Information security culture – state-of-the-art review between 2000 and 2013

Abstract

Purpose – The aim of this paper is to survey existing information security culture research to scrutinise the kind of knowledge that has been developed and the way in which this knowledge has been brought about. Design/methodology/approach – Results are based on a literature review of information security culture research published between 2000 and 2013 (December). Findings – This paper can conclude that existing research has focused on a broad set of research topics, but with limited depth. It is striking that the effects of different information security cultures have not been part of that focus. Moreover, existing research has used a small repertoire of research methods, a repertoire that is more limited than in information systems research in general. Furthermore, an extensive part of the research is descriptive, philosophical or theoretical – lacking a structured use of empirical data – which means that it is quite immature. Research limitations/implications – Findings call for future research that: addresses the effects of different information security cultures; addresses the identified research topics with greater depth; focuses more on generating theories or testing theories to increase the maturity of this subfield of information security research; and uses a broader set of research methods. It would be particularly interesting to see future studies that use intervening or ethnographic approaches because, to date, these have been completely lacking in existing research. Practical implications – Findings show that existing research is, to a large extent, descriptive, philosophical or theoretical. Hence, it is difficult for practitioners to adopt these research results, such as frameworks for cultivating or assessment tools, which have not been empirically validated. Originality/value – Few state-of-the-art reviews have sought to assess the maturity of existing research on information security culture. Findings on types of research methods used in information security culture research extend beyond the existing knowledge base, which allows for a critical discussion about existing research in this sub-discipline of information security.

A cybersecurity culture research philosophy and approach to develop a valid and reliable measuring instrument

“…If focus groups or interviews are conducted, the method could extend to an inductive method. 978-1-4673-8460-5/16/$31.00 ©2016 IEEE • Strategy: Quantitative research methods have been used with great success in the information security discipline [2,29,50]. One of the benefits of using a quantitative approach is that specific areas of concern (e.g.…”

“…• Factor A -20 statements: 49,55,50,54,62,35,61,58,57,28,60,22,56,24,66,64,42,21,47,32 • Factor B -13 statements: 44,43,30,36,45,29,34,38,46,53,19,27,52 • Factor C -5 statements: 26, 23, 39, 31, 33…”

Social Groupings and Information Security Obedience Within Organizations

“…For example, in [10] it is argued that information security obedience (i.e., compliance with policies) binds together information security, corporate governance and corporate culture and in [11] "culture" is described as the ideal state of "compliance. The most frequently cited their theoretical frameworks in r research on information security culture [12] are those of Edgar Schein and Geert Hofstede. Schein's framework is a three-tiered model that explains organizational culture on the levels of shared basic assumptions, espoused values and artifacts/behaviors [13].…”

Analysing information security in a bank using soft systems methodology

“…It is discussed in the next section. Karlsson et al's (2015) systematic review of information security culture research identifies that almost 40 percent of the papers are theoretical and do not include empirical data. Unlike those papers, this research is based on empirical data and it is conducted with a qualitative interpretivist approach using an embedded single case study methodology.…”

“…Unfortunately, most research has focussed on technology and more work is required on the sociotechnical aspects of information security (Hagen, Albrechtsen, & Hovden, 2008) In response to this need to focus on the socio-technical threats, and Karlsson et al's (2015) exhortation for more empirical and in-depth research, this paper presents a case study of a major bank in a developing economy. Since global finance is highly interconnected, it is important that banks in such economies do not comprise a weak link and hence results from this case have value for the industry as a whole.…”