Information Security Culture in Small and Medium Size Enterprises

Interest in the security of information and knowledge management systems has been increasing together with the developments in information and communication technology. Besides information management, an organization has to enable knowledge creation. From the security point of view this means that an organization has to secure both information and knowledge. Attempts to cover both information and knowledge security have often been discussed under the title of “information security awareness” and more recently under the title of “information security culture”. The aim of this paper is to study the concept of information security culture and apply this concept to small and medium size enterprises (SMEs). The paper has a broad view to information security culture and regards it as a complex system consisting of interacting framework and content categories of information security awareness. The development of a common information security culture for an organization is a huge task, because it shall be based on mutually agreed visible signs, practices and images, values and basic assumptions.