Defining the relationship between information security culture and information security practices

Abstract

This thesis investigates the relationship between ‘information security culture’ and ‘information security practices’ in organisations. There has been considerable interest in this relationship due to recent and widespread recognition that poor information security practices, rather than insufficient technical controls, are the primary reason for information security problems. Additionally, it is argued that there is a need for information security culture to cultivate and support security practices. This implies that a relationship exists between them, and through understanding this relationship, improvements to information security in organisations can be made. This research asks the fol..