Logo image
Back
Information security culture: a behaviour compliance conceptual framework
Conference paper   Open access   Peer reviewed

Information security culture: a behaviour compliance conceptual framework

Salahuddin Alfawaz, Karen J Nelson and Kavoos Mohannak
Proceedings of the 8th Australasian Information Security Conference, pp.47-55
Australasian Information Security Conference (AISC), 8th (Brisbane, Australia, 19-Jan-2010–20-Jan-2010)
Australian Computer Society Inc.
2010
pdf
PDF - Author's Accepted Version208.32 kBDownloadView
Accepted VersionPDF - Author Accepted Version Open Access
url
http://dl.acm.org/citation.cfm?id=1862275View
Webpage

Abstract

Data Format information security management conceptual framework information security culture information security behaviour and compliance
Understanding the complex dynamic and uncertain characteristics of organisational employees who perform authorised or unauthorised information security activities is deemed to be a very important and challenging task. This paper presents a conceptual framework for classifying and organising the characteristics of organisational subjects involved in these information security practices. Our framework expands the traditional Human Behaviour and the Social Environment perspectives used in social work by identifying how knowledge, skills and individual preferences work to influence individual and group practices with respect to information security management. The classification of concepts and characteristics in the framework arises from a review of recent literature and is underpinned by theoretical models that explain these concepts and characteristics. Further, based upon an exploratory study of three case organisations in Saudi Arabia involving extensive interviews with senior managers, department managers, IT managers, information security officers, and IT staff; this article describes observed information security practices and identifies several factors which appear to be particularly important in influencing information security behaviour. These factors include values associated with national and organisational culture and how they manifest in practice, and activities related to information security management.

Details

Metrics

210 File views/ downloads
706 Record Views
Logo image