A dimension-based information security culture model and its relationship with employees' security behavior: A case study in Malaysian higher educational institutions. Issue 3 (4th May 2019)

• Record Type: Journal Article
• Authors: Nasir, Akhyari; Abdullah Arshah, Ruzaini; Ab Hamid, Mohd Rashid
• Is Part Of: Information security journal. Volume 28:Issue 3(2019)
• Page Start: 55
• Page End: 80
• Publication Date: 2019-05-04
• Subjects: Information security culture -- second-order construct -- information security policy compliance behavior -- security behavior -- dimensions -- PLS-SEM; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1080/19393555.2019.1643956
• Languages: English
• ISSNs: 1939-3555

Abstract

ABSTRACT: Despite strong recommendations by scholars to establish Information Security Culture (ISC), the lack of ISC guidelines persists, particularly in aspects that could effectively improve employees' security behavior in an organization. This study proposes an ISC model based on seven new formulated dimensions to examine its influence on employees' Information Security Policy (ISP) compliance behavior. The dimensions represent specific aspects of ISC and were formulated based on widely accepted concepts of Organizational Culture and ISC. The model was tested at 19 out of 21 public universities in Malaysia and validated using Partial Least Square Structural Equation Modelling (PLS-SEM). Findings revealed all seven dimensions are significant in contributing to the underlying concept of ISC, with Information Security Knowledge being the most important dimension. This ISC concept was also found to be significant in influencing ISP compliance behavior. This study contributes to ISC literature in terms of conceptualization and operationalization of an ISC concept based on the new comprehensive dimensions in relation to ISP compliance behavior. The model could be employed by practitioners in assessing, improving and cultivating a positive ISC that would effectively influence employees' security behavior in higher educational institutions.