Research and Determination of Personal Information Security Culture Level Using Fuzzy Logic Methods

Abstract

The tasks of determining the state of the organizational information security culture are considered. Despite the dozens of technical and technological means to provide an information security, the issue of quantifying the level of information security culture (ISC) in the organization remains inadequately investigated. The personal information security culture of employee becomes the basis of organizational ISC. The model for identifying a personal ISC using the fuzzy logic for the formalized assessment of personnel ISC in the overall quantitative assessment of the organization’s IS was proposed. The need for this approach caused with difficulty of obtaining quantitative evaluation indicators of personnel ISC in assessing the overall security of the organization. As an example of using this model, the assessment of the user’s personal cybersecurity culture is considered. It was carried out by collecting the input data by questionnaire and represented as the “inputs-output” surfaces of the fuzzy hierarchical system. The results of the assessment show the problems in ISC wich must be corrected with training, motivation and additional instructing. The presented model can be considered as a part of the ISMS audit, which assessing the awareness of employees as one of aspects of the organization’s ISC.