Improving the information security culture through monitoring and implementation actions illustrated through a case study

Abstract

The human aspect, together with technology and process controls, needs to be considered as part of an information security programme. Current and former employees are still regarded as one of the root causes of information security incidents. One way of addressing the human aspect is to embed an information security culture where the interaction of employees with information assets contributes to the protection of these assets. In other words, it is critical to improve the information security culture in organisations such that the behaviour of employees is in compliance with information security and related information processing policies and regulatory requirements. This can be achieved by assessing, monitoring and influencing an information security culture. An information security culture can be assessed by using an approach such as an information security culture assessment (ISCA).The empirical data derived from an ISCA can be used to influence the information security culture by focussing on developmental areas, of which awareness and training programmes are a critical facet.In this paper we discuss a case study of an international financial institution at which ISCA was conducted at four intervals over a period of eight years, across twelve countries. Comparative and multivariate analyses were conducted to establish whether the information security culture improved from one assessment to the next based on the developmental actions implemented. One of the key actions implemented was training and awareness focussing on the critical dimensions identified by ISCA. The information security culture improved from one assessment to the next, with the most positive results in in the fourth assessment.This research illustrates that the theoretical ISCA tool previously developed can be implemented successfully in organisations to positively influence the information security culture. Empirical evidence is provided supporting the effectiveness of ISCA in the context of identified shortcomings in the organisation's information security culture. In addition, empirical evidence is presented indicating that information security training and awareness is a significant factor in positively influencing an information security culture when applied in the context of ISCA.

Defining and identifying dominant information security cultures and subcultures

“…An IS culture has been defined by various researchers [3,19,20,44,66]. It relates to the way things are done in the organisation to protect information [20], which is visible in artefacts (e.g. posters on online training), collective values, norms and knowledge (e.g.…”

“…There are numerous studies indicating which factors influence IS culture with the objective of transforming the culture [4,18,20,28,29,46,50,62,67,69,75,80]. These factors include aspects such as management, awareness, training, policies, compliance and national culture.…”

End user nonmalicious, counterproductive computer security behaviors: concept, development, and validation of an instrument

“…A clear picture of unpleasant consequences that can befall the organization should be communicated; for example, attention may be drawn to what can happen if a hacker is able to gain access to organizations' IS resources due to the direct activity of an employee who visits a compromised website using a work computer. The final step is to monitor such behaviors in the organization . The proposed instrument may have a role in all these steps.…”

Examining the suitability of industrial safety management approaches for information security incident management

“…Albrechtsen and Hovden (2007) claim that traditionally, the field of information security has been preoccupied by the first three stages. However, during the last decade it entered the fourth stage by an increased attention to individual awareness and behavior (Stanton et al, 2005;Möller et al, 2011;Shropshire et al, 2015) as well as the concept of information security culture (Ruighaver et al, 2007;van Niekerk and von Solms, 2010;da Veiga, 2015). In order for information security to reach the fifth step, we claim that there is a need to investigate adaptive management strategies.…”