A policy driven, human oriented information security model: a case study in UAE banking sector

Abstract

As companies continue to invest in information security, human weaknesses continue to remain a root cause of data breaches in organisations. Several security models have been proposed in the literature but largely remain ineffective at addressing this human vulnerability. In this paper, a policy-driven, human-oriented information security model is proposed. By adopting an information security policy, organizations set strong foundations on which sound security practices can be disseminated and enforced within the organisation. Instead of viewing human as the source of problem, it is a model that put human as the primary source of effectiveness to implement security policy. In this model, staffs in an organization will collectively secure an organisation from attacks. From existing literature and interviews conducted with selected banks in UAE, three primary factors, namely information security policy awareness, security training, and computer & security technology proficiency have been identified and incorporated into the new security model.