vroom and Von Solms (2004) and Zakaria and Gani (2003) also linked information security culture to the organisational culture model of Schein (1985). Dhillon (1997) related ''security culture'' to the behaviour of employees in an organisation that could contribute to the protection of information.…”

“…Quantitative research methods such as conducting surveys and the validation of frameworks and questionnaires have been deployed with great success in the information security discipline (Schlienger and Teufel, 2005;Straub et al, 2004;Straub, 1990;Workman et al, in press;Siponen et al, 2007;Woon et al, 2005). A survey is a method that organisations can use to study information security behavioural content in general, and attitude and opinions (Berry and Houston, 1993) of employees towards information security in particular.…”

A cybersecurity culture research philosophy and approach to develop a valid and reliable measuring instrument

“…The organizational culture that develops on the basis of exhibited behavior is evident in artifacts (using encryption), values ("the privacy of 978-1-4673-8460-5/16/$31.00 ©2016 IEEE customer data is respected"), and basic assumptions ("executive management understand the risk to information") [49].…”

“…• Factor A -20 statements: 49,55,50,54,62,35,61,58,57,28,60,22,56,24,66,64,42,21,47,32 • Factor B -13 statements: 44,43,30,36,45,29,34,38,46,53,19,27,52 • Factor C -5 statements: 26, 23, 39, 31, 33…”

A Conceptual Model to Understand Information Security Culture

“…Organization culture has emerged in this literature review as essential elements that influence security culture. Security culture was itself considered as part of the organization culture [10], [15], [19]. Moreover, national culture is known to have cultural beliefs in which have strong influences on Information Technology diffusion [27].…”