E-Banking security and organisational changes. An action research study.

The thesis considers customer security in a major European bank Bank X. The action research focus is to strengthen the processes and the overall solution for online Bank customers which experience a significant growth and increase in use. There seem to be a common misperception between the internal staff of the bank and its customers regarding what security is, and the research considers several new security situations in the banking business. Moving from branch-oriented business to a digital orientation within the time space of just a few years has challenged banks to create new solutions for their customers. Such solutions must be secure, but technical security need separation from human security since new approaches as for example social engineering easily can be a source for fraud and losses for customers in a modern digital bank. This thesis uses action research by interviewing leaders and team members in one security team. The internal researcher role also introduce proposals and suggestions to the team during the research, which locate the action. A connection between stakeholders’ security definitions, re-organisations and the end solutions is important to understand, to improve the situation. Findings reveal that internal communications have an external customer’s communications effect and that re-organisational tasks should focus to adjust the external factors, not only internal benefits. Re-organisational planning does not increase customer security instantly, but some participants can see long-term benefits. The problem is, however, that the long-term world-view changes continuously, and without adjustments organisations depending on cyber security fall behind in the new, but ongoing battle between usability vs security and cost. A modern digital bank should no longer act as a traditional bank, but more as an IT company. This claim opens the way for new ideas and solutions, but blending the banking business and the computer industry can be challenging due to the professional distance between the groups. Future re-organisations should therefore aim for cross-divisional collaboration, increasing communication internally and opening routes for a dualistic contact with customers whereby information and awareness campaigns can be just as effective as technical and physical firewalls. The computer and banking industries are now working towards a remote market with a distance to the online-customers, and while the computer industry has experience to perform business with less customer contact, the banks have now also moved from close contact to digital contact. For this reason, modern banks must think differently and understand what the business is and how to secure it, but never forget the major resource and security problem – the human being