Defining the relationship between information security culture and information security practices

© 2012 Dr. Joo Soon LimThis thesis investigates the relationship between ‘information security culture’ and ‘information security practices’ in organisations. There has been considerable interest in this relationship due to recent and widespread recognition that poor information security practices, rather than insufficient technical controls, are the primary reason for information security problems. Additionally, it is argued that there is a need for information security culture to cultivate and support security practices. This implies that a relationship exists between them, and through understanding this relationship, improvements to information security in organisations can be made. This research asks the following main research question: What is the relationship between security culture and security practices? This study develops a rigorous conceptual framework that identifies the particular security culture characteristics that support and guide security practices towards improving organisational information security. The framework is then used as the basis for qualitative followed by quantitative studies that empirically examine the precise relationship between security culture and security practices. This ‘mixed method’ approach has resulted in four main contributions. These are: • Empirical establishment of the relationship between security culture and security practices• Refinement of security culture characteristics• Synthesis and empirical demonstration of the existence of security practices• Development of a valid and reliable instrument to measure the relationship between security culture characteristic and security practices. This research found that a shared security vision, sense of employee empowerment, collaboration and cooperation, evidence-based decision making, and proper systems and processes, when simultaneously cultivated, explained most of the variance of existence of security practices in the six case organisations. In particular, ‘employee empowerment’ and ‘shared security vision’ have a favourable effect on the practice of security, which in turn benefits organisations