Information security culture the socio-cultural dimension in information security management

Abstract

The information security management mostly disregards the human dimension. The main focus is on technical and procedural measures. The user is seen as a security enemy, not as a security asset. In our paper we identify some problems, that emerge from this sight and we propose a paradigm shift from a technical approach to a socio-cultural one, from “the user is my enemy” to “the user is my security asset” approach. We explain the concept of corporate culture and show exemplary on the example of the security culture, how the cultural theory can help to increase the overall security of an organization.