This research outlines some dimensions of computer and information security (CIS) culture. Two exploratory studies were conducted to identify the various dimensions of CIS culture. One study included an industry workgroup consisting of six CIS managers and specialists. The second study consisted of individual interviews with eight CIS managers and managers and eight network administrators. The workgroup and CIS managers and network administrators provided a preliminary list of elements in CIS culture dimensions, including: employee participation, training, hiring practices, reward system, management commitment, and communication and feedback.
CarayonP.KraemerS. (2003) Human factors in e-security: The business viewpoint (Technical Report 184). Madison, WI: Center for Quality and Productivity Improvement.
3.
CarayonP.KraemerS. (2003) Using accident analysis methods in computer security: The development of the Human Factors Vulnerability Analysis (HFVA). In Proceedings of the XVth Triennial Congress of the International Ergonomics Association and the 7th Joint Conference of Ergonomics Society of Korea/Japan Ergonomics Society. Seoul, Korea.
4.
GlendonA. I.StantonN. A. (2000). Perspectives on safety culture. Safety Science, 34, 193–214.
5.
GuldenmundF. W. (2000) The nature of safety culture: A review of theory and research. Safety Science, 34, 215–257.
6.
HelokunnasT.KuusistoR. (2003) Information security culture in a value net. IEEE, 190–194.
7.
KraemerS.CarayonP. (2003). A human factors vulnerability evaluation method for computer and information security. In The Human Factors and Ergonomics Society (Ed.) Proceedings of the Human Factors and Ergonomics Society 47th Annual Meeting (pp. 1389–1393). Santa Monica, CA: The Human Factors and Ergonomics Society.
8.
KraemerS.CarayonP. (submitted). A conceptual framework of human error in computer and information securityApplied Ergonomics.
9.
MartinsA.EloffJ. (2002) Information security culture. Paper presented at the IFIP TC11 17th International Conference on Information Security (SEC2002): Security in the Information Society: Visions and Perspectives, Cairo, Egypt.
10.
RosnessR.RuuhilehtoK. (1993) Identification of human and organizational factors. In SuokasJ.RouhiainenV.Quality Management of Safety and Risk Analysis (pp. 104–124). Amsterdam: Elsevier.
11.
SasseM. A.BrostoffS.WeirichD. (2001). Transforming the ‘weakest link’ - a human/computer interation approach to usable and effective security. BT Technology Journal, 19 (3), 122–131.
12.
ScheinE. H. (1992) Organizational Culture and Leadership (2nd ed.). San Francisco: Jossey-Boss.
13.
SchneierB. (2000) Secrets and lies: Digital Security in a Networked World. New York: John Wiley & Sons, Inc.
14.
SiponenM. T. (2000) A conceptual foundation for organizational information security awareness. Information Management & Computer Security8 (1), 31–41.
15.
SutcliffeA.RuggG. (1998). A taxonomy of error types for failure analysis and risk assessmentInternational Journal of Human-Computer Interaction, 10 (4), 381–405.
16.
Van der SchaafT. W. (1991). A Framework for Designing Near Miss Management Systems. In Van der SchaafT. W.LucasD. A.HaleA. R.Near Miss Reporting as a Safety Tool(pp. 27–34). Oxford: Butterworth-Heinemann Ltd.
17.
Von SolmsB. (2000). Information security - The third wave? Computers & Security, 19 (7), 615–620.
18.
VroomC.Von SolmsR. (2004). Towards information security behavioural compliance. Computers & Security, 23, 191–198.
