Measurement and Improvement of Information Security Culture

Abstract

Remote IT based operations of offshore oil and gas installations are increasing in the North Sea. The motivation for remote operation is increased income, cost reductions and more efficient support. The technology used to support operations is changing from proprietary closed systems to standardised IT systems built on PC’s and MS Windows connected to both internal networks and the Internet. In addition the operations and management of the oil and gas fields are increasingly being performed by a network of firms that functions as a virtual organization. The network organizations and the increased vulnerabilities create the need for improved information security. Our hypothesis is that an important contribution to improved information security (IS) is improved IS culture and improved communication during operations and incident handling. IS culture should be explicitly focused, and actions should be taken to improve IS culture from a purely rule based culture to an ideal learning culture. We have suggested a method called CheckIT consisting of a questionnaire and a process to improve IS culture based on group discussions. The questionnaire consists of questions and suggested answers based on denial based culture, rule based culture and the ideal learning culture, to enable the participants to explore their culture and identify areas to be improved.