Organisational security culture: Extending the end-user perspective

Abstract

The concept of security culture is relatively new. It is often investigated in a simplistic manner focusing on end-users and on the technical aspects of security. Security, however, is a management problem and as a result, the investigation of security culture should also have a management focus. This paper describes a framework of eight dimensions of culture. Each dimension is discussed in terms of how they relate specifically to security culture based on a number of previously published case studies. We believe that use of this framework in security culture research will reduce the inherent biases of researchers who tend to focus on only technical aspects of culture from an end-users perspective.

Introduction

It was not until the start of this century that researchers first began to recognise that an organisation's security culture might be an important factor in maintaining an adequate level of information systems security in that organisation (Schwarzwalder, 1999, Breidenbach, 2000, Von Solms, 2000, Andress and Fonseca, 2000, Beynon, 2001). None of these authors, however, presented a clear definition of what they meant with “a security culture”, nor were there any clear views on how to create this organisational culture to support security.

In the last few years, research in this new area of (information) security culture has been expanding rapidly. Unfortunately, a lot of this research still has a limited focus and often only concentrates on the attitudes and behaviour of end-users as well as on how management can influence these aspects of security culture to improve the end-user's adherence to security policies (Schlienger and Teufel, 2002, Ngo et al., 2005). Schlienger and Teufel (2003) more or less defines security culture as “all socio-cultural measures that support technical security measures”, which not only limits its focus to a small sub-dimension of information security, but also enforces the old belief that information security is mostly a technical problem. Information security is, in general, a management problem and the security culture reflects how management handles this problem. Subsequently, we will argue that technical security measures and security policies will often need to be (re)designed to support an organisation's security culture.

In this paper we propose that security policy development is just one of the areas that will be influenced by an organisation's culture. Nosworthy (2000), for instance, states that an organisation's culture has a strong influence on organisational security, as it may ‘hinder change’. Borck (2000) states that ‘beyond deploying the latest technology, effective security must involve the corporate culture as well’. There is strong suggestion from the literature that the study of security culture cannot be carried out in isolation of wider organisational culture. For example, in their review of organisational behavioural studies, Mowday and Sutton (1993) point out that contextual factors play a significant role in influencing individual and group behaviours within organisations. The contextual factors here often reflect the organisation's culture.

In the following sections we will describe how we used Detert et al.'s (2000) framework of eight ‘overarching, descriptive culture dimensions’ to explore the security culture within quite a few organisations with vastly different levels of security. As several of these case studies have been published previously (Shedden et al., 2006, Maynard and Ruighaver, 2006, Koh et al., 2005, Tan et al., 2003, Chia et al., 2003, Chia et al., 2002), we will concentrate on the resulting insights that these case studies have given us into each of these dimensions of an organisational security culture.