Australian Information Security Management Conference
Document Type
Conference Proceeding
Publisher
Security Research Centre, School of Computer and Security Science, Edith Cowan University, Perth, Western Australia
Abstract
Managing Information Security is becoming more challenging in today’s business because people are both a cause of information security incidents as well as a key part of the protection from them. As the impact of organizational culture (OC) on employees is significant, many researchers have called for the creation of information security culture (ISC) in organizations to influence the actions and behaviour of employees towards better organizational information security. Although researchers have called for the creation of ISC to be embedded in organizations, nonetheless, literature suggests that little past research examining the relationship between the nature of OC and ISC. This paper seeks to explore the relationship between the nature of OC and ISC and argues that organizations that have a medium to high security risk profile need to embed the ISC to influence employee actions and behaviours in relation to information security practices. In addition, this paper also introduces a framework to assist organizations in determining the extent to which the desired ISC is embedded into OC.
DOI
10.4225/75/57b4065130def
Comments
7th Australian Information Security Management Conference, Perth, Western Australia, 1st to 3rd December 2009