Understanding Information Security Culture: A Conceptual Framework

The importance of establishing an information security culture in an organization has become a well established idea. The aim of such a culture is to address the various human factors that can affect an organization’s overall information security efforts. However, understanding both the various elements of an information security culture, as well as the relationships between these elements, can still be problematic. Schein’s definition of a corporate culture is often used to aid understanding of an information security culture. This paper briefly introduces Schein’s model. It then incorporates the important role knowledge plays in information security into this definition. Finally, a conceptual framework to aid understanding of the interactions between the various elements of such a culture, is presented. This framework is explained by means of illustrative examples, and it is suggested that this conceptual framework can be a useful aid to understanding information security culture.