Value-Focused Assessment of Information Communication and Technology Security Awareness in an Academic Environment

Abstract

Abstract. The aim of this paper is to introduce the approach of value-focused thinking when identifying information and communications technology (ICT) security awareness aspects. Security awareness is important to reduce human error, theft, fraud, and misuse of computer assets. A strong ICT security culture cannot develop and grow in a company without awareness programmes. How can personnel follow the rules when they don't know what the rules are? [I] This paper focuses on ICT security awareness and how to identify key areas of concern to address in ICT security awareness programmes by making use of the value-focused approach. The result of this approach is a network of objectives where the fundamental objectives are the key areas of concern that can be used in decision making in security planning.

Reconciling value-based objectives for security and identity management

“…The practice of incorporating public values into the policy-making decision process has a robust basis in the academic literature, where the public's opinion is intended to drive policy creation and implementation (Dhillon and Smith, 2017;Dhillon et al, 2016;Dhillon and Torkzadeh, 2006;Drevin et al, 2007;Keeney, 1994Keeney, , 2006Keeney, , 2013Keeney and Palley, 2013;May et al, 2013;Merrick and Garcia, 2004;Merrick et al, 2005a;Merrick et al, 2005b; Reconciling value-based objectives Witesman and Walters, 2014). The opinion of the public is driven by the inherent values of the collective individuals and is very useful for creating policy that is both effective and accepted by those affected through its implementation (Keeney, 1999(Keeney, , 2006Dhillon et al, 2016;Dhillon and Torkzadeh, 2006).…”