CHAPTER 2: LITERATURE REVIEW
2. Introduction
2.9 Public Organisation Information Security Culture
Public organisations require a strong security culture in their mode of operation.
Malekian et al. (2017) stated that a sustainable security culture is required to secure the information in addition to the data. When the security culture is sustainable, then it transforms security from an event to part of the company’s lifecycle, which generates security. The information security is not relying on the technology (Siponen et al., 2014). The culture encourages the employees to comply with the informational policies related to collecting in addition to managing the information, which will improve the information security.
2.9.1 Organisational Culture
Pearlson et al. (2016) stated that organisational culture includes the organisation’s expectations and experiences as well as the values which hold it together, and its interactions with the outside world along with its future expectations. The organisational culture affects its productivity and performance along with guidelines concerning customer care. Organisational culture is different for each organisation and one of the critical aspects is the ability to respond to change.
59 2.9.2 Information Security Culture
Siponen et al. (2014) discussed that information security culture is based on how things are to be done within the organisation with regard to information security, with the aim being to protect the information assets along with influencing employees’ security behaviour.
Information security culture is a part of the organisational culture as the security of information is an organisational function. In order to gain a secure environment for the information assets, the practices of information security have become a part of corporate culture within the organisation (Kim et al., 2014). The culture guides activities within the organisation and the employees by placing constraints on the organisational activities and employee behaviour. The culture influences the human behaviour; therefore, there is a requirement to establish information security behaviour of the organisational employees. Malekian et al. (2017) defined information security culture as the perceptions, attitudes and assumptions of employees within the organisation based on information security. The culture develops as a result of employees’
interactions with the information security controls.
Abbasi, Sarker and Chiang (2016) suggested that the information security culture is considered as accepted behaviour as well as actions by the employees. The culture involves identifying the security-related issues and beliefs along with values of the group that shape the security-related behaviours. Safa et al. (2016) defined the information security culture as the totality of the human attributes like behaviours and attitudes as well as the beliefs held by the organisation. This could impact the security of the organisation, which may or may not be explicitly linked to the impact (Siponen et al., 2014). The procedures which the employees are using in their daily work represent the weakest link in the chain of information security. It is
60
necessary to develop as well as improve the information security culture through a structured model to address the human behaviour.
2.9.3 Cultural Change
Cultural change is a term used in policy making to emphasise the influence of the cultural capital on individuals along with community behaviour. Vance et al. (2014) stated that cultural changes places a stress on social along with cultural capital which lead to determining the decision make to interact with the people (Pearlson et al., 2016). The cultural capital influences include the role of management.
2.9.4 Cultural Impact on Human Behaviour
Comparative research from other research studies shows that human social behaviour varies across various domains such as cooperation, culture, trust and morality. In order to better tackle human behaviour, work on cultural evolution is required. San Martin et al. (2018) stated that people are surprised when they witness how others behave when they are travelling across various cultures. Apart from regular observations, the cultural differences in behaviour are documented by means of psychological research. As an example, comparing Chinese and Canadian toddlers, Chinese toddlers spend more time in direct contact with their mothers and take more time to approach and play with strangers (Fuentes, 2017). This is an example of cultural differences in human behaviour in early childhood time. Taylor and Bean (2017) argued that there are theoretical accounts of various cultural differences in human behaviour, which can emphasise cognitive as well as affective processes. Perreault and Mathew (2016) proposed that Westerners hold a self-governing self-concept which is not affected by means of social contexts.
61
Varnum and Grossmann (2016) discussed that human behaviour is affected by genetic inheritance as well as by means of experience. In this way, people can develop and be shaped by their social experiences as well as situations in the context of inherited genomic. Each person is born into cultural as well as social settings; therefore, they are required to build social connections with community and family, close ones. Characteristics of the social settings among children are affected by how they think and behave. Each culture contains dissimilar webs of patterns plus meanings, ways to earn a living, social roles, and civilizations besides beliefs.
Abbasi, Sarker and Chiang (2016) mentioned that the culture is induced by behavioural patterns, like patterns of speech, body language and type of humour. In a large society, there are various groups from different cultures linked by a region and social classes. Mishra et al. (2014) argued that, when a single culture is dominant in a large region, then its social value is considered as accurate as well as promoted. In each culture, there are fair as well as unfair social differences and wanted or unwanted believes. The distinctions among class are due to wealth, occupation and education. According to Siponen et al. (2014), class affects what opportunities and threats people experience; therefore, it affects people’s paths and their living standards.