| Title | Information Security Culture Model. A Case Study |
| Publication Type | Conference Paper |
| Year of Publication | 2021 |
| Authors | Marchand-Niño, William-Rogelio, Samaniego, Hector Huamán |
| Conference Name | 2021 XLVII Latin American Computing Conference (CLEI) |
| Keywords | composability, culture, human factors, IEC standards, information assets protection, Information security, Instruments, ISO, ISO standards, Medical diagnostic imaging, Metrics, oscillating behaviors, phishing, privacy, pubcrawl, Resiliency |
| Abstract | This research covers the problem related to user behavior and its relationship with the protection of computer assets in terms of confidentiality, integrity, and availability. The main objective was to evaluate the relationship between the dimensions of awareness, compliance and appropriation of the information security culture and the asset protection variable, the ISCA diagnostic instrument was applied, and social engineering techniques were incorporated for this process. The results show the levels of awareness, compliance and appropriation of the university that was considered as a case study, these oscillate between the second and third level of four levels. Similarly, the performance regarding asset protection ranges from low to medium. It was concluded that there is a significant relationship between the variables of the investigation, verifying that of the total types of incidents registered in the study case, approximately 69% are associated with human behavior. As a contribution, an information security culture model was formulated whose main characteristic is a complementary diagnostic process between surveys and social engineering techniques, the model also includes the information security management system, risk management and security incident handling as part of the information security culture ecosystem in an enterprise. |
| DOI | 10.1109/CLEI53233.2021.9639939 |
| Citation Key | marchand-nino_information_2021 |
Information Security Culture Model. A Case Study