Information security culture

Employee’s behavior has a big impact to information security in organizations. Cultural concept can help different segments of the organization to concern about the information security within the organization.″Exploring the Relationship between Organizational Culture and Information Security Culture″ provides the following definition of information security culture: ″ISC is the totality of patterns of behavior in an organization that contribute to the protection of information of all kinds.

Information security culture needs to be improved continuously. In ″Information Security Culture from Analysis to Change″, authors commented, ″It′s a never ending process, a cycle of evaluation and change or maintenance.″ To manage the information security culture, five steps should be taken: Pre-evaluation, strategic planning, operative planning, implementation, and post-evaluation.

1. Pre-Evaluation：to identify the awareness of information security within employees and to analysis current security policy.
2. Strategic Planning: to come up a better awareness-program, we need to set clear targets. Clustering people is helpful to achieve it.
3. Operative Planning: we can set a good security culture based on internal communication, management-buy-in, and security awareness and training program.
4. Implementation: four stages should be used to implement the information security culture. They are commitment of the management, communication with organizational members, courses for all organizational members, and commitment of the employees.