Understanding and transforming organizational security culture

Abstract

PurposeThe purpose of this paper is to examine the practical issues, techniques and learning points associated with information security awareness and organizational change programmes.Design/methodology/approachThe paper is based on the findings and conclusions of research, observations and projects carried out in large organizations over the last two decades. It highlights failings and critical success factors in contemporary approaches to transform organizational culture. It draws on theory and research from the industrial safety field, and discusses its relevance in the information security field.FindingsThe paper identifies the primary reasons why many contemporary enterprise security awareness programmes are ineffective. It discusses the nature of the problem and solution space, identifying the practical issues and opportunities, and gives recommendations on how future programmes can be improved.Research limitations/implicationsThe paper identifies gaps in current research, including the need to confirm whether or not certain findings about incidents in safety field might be applicable to security incidents. It calls for a new approach to information security management that incorporates theory and techniques drawn from psychology and marketing.Practical implicationsThe paper is intended to educate students and researchers working in the information security field on issues and techniques associated with information security awareness and organizational change programmes. It also provides practical advice for business organizations on how to design and implement such programmes.Originality/valueThe paper takes a fresh approach to the subject, examining the relevance of theory and techniques adapted from other fields and drawing new conclusions about the requirements and approach for effective information security awareness and organizational change programmes.