Influences on Espoused and Enacted Security Cultures in Organizations

Approaches to the management of Information Systems (IS) security in organizations have relied mostly on complex technical controls. In recent years, management of IS security by developing a security culture in organizations is emerging as an important stream in IS security research. The intent of this study is to contribute to the body of knowledge dealing with security culture. Security cultures include both security-related beliefs and security-related behaviors. The first premise of the study is that such beliefs and behaviors may not be consistent with each other. The study will examine the factors affecting both security-related beliefs and behaviors to explain differences between the two. The second premise of the study is that the security culture may vary across different groups within an organization. The study will examine factors, internal and external to the organization, which influence security cultures in different groups. A positivistic case-study based approach will be used.