Investigating the Concept of Information Security Culture

View Sample PDF

Author(s): Daniel Oost (University of Technology, Australia)and Eng K. Chew (University of Technology, Australia)
Copyright: 2012
Pages: 12
Source title: Strategic and Practical Approaches for Information Security Governance: Technologies and Applied Solutions
Source Author(s)/Editor(s): Manish Gupta (State University of New York at Buffalo, USA), John Walp (M&T Bank Corporation, USA)and Raj Sharman (State University of New York, USA)
DOI: 10.4018/978-1-4666-0197-0.ch001

Keywords: Information Science Reference / Information Security & Privacy / IT Security and Ethics / Security & Forensics

Purchase

View Investigating the Concept of Information Security Culture on the publisher's website for pricing and purchasing information.

Abstract

The concept of an “information security culture” is relatively new. A review of published research on the topic suggests that it is not the information security panacea that has been suggested. Instead, it tends to refer to a range of existing techniques for addressing the human aspect of information security, oversimplifying the link between culture and behaviour, exaggerating the ease with which a culture can be adjusted, and treating culture as a monolith, set from the top. Evidence for some of the claims is also lacking. This chapter finds that the term “information security culture” is ambiguous and vague enough to suggest the possibility of achieving an almost mystical state, whereby behaviour consistent with information security is second nature to all employees, but when probed does not deliver. Instead, future research should be clear about what it considers information security culture to be, should provide evidence for claims, and should take complexity and context seriously.

The IRMA Community

Research IRM

Investigating the Concept of Information Security Culture

Purchase

Abstract

Related Content

IRMA Sponsors