Creating a Security Culture Development Plan and a case study

When developing training and awareness programs, information security specialists usually fail to consider the human element as an important component of the program (Kruger et al, 2006). They tend to focus on security policies and technical aspects leaving aside the human aspect of information security. We argue that it is necessary that the characteristics of the employees (roles and learning styles), the compliance with the current policies, the state of the security culture and the mission, vision and strategic planning of the organization be considered when setting up a security culture development plan. This paper describes the steps that should be followed to develop a Security Culture and reports a case study in an organisation where the development plan was applied.