| Information security has risen to be a business objective as opposed to an objective of the IT department. Increasing regulation, large-scale breaches, and emerging technologies and the threats that accompany them continue to keep information security in the headlines. As these challenges to security increase, the market is seeing that organizations are spending more on the protection of their information assets. This increase in spending, combined with the increased focus that the function is receiving, should help to engender a more secure organization that effectively manages its information risk profile. However, many organizations see continuing breaches and increased costs associated with breaches. This is because many organizations have used their increased funding to invest in security-related technologies that do not control one of the organization's biggest problems: its people. This study examines the possible relationships between organizational culture type and information security incidents. Other relationships between culture type and factors that contribute to overall security program success, such as senior management support for the program, information security policy, and information security awareness programs, are also examined. The study finds that there are significant relationships between certain culture types and three of the four independent variables. The study encourages further research, including looking at differences in industry type as well as expanding the study to a global sample. Additionally, the study provides practical guidance for those responsible for security as it provides useful information on how to identify and organization's culture type and how to influence that culture to begin to create a culture of security. |
