Information security culture

Abstract

In every organisation an information security culture emerges from the way in which people behave towards information and the security thereof. The procedures that employees use in their daily work could represent the weakest link in the information security chain. It is therefore important to develop and improve information security culture through a structured model that addresses employee behaviour. This article will discuss the concept of information security culture and an assessment approach developed to implement and improve such a culture.