A framework and assessment instrument for information security culture

Veiga, Adéle Da; Eloff, J. H. P.

doi:10.1016/j.cose.2009.09.002

Cited by 277 publications

(206 citation statements)

References 26 publications

Supporting

Mentioning

200

Contrasting

Unclassified

Order By: Relevance

“…If employees consider guidelines difficult to interpret or irrelevant to a business unit, it can easily give ground to non-compliance by way of accidental or deliberate introduction of threats to the environment [11]. Cases of security breaches due to negligence, intent and lack of understanding of policy requirements continue to make rounds despite the certification status attained by other Nigerian banks.…”

Section: 'Compliant Security'mentioning

confidence: 99%

Security by Compliance? A Study of Insider Threat Implications for Nigerian Banks

Fagade

Tryfonas

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Section: 'Compliant Security'mentioning

confidence: 99%

Security by Compliance? A Study of Insider Threat Implications for Nigerian Banks

Fagade

Tryfonas

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

“…According to Da Veiga and Elof [23], Information Security DNA, more commonly known as Information Security Culture, is defined as the "attitudes, assumptions, beliefs, values and knowledge that employees/stakeholders use to interact with the organization's systems and procedures at any point in time. The interaction results in acceptable or unacceptable behavior evident in artefacts and creations that become part of the way things are done in the organizations to protect its information assets."…”

Section: A Information Security Dna Based On Trustmentioning

confidence: 99%

IT Security Trust Model - Securing the Human Perimeter

Vuuren¹

2016

IJSSH

View full text Add to dashboard Cite

Abstract-There are numerous technical advances in the field of Information Security (IS). Despite the application of these IS technological controls, it is often not enough to address security issues due to the vulnerable human component. With a considerable amount of support in literature, there is no doubt that the human factor is a major weakness in preventing IS breaches. The true level of security in technology and process relies on the people involved in its use and implementation. Thus, human factors play an increasing role in securing computer information assets and therefore are detrimental to the security of an organization. One of the most prominent aspects of security, which is linked to humans, is trust. It is safe to presume that trust will play an important role in any IS environment and may influence security behavior significantly. In this paper the findings of a prior study, which focused on identifying human security elements, their relationship with, and consequently their influence on trust, are explored further. This paper builds upon the prior study of identified human security elements, which spawns IS trust factor elements of a previously proposed IT Security Trust (ITST) Model. Furthermore, the paper adapts and expands the original ITST Model, renamed to Information Security DNA Model, providing insight into and recommendations on how the trust factor elements may be utilized in an attempt to manipulate human behavior in such a manner to equip employees with the necessary behavioral attributes for combatting social engineering related attacks within organizations which choose to follow an IS model built on the foundation of trust.Index Terms-Information security, social engineering, human factor, trust factors, trust, smart trust, information security DNA model, IT security trust model.

show abstract

“…This leads to a negative impact on the confidence of customers on the institution. Moreover, other studies such as [5][6][7][8] have concluded that the insiders pose many threats to the protection of the information inside an organization.…”

Section: Introductionmentioning

confidence: 99%

“…In [14] have defined information security culture as "The attitudes, assumptions, beliefs, values and knowledge used by the employees to interact with the organization's systems and procedures at any point in time. The interaction results in acceptable or unacceptable behavior evident in artifacts and creations that become part of the way things are done in an organization to protect its information assets".…”

Section: Introductionmentioning

confidence: 99%