The relation between the organizational information security climate and employees’ information security behavior

The relation between the organizational information security climate and employees’ information security behavior

Timmermans, Jan (TU Delft Technology, Policy and Management)

van Eeten, Michel (mentor)
Pieters, Wolter (mentor)
Kroesen, Maarten (graduation committee)

Delft University of Technology

2018-12-14

Employees are often referred to as the main cause of cyber security incidents in organizations. These incidents can lead to huge company risks and enormous losses. Therefore insight in how organizations can improve employees’ information security behavior is important, realizing that technical measures alone cannot reduce all security risks. This paper examines the relation between organizational information security climate factors and employees information security behavior. The organizational climate concerns the tangible factors which relate to the atmosphere and work practices in the organization, like management support and openness on information security incidents. After a literature review and semi-structured interviews with information security experts, organizational factors are identified which influence information security behavior. A conceptual model is developed and quantitatively tested, with data collected via a survey under 289 employees. Structural equation modeling is used to analyze these data. The organizational factors education and communication, managerial commitment, employee involvement, work impediment and openness on information security, are confirmed to have a significant relation with the information security behavior of employees. Organizations can use these insights to strengthen their information security climate in order to improve employees’ information security behavior.

information security
Organizational climate
employee behavior

http://resolver.tudelft.nl/uuid:78a12359-a9a9-4b65-8e8f-83aeae8b8939

Student theses

master thesis

© 2018 Jan Timmermans