Understanding and transforming organizational security culture

Abstract

PurposeThe purpose of this paper is to examine the practical issues, techniques and learning points associated with information security awareness and organizational change programmes.Design/methodology/approachThe paper is based on the findings and conclusions of research, observations and projects carried out in large organizations over the last two decades. It highlights failings and critical success factors in contemporary approaches to transform organizational culture. It draws on theory and research from the industrial safety field, and discusses its relevance in the information security field.FindingsThe paper identifies the primary reasons why many contemporary enterprise security awareness programmes are ineffective. It discusses the nature of the problem and solution space, identifying the practical issues and opportunities, and gives recommendations on how future programmes can be improved.Research limitations/implicationsThe paper identifies gaps in current research, including the need to confirm whether or not certain findings about incidents in safety field might be applicable to security incidents. It calls for a new approach to information security management that incorporates theory and techniques drawn from psychology and marketing.Practical implicationsThe paper is intended to educate students and researchers working in the information security field on issues and techniques associated with information security awareness and organizational change programmes. It also provides practical advice for business organizations on how to design and implement such programmes.Originality/valueThe paper takes a fresh approach to the subject, examining the relevance of theory and techniques adapted from other fields and drawing new conclusions about the requirements and approach for effective information security awareness and organizational change programmes.

Dysfunctional information system behaviors are not all created the same: Challenges to the generalizability of security-based research

“…This finding should bring the focus of organizations towards effectively shaping their employees" attitudes and preventing inappropriate behaviors against IS security policy. As such, security awareness programs [107][108][109] form one of the many approaches available for organizations to influence their employees" attitudinal belief, which in essence influences attitude.…”

Human resource information systems: Information security concerns for organizations

“…Examples of human error include forgetting to change passwords, not logging off before leaving a workstation, or careless discarding of sensitive information (Warkentin & Willison, 2009). Case studies, scenario planning, and crisis exercises are used to create awareness, and are an effective means of changing organizational security culture (Hagen, Albrechtsen, & Hovden, 2008;Lacey, 2010). According to Johnson (2006), benefits from awareness programs mitigate overall security risks, increase reliability and correctness of information, and result in early detection of potential security incidents.…”

Managing professional and personal sensitive information

“…The technology is often expensive or difficult to manage, and quickly becomes outdated, but the most critical aspect could be the people we often leave behind from the equation when pursuing methods to manage our sensitive information. Yet, managing sensitive information cannot be completed through a focus on only policies, processes, and technology, but also requires a change in employee awareness, attitude, and behavior (Lacey, 2010). …”

“…When sensitive information is breached, we need to stop and think before reacting, as often "the best performers make the most serious and glaring mistakes because they work harder, faster and are more empowered. The logical response to a major breach is to investigate what went wrong, rather than who is to blame" (Lacey, 2010). Thus, a holistic approach in the implementation of an information security program is often recommended.…”