CLTRe, a Norwegian security culture research company, recently released its Security Culture Report, which studied more than 10,000 employees across five verticals in two countries within the Nordics to determine how risk and security is understood and actioned.
The more than 200-page report, which focuses on “insights into the human factor” and how attributes of security culture can impact the overall risk posture of an organisation. It is unique in how it looks at age, experience, gender and attitudes influence risky behaviours and security culture.
According to the report, one of the main goals of this project was to demonstrate how security culture is one of the “most important yet most overlooked” aspects of organisational security, yet an important mechanism to reduce risk in employee behaviour.
“Our findings are very clear, females report better compliance with rules and less risky security behaviour than their male counterparts,” said Kai Roer, founder of CLTRe, and co-author of the report. “Men, on the other hand, report better knowledge of the rules as well as better understanding of risk and technology, while not following those rules as closely as their female colleagues.”
Roer founded CLTRe, a research-driven software-as-a-service company serving the global market, to provide a solution for organisations needing to quantify the impact and effectiveness of security culture investments. The paper, co-authored with Gregor Petric, Ph.D., Associate Professor of Social Informatics and Chair of the Center for Methodology and Informatics at the Faculty of Social Sciences, University of Ljubljana (Slovenia), was based on data using the CLTRe Toolkit, leveraging big data, statistical prediction, organizational psychology, and survey methodology.
Also related to gender balance, the report shows that females are more positive toward having security controls in place, and are more likely to avoid risky use of the Internet.
“Putting these factors together, we believe that a security culture program that aims to improve security culture, should aim for gender balance,” Roer said. “We also see a strong correlation between adherence to norms, and secure behaviour.”
The report identifies seven core dimensions of security culture: behaviours, attitudes, cognitions, compliance, communication, norms, and responsibilities.
The research also examines the authors’ perceived differences between security culture and security awareness. In fact, the report goes as far to say that security culture programs are more critical than security awareness programs.
According to the report:
“Scientific research of organisational behaviour (Ajzen, 2011) convincingly shows that human behaviour is dependent not only on knowledge (awareness) but to a larger extent on organisational culture, norms, attitudes and other socio-psychological factors. Awareness is just one of many factors contributing to secure behaviour.”
“More important are attitudes toward information security issues, perceived norms regarding what is right and wrong regarding information security, involvement in organisational communication processes, and awareness of security policies,” it reads.
CLTRe’s research demonstrates how important it is to consider security culture in running a more secure organisation. The topics the authors consider at least indirectly linked to security culture, from how people work to the results generated, include General Data Protection Regulation (GDPR) and compliance, human factors, and pragmatic threats.
“The ability to quickly and proactively single out units, departments and teams that require extra attention to deal with these threats can be critical to protecting an organisation.”
Contact us today for a chat about our Cyber security services including ISO & GDPR Compliance and certification.
