A Conceptual Model for Exploring the Factors Influencing Information Security Culture

Abstract

Human behavior is considered as one of the main threats in an organization. Owing

Holistic framework for evaluating and improving information security culture

“…Tang et al (2016), Van Niekerk and Von Solms (2010) and Solomon and Brown (2020) investigated the relationship between information security culture and organizational culture, Alnatheer (2014), Shkarlet et al (2020) and Sas et al (2020) explored assessment and measurement of information security culture, while other researchers focus their work on determining dimensions (factors) of information security culture (Sherif and Furnell, 2015; Nel and Drevin, 2019; Arbanas, 2020). On the other hand, Van Niekerk and Von Solms (2010) and Mahfuth et al (2017a, b) worked on development of conceptual models and revealed that there is a positive relationship between levels of knowledge and employees' behaviour, which is not surprising since Bouhnik et al (2021) have shown that, in order for the security behaviour to become their second nature, people must first be educated to do so.…”

“…Also, there were a number of systematic literature reviews related to information security culture (Alhogail and Mirza, 2014; Alnatheer, 2014; Karlsson et al , 2015; Hassan et al , 2015; da Veiga et al , 2020) with the conclusion that existing research is largely theoretical or descriptive, and there is a lack of knowledge in identifying factors and measuring the impact on information security culture. Many researchers pointed out that there is a growing need for comprehensive empirical research in this area (Mahfuth et al , 2017a, b; Alhogail and Mirza, 2014; Karlsson et al , 2015), which was one of the motives for this research.…”

“…A further review in this field was performed by Mahfuth et al (2017a, b), who found that academic definitions of information security culture are mainly focused on Schein (2010) and his work related to organizational culture, whose model of corporate culture has become widely accepted among information security researchers. However, this model describes corporate culture in general, not information security culture in particular (Van Niekerk and Von Solms, 2010).…”

“…For this reason, Van Niekerk and Von Solms (2010) added a fourth layer, the knowledge layer, which provides an improved model for describing information security culture. To establish an acceptable and effective information security culture, it is necessary to focus on improving the safety behaviour of people in organizations by focusing on the required knowledge of employees (Mahfuth et al , 2017a, b). Georgiadou et al (2020) developed a cyber-security culture framework for assessing organization readiness which defines two levels, namely organizational level consisted of factors related to organization's security technology, operations, policies etc., and individual level targeted on employees' characteristics and attributes, which have impact on their attitude and behaviour.…”

“…Many researchers investigated different aspects of information security management. A growing body of research has been focused on human factor in information security management and consistently portrays people as “weakest link” of information security (Mahfuth et al , 2017a, b; Soomro et al , 2016). However, Georgiadou et al (2021) argue that human factor is still not recognized as a core information security element as indicated in the incident reports and recognize the lack of guidelines regarding security threats as one of the biggest argument to that claim.…”