Organisational culture, procedural countermeasures, and employee security behaviour

Abstract

Purpose This paper provides new insights about security behaviour in selected US and Irish organisations by investigating how organisational culture and procedural security countermeasures tend to influence employee security actions. An increasing number of information security breaches in organisations presents a serious threat to the confidentiality of personal and commercially sensitive data. While recent research shows that humans are the weakest link in the security chain and the root cause of a great portion of security breaches, the extant security literature tends to focus on technical issues. Design/methodology/approach This paper builds on general deterrence theory and prior organisational culture literature. The methodology adapted for this study draws on the analytical grounded theory approach employing a constant comparative method. Findings This paper demonstrates that procedural security countermeasures and organisational culture tend to affect security behaviour in organisational settings. Research limitations/implications This paper fills the void in information security research and takes its place among the very few studies that focus on behavioural as opposed to technical issues. Practical implications This paper highlights the important role of procedural security countermeasures, information security awareness and organisational culture in managing illicit behaviour of employees. Originality/value This study extends general deterrence theory in a novel way by including information security awareness in the research model and by investigating both negative and positive behaviours.

Critical Analysis of Information Security Culture Definitions

“…Moreover, this view lacks reliability due to the lack of consensus on the shared cultural values for the assessment of information security culture. This view has an added value of fruitfulness as it contributes to the development of research that is based on national cultures [24] such as crosscultural studies [52] and those based on organizational culture [10,47]. The action-based view.…”

“…This ISC is developed, learned and changes with time with the aim to protect information assets and preserve confidentiality, integrity, and availability of information and information systems resources so as meet to the core organization vision" [38] but they emphasized on a set of shared values in the organization. For instance, Connolly et al [10] investigated the impact of organizational values such as people-orientation, solidarity, sociability, task orientation and flat [31] on individual security behaviors. Tang, Li, & Zhan [47] defined information security culture by using values-based dimensions such as accountability, communication, compliance and governance.…”

“…This complexity of culture has also impacted the theoretical clarity and conceptualization of information security culture in the literature. Depending on the culture theory used, researchers in information security culture focus their understanding of information security culture on actions (behaviors) [38,49], and shared organizational values [7,10,11]. Other researchers categorize information security culture as a part of or as a subculture of organizational culture [42].…”

A Descriptive Review and Classification of Organizational Information Security Awareness Research

“…The articles listed in this subcategory focuses on the habitual practice of doing things by the organizations and its individuals. The way things are done around here is the common theme found in the articles about organizational culture [48,52]. The way things are done around here to protect organizational information assets is the common theme to describe information security culture [48,53,54].…”

Information Security Behavior: A Cross-Cultural Comparison of Irish and US Employees

“…Prior studies have found that security policies and security education can reduce the level of information systems misuse (Connolly, Lang, Gathegi, & Tygar, 2017;Hovav & D 'Arcy, 2012) but the mere existence alone of security policies without proper governance is ineffective (Da Veiga & Eloff, 2007;Shaaban & Conrad, 2013). In their proposed research agenda for information security, Crossler et al (2013) suggest that "it is likely those who are in high-power distance cultures are more readily willing to comply with detailed policy requirements, whereas those from low-power distance cultures are likely to pick-and-choose which policies they feel they should obey."…”