A Conceptual Model for Exploring the Factors Influencing Information Security Culture

Human behavior is considered as one of the main threats in an organization. Owing to the fact that human element is the weakest link in security area, it is crucial to provide an ideal information security culture within an organization in order to guide the employees’ perception, attitudes and security behavior. Furthermore, this culture can protect an organization against many information security threats posed by the employees. In this paper, we have proposed a conceptual model exploring the factors influencing the information security culture. Those factors are Security Awareness, Security Knowledge, Belief, Top Management, Security Policy, Security Behavior , Information Security Training, Security Risk Analysis and Assessment, Security Compliance, Ethical and Legal, Trust, Technology, Change Management, People, Information Security, Security Responsibility, Process, Strategy and Environment. The aim of the conceptual model would help the researchers to develop effective solutions and to provide a suitable background for information security culture across an organization. The study recommends researchers to conduct many studies in this area to focus on and investigate each of identified factors in the conceptual model in order to improve information security culture in organizations.