Introduction Information has become a necessary
Overview
Information has become a necessary resource for enabling business
transactions and must be protected from unauthorized disclosure, modification, or
destruction. The proliferation of information and communications technology
(ICT) within businesses, the interconnectedness of ICT, and the integration of ICT
into nearly all areas of business have increased the potential for businesses to
experience a data breach (Al-Ahmad, 2013). When business-critical information is
not properly protected, businesses can experience unnecessary expenses and
hardships (Hausken, 2014; Van Niekerk & Von Solms, 2010).
The number of reported data breaches from 2013 to 2014 increased by 23
percent (Symantec, 2015). Businesses are being targeted by individuals looking to
gain unauthorized access to information (Casey, 2012; Fenz, Heurix, Neubauer, &
Pechstein, 2013). Kankanhalli, Teo, Tan, and Wei, (2003) suggested small and
medium-sized businesses implement fewer preventative security measures than
large businesses and contain equally valuable information which positions them as
easy targets.
According to Experian (2016), employees are expected to continue being
the largest threat to information security within a business because “employee
training programs continue to lag as a priority” (p. 8). Traditional information
security protection measures focused primarily on perimeter defenses; which were
designed to prevent unauthorized individuals from accessing information resources
(Weaver, Weaver, & Farwood, 2014). Information security solutions which solely
focus on technical aspects are no longer capable of protecting business information
(Cavelty, 2014; Safa, Von Solms, Furnell, 2016). Individuals who wish to gain
access to business information can trick an unsuspecting employee within the
business into unknowingly giving them access to the information (Hadnagy, Kelly,
& Ekman, 2014). Malicious individuals discovered it was not necessary to attack
traditional perimeter defense technology directly, they could circumvent the
security controls by using social engineering techniques (Mitnick & Simon, 2002).
According to Abraham and Chengalur-Smith (2010), social engineering involves
coercing information system users into performing actions they would otherwise
not perform such as giving up a password, clicking on a link, or opening a file
attachment.
Due to the business implications associated with protecting business
information, organizations are beginning to recognize information security is a
management function and not an extension of the information technology (IT)
department (Kotulic & Clark, 2004). Management shapes the organization’s
culture through its actions and policies (Knapp, Marshall, Rainer, & Ford, 2006).
Information security policy establishes acceptable and unacceptable behaviors
associated with protecting information within the business (Doherty & Fulford,
2006). Support from senior management can positively influence an organization’s
security culture and policy enforcement (Knapp et al., 2006). However,
organizational culture has also been shown to affect the implementation of
information security management principles (Chang & Lin, 2007). Information
security awareness and training programs are built upon information security
management principles. However, in order for security awareness and training
programs to be useful to the organization, they must be integrated with the
organization’s culture (Siponen, 2001).
Background of the Problem
The relationships which exist between organizational culture and
information security programs are at best ambiguous (Chen, Ramamurthy, & Wen,
2015). Early researchers who focused on organizations attempted to identify and
study the characteristics of group and organizational level social interactions which
later became known as organizational behavior (Schein, 1996). Researchers
discovered organizations contain an inherent set of values and rules of conduct
which guide an individual’s behavior when socially interacting within
organizations—this phenomenon became known as organizational culture (Schein,
2010).
Attempting to unravel the mysteries associated with the construct of
organizational effectiveness, researchers proposed several early models to evaluate
organizational values (Cameron, 1981; Quinn & Rohrbaugh, 1983). The early
models used to depict the competing values approach attempted to understand
organizational effectiveness along three value dimensions which included internal
versus external focus, stability versus flexibility within the organizational structure,
and process versus outcome as it related to planning and productivity (Quinn &
Rohrbaugh, 1983). The competing values framework was useful in examining the
effects of organizational culture (Cameron & Quinn, 2006). The version of the
competing values framework used by Chang and Lin (2007) relied upon only two
dimensions internal versus external focus and stability versus flexibility orientation
to assess the cultural traits within an organization.
Researchers have shown organizational culture impacts the information
security outcomes within a business (Dhillion, Syed, & Pedron, 2016; Kolkowska
& Dhillon, 2013). Organizations using ICT to conduct business transactions are
reliant upon people, processes, and technology (Batteau, 2011). People within
organizations have repeatedly been identified as the weakest link in regards to
information security (Thomson & Van Niekerk, 2012). Information security
awareness and training programs improve the security behaviors of people using
ICT (Chen et al., 2015). However, very little is known about how organizational
culture affects the implementation of information security awareness and training
programs (Chen et al., 2015).
Statement of the Problem
Organizations are faced with a growing number of security breaches—many
of which are due to social engineering (Abraham & Chengalur-Smith, 2010; Casey,
2012) and internal employee negligence (Chen et al., 2015). However, information
security awareness and training programs are not considered to be a top priority
within businesses (Experian, 2016; Kaspersky & Furnell, 2014). The only known
defense against employee negligence and social engineering attacks is information
security awareness and training (Gardner & Thomas, 2014; Hadnagy et al., 2014).
Understanding how organizational cultures affect the implementation of
information security awareness and training programs will help explain why
information security awareness and training programs are “lagging in priority”
when data breaches—due to employee negligence—are rising (Experian, 2016, p.
8).
Purpose of the Study
The purpose of this nonexperimental qualitative study was to explore the
relationships which exist between organizational culture and the implementation of
information security awareness and training programs. The study expanded upon
the research conducted by Whipple (2015) which suggested there was statistical
significance to the relationship between information security principles and control
oriented organizational cultures within businesses located within the United States.
However, Whipple (2015) also suggested there was no statistical significance to the
relationship between information security principles and flexibility oriented
organizational cultures within businesses located within the United States.
Figure 1. Competing values framework. This figure illustrates how the framework was adapted
from Chang and Lin (2007) and extended to information security awareness and training programs.
The qualitative study provided a deeper understanding of the relationship
between organizational culture and information security awareness and training
programs within the defense industry located in the Tennessee valley region.
Understanding how organizational culture affects the implementation of
information security awareness and training programs will help researchers and
practitioners identify methods for influencing organizational cultures to adopt
information security awareness and training programs.
Nature of the Study
The study used a qualitative approach because the data collected needed to
be rich in detail. The exploratory nature of the study did not provide insight into
the themes which emerged as data was analyzed for meaning. Exploratory research
is best supported by a qualitative approach (Creswell, 2014; Maxwell, 2013;
Coo
p
eratio
n
,
i
n
formation shari
n
g
,
tr
u
st
,
em
p
owerment
,
a
n
d teamwork
Order
,
r
u
les a
n
d
reg
u
latio
n
s
,
u
n
iformity
,
a
n
d efficie
n
cy
Creativity
,
en
t
repreneurship
,
adaptability
,
and
dynamism
Competitiveness
,
goal
achievement
,
production
,
and benefit
-
oriented
measures
Flexibili
t
y
Orientation
Control
Orien
t
ation
External
Orien
t
ation
I
n
ternal
Orie
n
tation
Statistical Significance
Information
Security
Management
Confidentiality
Integrity
Availability
Accountability
No S
t
atis
t
ical Significance
Information
Security
Awareness and
Training
Program
Maximize
Confidentiality
Integrity
Availability
Accountability
Information
Security
Management
Confidentiality
Integrity
Availability
Accountability
Exploring Effects
Merriam & Tisdell, 2016; Yin, 2014). The study utilized a grounded theory design
so a substantive theory addressing the main research question could evolve from
the research and provide insight into why information security awareness and
training programs are not a top priority within businesses (Glaser & Strauss, 1967;
Merriam & Tisdell, 2016).
Semi-structured qualitative interviews were the preferred data collection
method because they provided the flexibility necessary to capture rich data and the
structure necessary to remain focused on relevant topics (Creswell, 2014).
Participants were presented with an informed consent form prior to starting the
interview and were given the ability to terminate the interview at any point. A
series of demographic questions were also asked to ensure participants were at least
18 years old, worked within businesses operating within the defense industry
located in the Tennessee valley region, and were in a position to respond accurately
to questions about their organizations’ organizational culture and information
security awareness and training program. Participants and organizations remained
anonymous and did not have visibility into interview responses prior to this final
report.
Research Questions
The relationship between control oriented organizational cultures and
information security management principles has been shown to have statistical
significance (Chang & Lin, 2007; Whipple, 2015). However, the relationship
between flexibility oriented organizational cultures and information security
management principles has been shown not to have statistical significance (Chang
& Lin, 2007; Whipple, 2015). Missing from the body of literature is an explanation
of how organizational culture affects the implementation of information security
awareness and training programs which attempt to maximize the principles of
information security. Therefore, the primary research question for this study
explored the relationship between organizational culture and the implementation of
an information security awareness and training program. Specifically, the primary
research question was: how does organizational culture affect the implementation of
information security awareness and training programs? The primary research
question was decomposed into four researchable questions (RQ1 through RQ4)
based on the competing values framework, which facilitated answering the primary
research question.
RQ1. How does the level of cooperativeness (cooperation, information
sharing, trust, empowerment, and teamwork) within the business affect the
implementation of an information security awareness and training program?
RQ2. How does the level of innovativeness (creativity, entrepreneurship,
adaptability, and dynamism) within the business affect the implementation
of an information security awareness and training program? RQ3. How
does the level of consistency (order, rules and regulations, uniformity, and
efficiency) within the business affect the implementation of an information
security awareness and training program?
RQ4. How does the level of effectiveness (competitiveness, goal
achievement, production, and benefit-oriented measures) within the
business affect the implementation of an information security awareness
and training program?
Significance of the Study
Exploring the effects of organizational culture traits through the application
of the competing values framework facilitated explaining how organizational
culture affects the implementation of information security awareness and training
programs within the defense industry located in the Tennessee valley region.
Researchers determined there was statistical significance between control oriented
organizational cultures and information security principles and there was no
statistical significance between flexibility oriented organizational cultures and
information security principles within business located in both Taiwan (Chang &
Lin, 2007) and the United States (Whipple, 2015). This study extended previous
research efforts (Chang & Lin, 2007; Whipple, 2015) and helped fill a void in the
information security culture literature by applying a qualitative exploratory
approach to understand how each of the four organizational culture types
(cooperativeness, innovativeness, consistency, and effectiveness) affects the
implementation of information security awareness and training programs within the
defense industry located in the Tennessee valley region.
Definition of Terms
Awareness: pertains to an “individual’s passive involvement and increased interest
toward certain issues” (Choi, Kim, Goo, & Whitmore, 2008, p. 486)
Competing Values Framework (CVF): represents two dimensions of organizational
culture: control versus flexibility and internal versus external focus (Chang
& Lin, 2007).
Consistency: refers to aspects of control and internal processes which emphasize
order, rules and regulations, uniformity, and efficiency (Chang & Lin, 2007;
Quinn & Rohrbaugh, 1983).
Cooperativeness: refers to aspects of flexibility and internal processes which
emphasize cooperation, information sharing, trust, empowerment, and
teamwork (Chang & Lin, 2007).
Effectiveness: refers to aspects of control and external processes which emphasize
competition, goal achievement, production, and benefit-oriented measures
(Chang & Lin, 2007; Quinn & Rohrbaugh, 1983).
Information security: involves “the protection of information and its critical
characteristics (confidentiality, integrity, and availability), including the
systems and hardware that use, store, and transmit that information, through
the application of policy, training and awareness programs, and technology”
(Whitman & Mattord, 2014, p. 4).
Information security awareness: refers “to a state where users in an organization
are aware of…their security mission” (Siponen, 2000, p. 1) and have
cognizance of the information security policies within the organization
(Bulgurcu, Cavusoglu, & Benbasat, 2010).
Information security training: occurs at defined intervals and “provides users with a
finite set of knowledge and usually tests for short-term comprehension”
(Korpela, 2015, p. 72).
Information system: “is a set of interrelated components that collect, manipulate,
store, and disseminate data and information and provide a feedback
mechanism to meet an objective” (Stair & Reynolds, 2014, p. 4).
Innovativeness: refers to aspects of flexibility and external processes which
emphasize creativity, entrepreneurship, adaptability, and dynamism (Chang
& Lin, 2007).
Objective: is a statement of direction which indicates a desired object within a
decision context (Keeney, 1996).
Organizational Culture (OC): refers to “a set of shared, taken-for-granted implicit
assumptions that determines how an organization perceives, thinks about,
and reacts to various environments” (Schein, 1996, p. 236).
Social engineering: refers to the use of deception techniques designed to trick an
individual into performing an action they might not otherwise have done for
the purpose of stealing personal or corporate information (Mitnick &
Simon, 2002).
Values: are principles used “to evaluate the actual or potential consequences of
action and inaction, of proposed alternatives, and of decisions” (Keeney,
1992, p. 6).
Assumptions and Limitations
Assumptions. The underlying theoretical assumption was the organizational
culture traits identified within the competing values framework used by Chang and
Lin (2007) are the primary factors within organizational culture affecting the
implementation of information security awareness and training programs. The
assumption was supported by early organizational effectiveness research conducted
by Quinn and Rohrbaugh (1983) and more recently the application of the
competing values framework within information security (Chang & Lin, 2007;
Whipple, 2015).
Limitations. The study was limited to exploring the relationships which
exist between organizational culture and the implementation of information security
awareness and training programs within the defense industry located in the
Tennessee valley region. The study relied on participants’ knowledge and how they
related organizational culture to the implementation of information security
awareness and training programs. The total number of participants interviewed was
not predetermined, but due to practical time constraints interviews were conducted
over a four-month period (Merriam & Tisdell, 2016). The theoretical data
saturation point—which could occur when additional data yields only previously
recorded results—may not be reached but the richness of the data collected from
open-ended qualitative interviews and surveys should support diversity analysis
exposing both similarities and dissimilarities between the samples collected
(Jansen, 2010; Levy & Ellis, 2006). If the data saturation point has not been
achieved before the time constraint has been reached, then some themes may
remain unexplored by this study.
Scope of the Study
The scope of the study included users of information systems (a) working
for organizations operating within the defense industry, (b) located in the Tennessee
valley region, and (c) who were at least 18 years of age. Users of information
systems were the focus of the study because they are being exploited by individuals
attempting to gain access to business information and information systems
(Hadnagy et al., 2014) and their security behavior can be improved through
awareness and training programs (Hansch & Benenson, 2014).
Organizations operating within the defense industry located in the Tennessee valley
region were chosen because of their proximity to the Florida Institute of
Technology’s extended studies campus in Huntsville, Alabama. Employees at least
18 years of age are more likely to have been in a position long enough to assess the
organizational culture within their organization as it pertains to the implementation
of information security awareness and training programs.
Worldview and Theoretical Foundation
The constructivist worldview was adopted for this study. The purpose of the
study was to explore the relationships which exist between organizational culture
and the implementation of information security awareness and training programs.
Individuals who seek to understand the many social realities within their work
environment apply interpretive meaning to social situations and construct
knowledge from their interactions and observations (Creswell, 2014; Merriam &
Tisdell, 2016). Researchers collecting data through use of broad open-ended
questions which rely upon the participant’s views about a particular object to
construct meaning are relying upon a constructivist worldview (Creswell, 2014).
The competing values framework was used to structure the study and to
explore the effects of organizational culture upon the implementation of
information security awareness and training programs. The study leveraged the
research conducted by Quinn and Rohrbaugh (1983) and Cameron and Quinn
(2006) and built upon the quantitative research conducted by Chang and Lin (2007)
and Whipple (2015) by extending the research to information security awareness
and training programs. The addition of a qualitative approach to provide
understanding of how organizational culture affects the implementation of
information security awareness and training programs within the defense industry
located in the Tennessee valley region helped fill a knowledge gap within the
academic literature.
Organization of the Study
This chapter introduced the background of the problem, purpose for the
study, research questions, and scope of the study. Chapter 2 is a review of the
literature organized by themes relevant to this study. The themes include
organizational culture, information security, information security culture,
information security policies, information security awareness, and information
security awareness and training programs. Chapter 3 contains the research
methodology which includes the philosophical worldview, research approach,
research design, research methods, and procedures for data collection, analysis, and
reporting. Chapter 4 consists of the coding processes, findings, conceptual
analysis, and theoretical model. Chapter 5 contains the contributions and
implications of the study, and recommendations for future research.
Chapter 2
Literature Review
Overview
The purpose of this chapter was to provide an overview of key research
models, theories, frameworks and themes relevant to understanding organizational
culture, information security, information security culture, information security
policy, information security awareness, and information security awareness and
training programs. The purpose of performing the literature review was to gain an
understanding of the topics relevant to this study, explore the relationships which
exist between topics, and obtain the knowledge necessary to recognize concepts
and themes which emerged during data analysis. The literature review also
provided the foundational knowledge necessary to understand how organizational
culture and information security awareness and training programs have already
been studied.
Questions which Guided the Research
The primary question which guided the research and determined the initial
scope of the literature review was: how does organizational culture affect the
implementation of information security awareness and training programs? The
primary research question was decomposed into four questions derived from the
competing values framework which were:
RQ1. How does the level of cooperativeness (cooperation, information
sharing, trust, empowerment, and teamwork) within the business affect the
implementation of an information security awareness and training program?
RQ2. How does the level of innovativeness (creativity, entrepreneurship,
adaptability, and dynamism) within the business affect the implementation
of an information security awareness and training program? RQ3. How
does the level of consistency (order, rules and regulations, uniformity, and
efficiency) within the business affect the implementation of an information
security awareness and training program? RQ4. How does the level of
effectiveness (competitiveness, goal achievement, production, and benefit-
oriented measures) within the business affect the implementation of an
information security awareness and training program?
The primary research question led to the inclusion of literature pertaining to
organizational culture, information security, information security culture,
information security policy, information security awareness, and information
security awareness and training programs. The four decomposed questions added
literature specific to the competing values framework.
Method for Reviewing the Literature
The literature review was conducted using multiple keyword searches,
previously used keyword searches, backward reference searches, and forward
reference searches. As articles were selected, the source journal and database were
documented. The articles selected for review were discovered within 76 different
journals by searching across 14 different databases. Books, dissertations, and
conference proceedings were also included raising the total number of relevant
works substantially. However, only the works referenced have been included as
part of the study. The literature search was considered complete when newly
discovered articles began introducing concepts and conclusions which were
previously seen, and backward and forward reference searches produced repeat
results (Levy & Ellis, 2006). Each of the search methods are discussed in more
detail below.
Keyword and previously used keyword searches. The Summon search
service provided by the Florida Institute of Technology library was utilized to
perform an initial keyword search across numerous databases simultaneously.
Keyword searches were conducted using 11 keywords with a filter to return articles
from peer-reviewed publications. Articles were selected from the initial results
based upon a review of their abstracts for relevance to the study. The keywords
identified within each selected article’s keyword list were used to generate a
previously used keywords list containing 12 additional keywords. The previously
used keyword search was conducted using the list of previously used keywords to
ensure broad coverage of the literature.
Backward and forward reference searches. A backward reference search
was conducted to discover additional articles worth reviewing and the genesis of
concepts found within the literature. An initial backward reference search was
conducted using selected articles published between 2012 and 2016. However,
several selected articles returned from the initial search prompted subsequent
backward reference searches which were necessary to trace concepts to their origin.
A forward reference search was then conducted using selected articles published
before 2012 to trace the evolution of relevant concepts found within the literature.
Methods for Analyzing the Literature
As recommended by Machi and McEnvoy (2012), the selected articles were
scanned and associated with an initial theme. The initial themes used were:
organizational culture, information security, and information security awareness
and training. Each article was thoroughly read and then summarized to identify its
actual theme. Further analysis was conducted to identify theories, concepts, and
models which could be used to narrow the number of articles to only those with
actual relevance and facilitate assigning the article to a subcategory (Machi &
McEvoy, 2012). Analysis led to the identification of three additional themes and
one relevant framework. The additional themes included information security
culture, information security policy, and information security awareness. The
relevant framework was the competing values framework.
Minimizing Biases and Assigning Relevance
During the analysis process, articles from peer-reviewed publications were
considered more relevant than articles discovered within practitioner oriented
publications to minimize biases (Levy & Ellis, 2006). Articles which were relevant
to the study were included as foundational literature to support the study (Levy &
Ellis, 2006). Articles which were remotely relevant but provided significant
supporting information were also included; whereas articles which provided
insignificant supporting information or were deemed irrelevant were excluded
(Levy & Ellis, 2006). The summary for each of the included articles was doubled
checked to ensure material was not taken out of context (Laband & Piette, 2000).
Competing Values Framework
The competing values framework evolved from a necessity to bring order to
the body of literature focused on organizational effectiveness—which in the 1980s
was in disarray (Cameron, 1981; Quinn & Rohrbaugh, 1983). The central theme
within the organizational behavior literature in the 80s was organizational
effectiveness (Quinn & Rohrbaugh, 1981). Quinn and Rohrbaugh (1983)
developed the competing values framework to clarify the effectiveness construct
and relate the main concepts within the organizational effectiveness literature to a
single three dimensional model. The competing values framework acts as a guide
which enables leaders to make sense of the interrelationships which exist within an
organization (Cameron, Quinn, DeGraff, & Thakor, 2006; Quinn, 1988).
According to Denison, Nieminen, and Kotrba (2014), the competing values
framework was designed to facilitate understanding of culture types which existed
within organizations.
The competing values framework uses three dimensions to assess the
culture within an organization (Quinn & Rohrbaugh, 1983). The first dimension
represented an organization’s focus toward internal versus external activities
(Quinn & Rohrbaugh, 1983). Some organizations find effectiveness through
internal unity which creates and projects a cohesive organizational persona
(Cameron & Quinn, 2006; Cameron & Quinn, 2011). However, other organizations
thrive on competition within the business units and create their own distinct
effectiveness through business unit independence (Cameron & Quinn, 2006;
Cameron & Quinn, 2011). The second dimension represented an organization’s
structural preference of control and stability versus flexibility (Quinn & Rohrbaugh,
1983). Organizations which find effectiveness through predictable activities and
are established within the industry tend to be oriented toward control and stability
(Cameron & Quinn, 2006). However, organizations on the opposite end of the
control versus flexibility continuum tend to find effectiveness through continued
change and adaptation (Cameron & Quinn, 2006). The third dimension focused on
an organization’s preference of means versus ends; essentially determining whether
an organization was process or profit oriented (Quinn & Rohrbaugh, 1983).
The core values within the framework as identified by Cameron and Quinn
(2006) are internal focus, external focus, control oriented, and flexibility oriented.
The four core values exist along two intersecting dimensions to create four
quadrants which can be used to facilitate an understanding of organizations
(Cameron & Quinn, 2006). The labels affixed to the quadrants have varied since
the models development (Kwan & Walker, 2004). Quinn (1988) identified the
quadrants as human relations, open systems, internal process, and rational goal.
Cameron et al. (2006) introduced the labels clan, adhocracy, hierarchy, and market.
Chang and Lin (2007) adopted different labels for each of the quadrants, although
the underlying meaning remained the same. Chang and Lin (2007) replace the term
clan with cooperativeness, adhocracy with innovativeness, hierarchy with
consistency, and market with effectiveness. However, Cameron, Quinn, DeGraff,
and Thakor (2014) continued to use the quadrant labels which were established in
2006.
The competing values model was validated as a “metric for understanding
organizational cultures, comparing organizational cultures, and evaluating
organizational cultures relative to other variables” (Howard, 1998, p. 245).
AlKhalifa and Aspinwall (2001) utilized the competing values framework to assess
organizational cultures within Qatar to determine the likelihood of successfully
adopting total quality management principles. Kwan and Walker (2004) conducted
a study across seven institutions within Hong Kong and validated the competing
values framework as a model capable of differentiating institutions based on
organizational culture. However, Hartnell, Ou, and Kinicki (2011) performed a
meta-analysis of published literature and found mixed support for the validity of the
competing values framework and proposed future studies consider alternative
approaches to verify other aspects of the relationships between effectiveness and
organizational cultures.
Organizational Culture
Understanding organizational culture begins with an understanding of
organizations and what leads to an organization’s effectiveness. Hogan and Coote
(2014) suggested organizations consist of both social and physical constructs.
Lawrence and Lorsch (1967) defined an organization as
a system of interrelated behaviors of people who are performing a task that
has been differentiated into several distinct subsystems, each subsystem
performing a portion of the task, and the efforts of each being integrated to
achieve effective performance of the system (p. 3).
Effective organizations successfully balance integration and differentiation to
overcome environmental turbulence introduced through advances in science and
technology (Lawrence & Lorsch, 1967). Denison et al. (2014) reaffirmed the core
issues with organizational design pertain to integration and differentiation, and
organizations which balance the two create the most effective systems.
Successful organizations are both empowered and empowering
(Francescato, & Aber, 2015). An empowered organization achieves its goals and
positively influences systems within its environment (Francescato, & Aber, 2015).
Empowering organizations strive to enable individual members to achieve higher
levels of effectiveness (Francescato, & Aber, 2015). According to Schein (1984),
organizations tend to reflect the environmental culture which encapsulates them but
due to the biases of owners, leaders, and influential employees a culture develops
and persists within the organization. Organizations which find their internal culture
misaligned with the culture present in their surrounding environment will not
achieve the same level of success as those organizations which attain alignment
(Nold, 2012).
Organizational culture is a concept which originated in cultural
anthropology and has been the focus of many researchers attempting to explain
organizational dynamics, organizational behavior, organizational effectiveness, and
leadership (Hartnell et al., 2011; Hogan & Coote, 2014; Quinn & Rohrbaugh,
1983). Cameron and Quinn defined organizational culture as a persistent set of
values, beliefs, and assumptions which characterize the organization and shape the
behaviors of the members within the organization. Schein (2010) defined culture as
a pattern of shared basic assumptions learned by a group as it solves its
problems of external adaptation and internal integration, which has worked
well enough to be considered valid and, therefore, to be taught to new
members as the correct way to perceive, think, and feel in relation to those
problems (p. 18).
Organizational culture was identified as a powerful and sustaining force
(Schein, 1996). Howard (1998) suggested organizational culture was a concept
where members within an organization share similar assumptions, values, and
artifacts. However, Howard (1998) also suggested the lack of a standardized
definition for organizational culture may be a result of having adopted the concept
from anthropology where culture had not yet been definitively defined. Hartnell et
al. (2011) proposed organizational culture was a complex social phenomenon
consisting of common beliefs, values, norms, and behaviors shared by
organizational members. Ivancevich, Konopaske, and Matteson (2014) suggested
organizational culture is an invisible force but its existence can be sensed through
the attitudes and behaviors of people within an organization.
Levels of organizational culture. Evidence of organizational culture can be
seen through artifacts, espoused values, and assumptions (Schein, 1990; Schein,
2010). Artifacts are extensions of an organization’s culture which interface with the
surrounding environment and are visible to observers unfamiliar with the
organization (Schein, 1990; Schein, 2010). Artifacts are tangible manifestations
which can be observed through an organization’s image, style, technology,
ceremonies, attire, architecture, and displays of emotion (Bolman & Deal, 2013;
Schein, 2010).
Espoused values establish the policies and procedures for members of the
organization to follow (Schein, 1990; Schein, 2010). According to Howard (1998),
values represent standards which can be used to guide decisions when alternatives
are involved. Assessing values to understand an organization’s culture is similar to
the value-focused approach to decision making (Keeney, 1992). Value-focused
thinking relied upon the ability of participants to identify both conscious and
subconscious values maintained about a particular situation (Keeney, 1992). The
participants’ values were used to construct objectives to guide the decision making
process toward a desired outcome (Keeney, 1992). The significance of studying
values within an organization lies in the fact that values are “more accessible than
assumptions and more reliable than artifacts” (Howard, 1998, p. 233).
Assumptions are the deep underlying beliefs within an organization which
require members to be attentive and attuned to decipher meaning from interactions
within the organization (Schein, 1990; Schein, 2010). Organizations must establish
clear goals if they intend to communicate a common message and develop a sense
of identity (Schein, 1985). The social aspects of an organization necessitate
continued inquiry into organizational culture to gain understanding of
organizational effectiveness and performance (Hogan & Coote, 2014). An area
within organizational culture which warrants further exploration is the emergence
of distinct types of organizational culture (Hartnell et al., 2011).
Types of organizational culture. Organizational culture plays a significant
part in determining the effectiveness of an organization (Quinn & Rohrbaugh,
1983). There is no indication that one particular culture type is superior to another
(Cameron & Quinn, 2006). However, leaders must take into account the culture of
the organization or conflict can arise between groups having different values
(Bolman & Deal, 2013; Schein, 2010). The culture within an organization is more
likely to change a leader than a leader is to change the culture (Schein, 1996). The
four organizational culture types identified by Quinn (1988) and repeatedly
discussed within the literature are: clan, adhocracy, hierarchy, and market. The clan
culture, also known as group culture, is internally oriented and focused on
cooperation between team members within the organization (Chang & Lin, 2007;
Hartnell et al., 2011). Organizations with a clan culture find success by recruiting,
developing, and retaining employees (Cameron & Quinn, 2006). Employee
behaviors associated with the clan culture type foster teamwork, encourage
employee involvement, and facilitate open communication between managers and
employees (Cameron & Quinn, 2006; Hartnell et al., 2011).
The adhocracy culture, also known as open systems culture, is externally
oriented and focused on change which drives innovation (Chang & Lin, 2007;
Hartnell et al., 2011). The emphasis within adhocracy cultures is placed on
“creating a vision of the future, organized anarchy, and disciplined imagination”
(Cameron & Quinn, 2006, p. 43). Employee behaviors associated with the
adhocracy culture type promote risk taking activities, encourage creativity, and
foster adaptability (Cameron & Quinn, 2006; Hartnell et al., 2011).
The hierarchy culture, also known as internal process culture, is internally
oriented and focused on process control mechanisms (Hartnell et al., 2011).
Organizations characterized as having a hierarchy culture typically require strict
adherence to rules and processes to ensure long-term stability and efficiency
(Cameron & Quinn, 2006). Roles within the organization are well defined and
employees are expected to meet specified expectations (Cameron & Quinn, 2006;
Hartnell et al., 2011). Consistency and precise communication is valued throughout
the organization (Hartnell et al., 2011). Employee behaviors associated with the
hierarchy culture type promote compliance with regulations and operational
guidance (Hartnell et al., 2011).
The market culture, also characterized as rational goal, is externally oriented
and focused on short-term effectiveness through competitive challenges (Cameron
& Quinn, 2006; Hartnell et al., 2011). Organizations characterized as having a
market culture establish clear goals and milestones to keep employees motivated
(Hartnell et al., 2011). Employee behaviors associated with the market culture type
focus on winning through adoption of aggressive growth strategies to outperform
the competition (Cameron & Quinn, 2006; Hartnell et al., 2011).
Although researchers have not identified one culture as being superior, they
have recognized some cultures enable an organization to perform better within its
environment (Schein, 2015). For instance, control oriented organizations were
found to be less accepting of total quality management principles (Al-Khalifa &
Aspinwall, 2001). Innovation fueled by collaboration and the flexibility to be
creative within the organization may not align well with organizational cultures
embracing hierarchy or market oriented cultures (Andrevski, Richard, Shaw, &
Ferrier, 2014; Sharifirad & Ataei, 2012). According to Denison et al. (2014), high
performing organizations find the proper balance between adhocracy and hierarchy
cultural characteristics. However, Büschgens, Bausch, and Balkin (2013)
recognized cultures are not mutually exclusive and an innovative organization
characterized as having an adhocracy culture can also exhibit employee
development characteristics found within the clan culture.
The existence of multiple cultures within a single organization, sometimes
referred to as subcultures, is an accepted possibility (Denison et al., 2014).
Subcultures within an organization may adopt an alternative set of values which are
more aligned with the member’s occupation (Schein, 2015). Schein (2015) argued
“not enough attention has been paid to functional subculture compatibility based on
the occupational cultures of the employees in the subcultures” (p. 7). D’Arcy and
Greene (2014) recognized security culture as having a significant positive
relationship with security compliance intention. Da Veiga and Martins (2015a)
recognized instilling an information security subculture within an organization can
facilitate infusing information security principles into the surrounding
organizational culture.
Information Security
Information security refers to the measures taken to prevent unauthorized
disclosure, modification, disruption, and destruction of information through
intentional or accidental means (Chang & Wang, 2011; Finne, 2000; Parker, 1997).
The scope of information security extends beyond information and “includes the
protection of all resources that are the means of creating, processing, transmitting,
storing, using, displaying, or controlling information” (Parker, 1997, p. 16). The
purpose of information security is to ensure a satisfactory level of confidence that
information shared between an organization and business partners will be
adequately protected (Chang & Ho, 2006). Von Solms and Van Niekerk (2013)
argued information security and cyber security are not interchangeable terms even
though they have been used interchangeably within the literature. Information
security is focused on protecting the confidentiality, integrity, and availability of
information and information resources (Finne, 2000; Whitman & Mattord, 2014)
whereas cybersecurity extends beyond information and information resources to
include all devices and users connected through cyberspace (Craigen,
DiakunThibault, & Purse, 2014; Von Solms & Van Niekerk, 2013). The protection
of information is an evolving process which has grown beyond a strict technology
focused approach (Von Solms & Van Niekerk, 2013). According to Da Veiga and
Martins (2015b), the objective of information security is to protect information and
ensure threats to information do not negatively affect the continuity of the business.
Researchers and practitioners have agreed the core information security principles
focus on confidentiality, integrity, and availability of information (Kolkowska &
Dhillon, 2013; Whitman & Mattord, 2014).
Confidentiality refers to protecting information so only authorized
individuals who have a legitimate business reason have access to the information—
reducing the likelihood of unauthorized disclosure (Finne, 2000; Whitman &
Mattord, 2011). Confidentiality within information systems is accomplished
through the use of access control measures which are responsible for managing
access to protected resources and cryptographic control measures which encrypt
information while in storage and in transit (Plate, Basile, & Paraboschi, 2013).
According to Whitman and Mattord (2014), the most common methods for
protecting the confidentiality of information include: information classification,
secure document storage, cryptography, and education of information users.
The accuracy and completeness of the information and the safeguards to
prevent unapproved editing of the information are included within the integrity
element of information security (Finne, 2000; Whitman & Mattord, 2011).
Integrity of information guarantees the validity of the information being entered,
stored, or transmitted and relies heavily upon encryption, hashing functions, and
digital signatures (Plate et al., 2013). Information is also susceptible to data
corruption which can occur due to glitches in the transmission process, faulty
programming, or failure of equipment (Whitman & Mattord, 2014). According to
Whitman and Mattord (2014), security measures to protect against data corruption
include error-control checking, redundancy and check bits, and hashing functions.
The accessibility of information and the safeguards in place to prevent
disruption or destruction of information are included within the availability element
of information security (Finne, 2000; Whitman & Mattord, 2011). Availability of
data is critical in some business environments necessitating the implementation of
resilient or redundant information systems which can failover and recover from
disruptions (Plate et al., 2013). Availability does not imply access control measures
are absent. Availability simply means information is accessible to users who are
authorized access (Whitman & Mattord, 2014).
Some researchers have also included accountability as an essential
information security principle (Chang & Lin, 2007; Whitman & Mattord, 2014).
Accountability of information occurs when all activities affecting the
confidentiality, integrity, or availability of the information are attributable to an
individual or automated process (Whitman & Mattord, 2014). According to Plate et
al. (2013), the goal of accountability is to ensure nonrepudiation so users cannot
deny performing actions which they performed. Methods for ensuring
accountability include network monitoring and system auditing where audit logs
can be used to track and verify a user’s activity (Whitman & Mattord, 2014).
Information security research has traditionally focused on the technical
context, issues of access to information systems, and secure communications
(Siponen & Oinas-Kukkonen, 2007). However, Silic and Back (2013) performed a
review of the information security literature dated between 1977 and 2012 and
noted information security research has begun to focus on understanding individual
behaviors. Chen, Ramamurthy, and Wen (2013) argued information security
requires more than technological solutions. Technological solutions which are
misconfigured or not fully implemented may actually contribute very little toward
improving a business’ security posture (Mulligan & Schneider, 2011). Traditional
information security depended upon checklists, standards, maturity ratings, and
methods borrowed from risk management (Siponen, 2005). However, traditional
information security alone does not address the challenges which exist within
today’s interconnected business environments and global supply chains (Sindhuja
& Kunnathur, 2015).
Responsibility for information security issues has shifted from the
information technology department to management due to the potential for
information security issues to impact a business’ market position (Von Solms & Von
Solms, 2004; Soomro, Shah, & Ahmed, 2016). Rigon, Westphall, dos Santos, and
Westphall (2014) suggested current information security challenges pertain to
defining and achieving realistic security goals which are aligned with the business’
strategic vision and risk appetite. However, senior management teams lack access
to reliable security planning processes even though they seem willing to adopt best
practices when they are made available (Kotulic & Clark; 2004). Chang and Ho
(2006) performed an empirical study which suggested the competence level of
managers using information technology influenced an organization’s ability to
implement information security principles. Fenz et al. (2013) conducted a review
of eight cybersecurity frameworks for managing information security risk and
concluded none of the frameworks evaluated satisfactorily addressed managing an
asset inventory, determining asset value, predicting risk, dealing with
overconfidence, or sharing knowledge and each solution evaluated offered only
minimal decision support for making appropriate risk versus cost trade-offs.
Soomro et al. (2016) suggested there is a need for a holistic approach to
information security management. However, Whitman and Mattord (2014) stated
information security is accomplished “through the application of policy, training
and awareness programs, and technology” (p. 4).
Information Security Culture
According to Guo, Yuan, Archer, and Connelly (2011), users of information
and communication technology knowingly violate security policies for
nonmalicious reasons such as a perceived increase in their productivity.
Information security culture instills understanding among members of an
organization through awareness programs designed to communicate policy and the
risk to the information being processed (Da Veiga & Martins, 2015b). Da Veiga
and Eloff (2010) defined information security culture as values and assumptions
which are presented in the security behaviors exhibited by users of information and
communications technology within the organization.
Basahel and Alshawi (2014) suggested organizational culture, leadership,
and the implementation of information security principles are interrelated.
Traditional information security research focused on technical security measures to
account for the many unsafe behaviors users exhibited when using information and
communications technology (Chang & Ho, 2006). However, information security
culture provides guidelines to reduce risks associated with using information and
communications technology by focusing on “good security-related human behavior
through knowledge, artifacts, values, and assumptions” (AlHogail, 2015, p. 567).
Dhillion et al. (2016) stated organizations can be vulnerable during a merger due to
the lack of clear information security policy.
Information Security Policy
Information security policy provides a framework to ensure the secure
development, implementation, and use of information systems within a business
environment (Doherty & Fulford, 2006). Policy creates the foundation for an
effective information security program (Whitman & Mattord, 2014). Information
security policies influence employee security awareness and improve the
effectiveness of an information security program (Knapp & Ferrante; 2012).
Doherty and Fulford (2006) considered information security policy to be the
primary method of disseminating, standardizing, and enforcing information security
practices across a business. The sharing of information security knowledge within
the business environment increases security awareness and reinforces the necessity
for employees to comply with information security policies
(Safa et al., 2016).
Doherty and Fulford (2006) suggested the importance of information
security policy warranted including it into the strategic information system
planning phase so information security policies could be tied directly to strategic
plans and business objectives. According to Doherty and Fulford (2005)
organizations lacking the ability or experience to develop an information security
policy typically adopt an existing framework and are unable to manage its
implementation due to the broad nature and complexity of available frameworks.
Failing to manage and enforce security policy within a business may signal a lack
of support from senior management and encourage information system users to
ignore security requirements (Knapp & Ferrante; 2012; Knapp et al., 2006).
According to Siponen, Mahmood, and Pahnila (2014), the most significant threat to
information security is the information system user, who lacks the security
awareness necessary to comply with information security policies.
Information Security Awareness
Information security awareness has been defined as having general
information about the security objectives and security policies within a business
(Bulgurcu et al., 2010; Siponen, 2000). Researchers seem to agree security
awareness is essential to improving information security behavior (Knapp &
Ferrante, 2012; Safa et al., 2016; Vance, Siponen, & Pahnila, 2012). However,
researchers have yet to agree on whether information security awareness pertains to
knowing about threats, includes knowledge of protections, or extends to the
behavior which results simply from gaining increased knowledge about a situation
(Hansch & Benenson, 2014).
The willingness of an information system user to comply with security
policy is impacted by both their level of information security knowledge and their
intended security behavior (Ngoqo & Flowerday, 2015; Van Niekerk & Von Solms,
2010). According to Siponen (2001), individuals who utilize information in any
capacity should know about the dangers associated with the information they find
valuable. However, Jones (2009) suggested users lack the necessary awareness to
recognize information threats because much of the information stored today is done
so electronically and has no physical presence making it difficult for information
system users to understand the value of information. Kaspersky and Furnell (2014)
highlighted the fact cybercriminals are exploiting information system users because
users of the technology lack basic security awareness.
Information Security Awareness and Training Programs
The purpose of a security awareness and training program is to focus the
attention of information system users toward the dangers affecting information
assets, train users on the methods available for minimizing the likelihood of
damage to information assets, and encourage users to adopt security behaviors
which facilitate protection of information resources (Korpela, 2015). Security
awareness programs focus on continuously communicating information security
policy and drawing an information system user’s attention to potential dangers
threating information assets (Korpela, 2015). Lacey (2010) suggested most
security awareness programs are initiated in response to a major data breach being
reported in the news, are grossly underfunded, and will likely fail to make the
necessary improvements in behavior unless the program considers the unique
security challenges facing the information system users and the environment in
which they operate. Korpela (2015) suggested “failure identifying users at risk”
and “lack of understanding on how cyber security is best learned by users” as two
additional reasons security awareness and training programs fail (p. 73).
Albrechtsen and Hovden (2010) conducted a study which found an individual’s
security awareness and behavior can be influenced by participation in organization
level information security knowledge collaboration and creation workshops.
Dodge, Carver, and Ferguson (2007) performed an email phishing campaign to
discover the security posture of an organization by evaluating the behaviors of
individuals using email and found the awareness program had influenced users to
improve their security behaviors. Lötter and Futcher (2015) proposed an approach
for users of email to detect messages which have been sent by someone disguising
their true identity for the purpose of stealing information from an unsuspecting
individual. Eminagaoglu, Ucar, and Eren (2009) conducted a yearlong workplace
information security awareness study focused on improving password use and
concluded information security awareness training improved the security behaviors
of information system users and increased the number of users willing to comply
with the company’s information security policies. Spears and Barki (2010) noted
information system users who participate in information security compliancerelated
activities develop an increased level of information security awareness.
While both security awareness and security training programs attempt to
improve the security behaviors of information system users, security training stands
apart from awareness training because it is designed to provide users with the
knowledge necessary to develop a particular security-related skill (Korpela, 2015).
Security-related training occurs at predefined intervals and is designed to provide
an information system user with the knowledge necessary to perform a
securityrelated function and may involve testing or certification to prove
comprehension (Korpela, 2015). According to Dhillon et al. (2016), information
security awareness and training programs communicate organizational values, set
the foundation for creating an information security culture, and focus members on
protecting the organization.
Synthesis
The preceding sections within this chapter provided a review of relevant
literature pertaining to the competing values framework, organizational culture,
information security, information security culture, information security policy,
information security awareness, and information security awareness and training
programs. The competing values framework provided a method for assessing the
culture type within an organization and facilitated understanding the relationships
between organizational effectiveness and organizational culture. The literature
pertaining to organizational culture is rich with information and has both depth and
breadth, revealing an area which has benefited from extensive research. However,
as Schein (2015) suggested, more research is necessary to understand the formation
and effects of occupational subcultures within the larger organizational culture.
Information security is focused on the protection of information and
information resources within an organization. Traditional information security
methods focused on technical solutions and paid little attention to the employees
using the information and communications technology within the organization.
However, social engineering attacks circumvent technical security controls and
exploit the employees using the information and communication technology. Guo
et al. (2011) indicated employees knowingly circumvent security controls to
improve their work performance. Within the information security literature, users
of information communications technology are repeatedly positioned as the
weakest link in the information security chain and have been referred to as the
insider threat.
A relatively new body of literature is emerging to address the rising security
challenges which are indiscriminately threatening all organizations. Several
researchers are suggesting the creation of an information security culture within the
organization which can infuse security principles into the surrounding
organizational culture (Da Veiga & Martins, 2015a). However, the emergence of an
information security culture within the predominant organizational culture seems to
be what Schein (2015) was referring to as an occupational subculture.
The literature pertaining to information security policy is also well
established. Information security policy sets the standards and the expectations of
organizational leaders so users of information and communications technology are
empowered to act in a manner which is aligned with the values being
communicated through policy. However, leaders need to be cognizant of the
organizational culture and its willingness to accept information security principles.
Chang and Lin (2007) determined the relationship between control oriented
organizational cultures and information security principles had statistical
significance. Chang and Lin (2007) also determined the relationship between
flexibility oriented organizational cultures and information security principles had
no statistical significance. However, the majority of the studies reviewed were
either conceptual or quantitative in nature and did not explore how the
organizational culture affects information security principles using qualitative
methods. Schein (2015) expressed concern about the lack of qualitative research
and the trend toward performing “quantitative abstraction” within business and
management schools (p. 3).
The body of literature pertaining to information security awareness
contained a similar theme which suggested information security awareness is vital
to the successful implementation of an information security program. Establishing
information security awareness among users of information and communications
technology has also been recognized as a necessary step toward creating an
information security culture within an organization. Users of technology, who are
unaware of the risks of using the technology and the threats to the information they
have been entrusted to protect are perfect targets for social engineering techniques.
Information security awareness and training programs are mechanisms
which enable the flow of security-related information to all members within an
organization. Information security awareness empowers users of information and
communications technology and enables them to make appropriate decisions when
confronted with potential information security threats. The number of data
breaches due to employee negligence is increasing and the only known defense
against the threat is awareness and training (Gardner & Thomas, 2014; Hadnagy et
al., 2014). However, Experian (2016) reported information security awareness and
training programs are lagging in priority.
Based on the literature reviewed, researchers seemed aware organizations
are faced with real problems with implementing information security principles.
The emergence of literature specific to information security culture provides
additional evidence that there is a legitimate problem which researchers are
attempting to address. Based on the literature discovered, a few studies supported
the existence of a relationship between organizational culture and information
security principles. However, none were discovered which explored how
organizational culture affects the implementation of an information security
awareness and training program. Exploring the relationship between organizational
culture and implementation of information security awareness and training
programs may facilitate understanding why information security awareness and
training programs are lagging in priority when data breaches due to employee
negligence are on the rise.
Chapter 3
Methodology
Overview
This study explored the relationships which exist between organizational
culture and the implementation of information security awareness and training
programs within the defense industry located in the Tennessee valley region. The
purpose of this chapter was to establish the research methodology and processes
used to conduct the study. Specifically, the chapter introduced ethical
considerations and provided the rationale for the philosophical worldview,
approach, design, and methods used to shape this study. The target population,
pilot study, specific procedures, and reliability and validity techniques specific to
conducting the study were also explained.
Ethical Considerations
Respect for participants and equity were considered important aspects of
this study (Swanson & Holton, 2005). Participants were given an informed consent
form (Appendix A, Informed Consent Form) prior to starting the interview and
were asked to acknowledge their understanding and agreement to voluntarily
participate in this study by signing the consent form. In addition to their signature,
if a participant permitted recording the audio portion of the interview they were
asked to place their initials within the section discussing audio recording. A copy
of the signed consent form was given to the participant for their records and a
signed copy of the consent form was kept by the researcher.
In addition to the ethical considerations mentioned above, an institutional
review board (IRB) application was completed for this study. The potential risks
associated with participation in the study were no more than those which exist
within everyday life. The expected impact and likelihood of an adverse event
resulting from participation in the study was negligible. Each participant was
assigned a numeric identifier to ensure confidentiality and maintain data integrity.
Maintaining the confidentiality of participants reduced the likelihood of an adverse
event occurring to nearly zero, consequently minimizing potential risks.
Philosophical Worldview
The philosophical worldview establishes the point of view from which
research is conducted (Creswell, 2014). The purpose of this research was to explore
relationships to uncover meaning and facilitate construction of explanations for
situations occurring within the work environment. The research was not intended to
discover an absolute truth, change a particular situation, or suggest a solution to the
situation. Inductive reasoning was used to construct an explanation for the
occurrence of situations discovered through analysis of data collected from multiple
participants (Creswell, 2014). Inductive reasoning involves looking at data or
evidence to construct meaning which can lead to an explanation for a situation which
has a high probability of being true (Feeney & Heit, 2007). Constructing meaning
from data obtained from multiple participant responses and providing insight into
why a particular situation exists required adopting the constructivist worldview.
Research Approach
According to Creswell (2014), constructivists ask very broad questions
which encourage participants to provide responses rich in information which can be
used to construct meaning for a particular situation. The information provided by
multiple participants must be rich in detail to support in-depth exploration of the
relationship between organizational culture and the implementation of information
security awareness and training programs. Studies which are exploratory in nature
and aim to generate hypothesis are better suited for a qualitative approach (Fosnot,
2005). Qualitative research supports exploration into the experiences of multiple
participants for the purpose of exposing the variables involved and deriving
meaning from their interaction (Corbin & Strauss, 2015). The organizational
culture traits drawn from the competing values framework (Chang & Lin, 2007)
were utilized to structure the exploration of the relationships between
organizational cultures and the implementation of information security awareness
and training programs. The data necessary to support exploring the effects of
organizational culture upon implementation of information security awareness and
training programs was collected from multiple participants who have experienced
the effects being studied within their work environments. According to Merriam
and Tisdell (2016), the foundation of qualitative research lies within “the belief that
knowledge is constructed by people in an ongoing fashion as they engage in and
make meaning of an activity, experience, or phenomenon” (p. 23). Because the
study explored relationships and constructed meaning from the experiences of
participants where variables were not known in advance and there was no insight
into the themes which emerged, the research design adopted a qualitative approach.
Research Design
Merriam and Tisdell (2016) identified six common qualitative research
designs which included basic qualitative research, narrative inquiry,
phenomenology, ethnography, case study, and grounded theory. Basic qualitative
research refers to a qualitative design which does not have an additional dimension
beyond uncovering and interpreting “how people make sense of their lives and their
worlds” (Merriam & Tisdell, 2016, p.25). Narrative inquiry is specific to
understanding meaning as it exists within stories told by individuals (Merriam &
Tisdell, 2016). Phenomenology research focuses on understanding the
underpinnings of an event experienced by multiple people to uncover the
significance of having experienced the phenomena (Creswell, 2014; Merriam &
Tisdell, 2016). Research which is focused on studying interactions within social
groups or entire cultures where the researcher is typically a participant observer
over an extended period of time typically involves ethnography (Bloomberg &
Volpe, 2012). Case study research refers to studying a phenomena which has a
distinct boundary such as a person, program, decision, event, institution, or small
group to describe and analyze the phenomena in significant detail (Creswell, 2014;
Merriam & Tisdell, 2016; Stake, 1995; Yin, 2014). Grounded theory involves
moving beyond describing a situation and toward constructing a substantive theory
using data collected from research participants (Bloomberg & Volpe, 2012;
Merriam & Tisdell, 2016). The purpose of this study was to use data collected from
research participants to construct a theory to understand how organizational culture
affects the implementation of information security awareness and training programs
which could then explain why those programs are not a top priority in organizations
when data breaches are on the rise. The research design which facilitated practical
theory development and was adopted by this study was constructivist grounded
theory.
Research Methods
The goal of using constructivist grounded theory within this study was to
develop a practical theory through a recursive process of collecting, coding, and
comparing data which recognizes a researcher’s involvement in data interpretation
(Charmaz, 2014). The constructivist grounded theory builds upon the principles of
constant comparative methods and theoretical sampling (Bloomberg & Volpe,
2012; Charmaz, 2014).
Constant comparative methods. Constant comparative methods involve a
recursive and concurrent process involving data collection and analysis (Cho &
Lee, 2014; Glaser & Strauss, 1999). Within this study, constant comparative
analysis was performed during all stages of coding and involved comparing data to
data, data to codes, codes to codes, codes to concepts, concepts to concepts,
concepts to categories, and categories to categories to identify similarities and
differences which contributed toward emerging themes (Birks & Mills, 2011;
Saldana, 2016).
Theoretical sampling. The target population for selecting participants
consisted of individuals who were at least 18 years of age, were currently employed
by an organization operating within the defense industry located in the Tennessee
valley region, and were in a position to respond accurately to questions about
organizational culture and implementation of an information security awareness
and training program. Theoretical sampling refers to the process of collecting data
from participants who have varying levels of experience with the phenomena being
studied or who represent a different dimension to be explored (Cho & Lee, 2014;
Glaser & Strauss, 1999). Theoretical sampling within the study was accomplished
by interviewing participants who possessed varying levels of experience pertaining
to the effects of organizational culture upon implementation of an information
security awareness and training program and who were in the target population. The
purpose behind theoretical sampling was to identify areas which required further
data collection so concepts which had already been identified through comparative
methods could be fully evolved (Charmaz, 2014).
Theoretical sampling involved purposefully sampling participants to gain
additional information relevant to the concepts being researched (Corbin and
Strauss, 2015). Purposeful sampling was conducted within the target population
and was aided by using participant demographics. The demographics data was
used to ensure a diverse sampling of the population occurred so emerging
categories would contain a wide variety of viewpoints. By purposefully sampling a
wide range of participant characteristics from within the target population the
emerging categories were more representative of what participants were
experiencing within the industry located in the Tennessee valley region and not
limited to experiences within a particular type of organization or department.
Instrumentation
The data collection instruments used within this study consisted of a
demographics questionnaire (Appendix B, Demographics Questionnaire) and an
interview questionnaire (Appendix C, Interview Questionnaire). The demographics
questionnaire was designed specifically to support the purposeful sampling. The
interview questionnaire was used to provide a small degree of structure during the
semi-structured participant interviews and provide the association between each
interview questions and its corresponding research question. The interview
questionnaire consisted of 20 question pairs resulting in 40 questions total. Each
pair of questions focused on a particular organizational culture trait. Five culture
traits from each of the four culture types (see Table 1, Organizational culture traits.)
were used to create the question pairs.
Table 1. Organization culture traits.
RQ1:
Cooperativeness
RQ2:
Innovativeness
RQ3:
Consistency
RQ4:
Effectiveness
Empowerment
Entrepreneurship
Order
Competitiveness
Teamwork
Adaptability
Rules and
Regulations
Goal Achievement
Cooperation
Challenges
Security and
Stability
Production
Information Sharing
Growth
Efficiency
Unrewarded
Business Initiatives
Trust
Creativity
Uniformity
Maximizing
Benefits
The first question in the pair was designed to focus the participant’s
thoughts to activities, rituals, and beliefs within the organization which pertained to
a particular culture trait (e.g. teamwork). The second question in the pair was
designed to relate a particular culture trait to the effect which the trait had upon the
implementation of the information security awareness and training program.
Validity testing. The questions were reviewed and validated for face and
content validity by four individuals. Face validity helps ensure survey questions
actually capture the data which is relevant to answering the research questions
(Zikmund, Babin, Carr, & Griffin, 2013). Content validity ensures the questions
within the survey are within the scope of the concept being studied (Zikmund et al.,
2013).
The interview questions were reviewed by two professionals with a
background in organizational studies and two professionals with a background in
information security who also held the Certified Information Systems Security
Professional (CISSP) certification (see Table 2, Reviewers of interview questions).
Table 2. Reviewers of interview questions.
Source
Background
Qualification
Reviewer 1
Organization
Ph.D.
Reviewer 2
Organization
Ph.D.
Reviewer 3
Security
Ph.D. and CISSP
Reviewer 4
Security
D.Sc. candidate and CISSP
Each reviewer validated the questions independently and provided feedback
pertaining to both the demographic and interview questions. A summary of the
feedback which was implementation is shown in Table 3, Recommendations for
interview questions.
Table 3. Recommendations for interview questions.
Recommendation
Source
Status
Researcher
Comment
Add narrative to define
terms and provide context
for the participants prior to
asking each question.
Reviewer 1
Reviewer 2
Reviewer 3
Reviewer 4
Implemented
A narrative was
added to define the
terms prior to
asking each
question pair.
Address discrepancy
between questions RQ2.2a
and RQ2.2b.
Reviewer 1
Implemented
Questions were
aligned to focus on
adaptability.
Verify the relevance of
demographic questions.
Reviewer 3
Implemented
Used to ensure
diverse sampling.
Define “implementation of
an information security
awareness and training
program” before beginning
the interview.
Reviewer 4
Implemented
Definition of
implementation
added to opening
narrative on the
interview
questionnaire.
Pilot Study
A pilot study was conducted to streamline the delivery methods for the
questionnaire and to fine tune the approach used to conduct the interviews. The
pilot study included four participants who were employed by the same organization.
The purpose for having participants from the same organization was to assess the
responses for similarity. If significant differences would have been detected in the
responses, then the validity of the instrument would have been questioned. The
questionnaire was used to conduct three interviews where the first two participants
did not have insight into the questions before they were asked and the third
participant was provided a copy of the questions the day before the interview. The
fourth participant answered the questions in survey format which was setup and
delivered using Survey Monkey.
Results. Interviews took between 60 and 90 minutes to conduct. The first
two participants provided responses which were rich with content. However, the
third participant who was provided a copy of the questions prior to the interview
provided responses quicker allowing for more effective use of the interview time.
The survey option took the fourth participant approximately three hours to
complete. While the survey method would not have required transcription, it did
not provide opportunities to clarify questions or correct misunderstandings. The
approach chosen for the study was to send the participants the interview
questionnaire prior to conducting the interviews in person.
Research Procedures
Procedures within constructivist grounded theory involve theoretical
sampling, data collection, data coding and analysis, and theory emergence
(Charmaz, 2014). The processes and products used to support the study are
depicted in figure 2. Processes within grounded theory are not strictly linear.
Therefore, preceding processes were not entirely completed before subsequent
processes began. Data collection and coding processes were performed in parallel
which allowed theoretical sampling and data collection to continue while
previously collected data was being compared, analyzed, and coded.
Nassiff (2012) performed a survey of 25 grounded theory articles and conference
proceedings published between the years 1993 and 2011 and discovered the studies
contained between 2 and 159 participants. According to Creswell (2014),
theoretical saturation for studies using grounded theory typically occurs between
20 and 30 samples. However, establishing a predetermined number of participants
was not practical for this study and could have interfered with achieving theoretical
saturation. Due to the time constraints involved, this study utilized two conditions
to ensure the process could produce a result and not continue indefinitely. If
theoretical saturation was reached or if the time allotted for participant interviews
was exhausted, theoretical sampling and subsequent data collection would halt.
Data collected prior to halting theoretical sampling would continue through the
coding processes.
Figure 2. Process and products using constructivist grounded theory. This figure illustrates the
process steps derived from Charmaz (2014) and inspired by Nassiff (2012).
Data collection. Data can come from a variety of sources such as
interviews, surveys, memoirs or may even be derived from previously analyzed
data (Corbin & Strauss, 2015; Jansen, 2010). Data was collected through the use of
semi-structured qualitative interviews which were designed to capture detailed
information. Subsequent data collection was influenced by comparative analysis
which was conducted in parallel (Corbin & Strauss, 2015). The information gained
through comparative analysis was used during subsequent interviews to tease
additional information from participants.
A series of demographics questions were presented to participants prior to
the start of the interview to ensure participants were at least 18 years old, worked
within an organization operating within the defense industry located in the
Tennessee valley region, and were in a position to respond accurately to questions
pertaining to organizational culture and its effect upon implementing an
information security awareness and training program. The demographics data
collected using the demographics questionnaire was used to facilitate purposeful
sampling.
Preferably, participants would be interviewed within their organization.
However, if participants were unable to be interviewed within their organization,
alternative arrangements would be made to meet in a mutually convenient location.
Interviews would be digitally recorded when permitted and transcribed to text prior
to analysis. In situations where recording the interview was not permitted, the
interview would be documented through detailed note-taking focused on capturing
the meaning conveyed by the participant and not every word spoken by the
participant (Stake, 1995). Interview data would be collected over a four-month
period from participants working for organizations within the defense industry
located in the Tennessee valley region.
Initial coding. Coding is the process positioned between data collection and
the emergence of a substantive theory. Coding involves a bottom up approach
where analytical thinking applied to data eventually leads to the emergence of
codes, memos, concepts, categories, and substantive theory (Charmaz, 2014). The
process of initial coding involves splitting the collected data into individually coded
segments (Saldana, 2013). Initial coding involves examining each line of data and
identifying the events represented within the data (Charmaz, 2014). Initial coding
produces additional questions and ideas which facilitate the need for additional data
collection (Charmaz, 2014). Codes identify the significance which exists within a
line of data and concepts identify the significance which exists within blocks of
data (Corbin & Strauss, 2015).
Initial coding was used within this study to extrapolate meaning from each
line of data and label the data so the meaning was preserved. The initial coding
process incorporated both in vivo and process coding methods. The first iteration of
line-by-line coding utilized in vivo codes to extract the essence of a line of data
using the participant’s own words (Saldana, 2016). The second iteration of coding
utilized process codes which used gerund phrases exclusively to capture the action
within a line of data (Saldana, 2016). The in vivo codes and the process codes were
then compared with each other and with the original line of data using comparative
analysis to ensure an accurate representation of the data had been extrapolated.
Initial coding continued until each data segment was coded and memos had been
written to describe data context, emerging concepts, and questions which were
discovered (Charmaz, 2014).
Focused coding. Focused coding involves identification of the most
significant codes to construct salient categories (Saldana, 2013). The process of
focused coding helps guide analysis by identifying initial codes which appear to
have significance and creating categories which can be used to subsume numerous
initial codes and concepts (Charmaz, 2014). During the focused coding process,
larger segments of data are analyzed and conceptualized. Identification and use of
overarching categories to organize data from the initial coding process can facilitate
the construction of meaning (Saldana, 2013).
Focused coding was used within this study to discover categories which
could subsume multiple process codes and concepts, and provide abstract meaning
representative of the original data. Categories were discovered by constantly
analyzing and comparing process codes and concepts to one another (Saldana,
2016). The discovery of categories representing higher levels of abstraction allowed
many codes and concepts to be subsumed under a single label. The in vivo codes
were also used to ensure categories accurately subsumed process codes and
concepts. Focused coding continued until all initial codes and concepts had been
subsumed by a category.
Theoretical coding. The theoretical coding process integrates the categories
produced within the focused coding process (Saldana, 2013). Theoretical coding
will result in an umbrella code which can subsume all other codes and categories
formulated during the study (Saldana, 2013). A sufficiently broad and abstract
central or core category will emerge through the process of theoretical coding
which should summarize the main theme of the study (Corbin &
Strauss, 2015).
The purpose of theoretical coding within this study was to discover the
central theme weaved throughout the categories, concepts, codes, and data.
Comparative analysis was used to discover the central theme. Theoretical coding
continued until the essence of the central theme was identified resulting in a single
umbrella code. The umbrella code categorized all previously generated categories,
concepts, and codes, and represented the central theme contained in the data.
Reporting results. An important aspect of performing a study is reporting
the results so others can benefit from the knowledge which has been constructed
throughout the process (Corbin & Strauss, 2015). Reporting the results discovered
through use of grounded theory also includes presenting relevant memos and notes
created during the process providing additional context to situations coded within
the data (Charmaz, 2014). The memos created throughout the study become the
core of analysis (Charmaz, 2014).
As suggested by Corbin and Strauss (2015), a detailed outline was produced to
provide focus while documenting the results of this study. Reporting began once
theoretical coding was complete. Relevant memos, coding frameworks, and
theoretical schemes developed throughout the coding processes were included in
the findings.
Reliability and Validity
Qualitative reliability can be achieved by adopting an approach which is
consistent across multiple research projects (Creswell, 2014). The proposed study
utilized constructivist grounded theory which has been consistently applied to
research and possesses established methods (Charmaz, 2014; Glaser & Strauss,
1999). However, to facilitate qualitative reliability, there must also be sufficient
detail presented within the study to prove the results are reliable (Merriam &
Tisdell, 2016). This study made extensive use of participant responses to provide
the rich data necessary to establish the reliability of the study and the methods used.
The goal of a qualitative study may not be to eliminate personal bias but
rather acknowledge its existence and minimize its effects upon the study (Maxwell,
2013). Completely eliminating researcher bias within a qualitative study may be
difficult. Constructivist grounded theory recognizes the subjective nature of coding
and encourages researchers to document situations and rationales for particular
actions within their memos (Charmaz, 2014). Researcher biases which had the
potential to impact the study were identified, minimized, and documented
(Creswell, 2014).
Detailed memos were kept throughout the study and rich descriptions which
convey findings were included. Creswell (2014) suggested including both
discrepant as well as corroborating information within the study. Both discrepant
and corroborating information were included when using the coding methods
prescribed within grounded theory. A commonly accepted method for ensuring
qualitative validity and reducing researcher bias is triangulation (Cho & Lee, 2014;
Creswell, 2014). Triangulation can be achieved through collecting data from
different sources or selecting participants which represent varying levels of
experience or different environments (Creswell, 2014). This study utilized
triangulation of sources which consisted of collecting data using face-to-face
interviews conducted at different points in time, within different environments, and
to a variety of participants who possessed varying viewpoints. However, the study
was susceptible to self-report errors due to the nature of relying on participants to
recall events accurately while being interviewed.
Summary
This chapter introduced the philosophical worldview, research approach,
design, methods, and procedures which were used to support the study. The
procedures section outlined the processes and the products used to support this
study using the constructivist grounded theory design. Ethical considerations
relevant to the study were introduced and techniques to ensure the reliability and
validity of the study were discussed.
Chapter 4
Findings
Overview
Through exploration of the relationships between organizational culture and
the implementation of information security awareness and training programs,
explanations emerged providing meaningful insight which was used to facilitate
understanding why awareness and training programs are lagging in priority when
data breaches caused by employee negligence are rising. The purpose of this
chapter was to present the actions taken in support of the study and the findings
which were discovered as a direct result of those actions. The chapter presented a
profile of the interview sample which outlines the demographics of the individuals
who participated in the study. The chapter also discussed the analysis which
occurred through each of the coding phases and the findings which were
discovered.
Profile of Interview Sample
Several avenues were used to facilitate identifying candidates for the study.
The first avenue used to identify candidates relied upon sending an email invitation
(Appendix D, Email Invitation to Participate in Study) to individuals who seemed
likely to meet the selection criteria asking them to participate in the study. A follow
up email was sent to individuals who did not respond to the initial invitation.
However, the follow-up email did not generate any additional candidates. The
second avenue relied upon referrals made by professional contacts. Referrals
generated the greatest number of candidates. The last avenue involved attending
several professional meetings hosted by the ISACA-Huntsville chapter where this
study was promoted and members in attendance were invited to participate.
Individuals who were selected to participate in the study represented
varying levels of responsibility, experience, education, and viewpoints.
Participants were volunteers who met the prescreening criteria, signed the informed
consent form (Appendix A, Informed Consent Form), and were successfully
interviewed. There were 16 participants included in the study. The 16 participants
included 3 executive managers, 6 managers, 1 supervisor, and 6 workers. The
participants reported working in a variety of different departments. There were 2
participants in the executive staff, 2 participants working in human resources, 3
participants working in information technology, 4 participants working in security,
and 5 participants supporting programs and operations. Half of the participants
reported having a bachelor’s degree as their highest level of education. The other
half reported having advanced degrees with one participant having a doctoral
degree. Of the 16 participants, 10 reported being employed by their organization
for less than 10 years and 6 reported being employed by their organization for at
least 10 years. There were 9 participants who each reported their organization as
having less than 1000 employees and 7 participants who each reported their
organization as having 1000 or more employees. Additionally, there were 3
participants who each reported their organization as being in existence for less than
15 years, 7 participants who each reported their organization as being in existence
for at least 15 years but less than 25 years, and 6 participants who each reported
their organization as being in existence for more than 25 years.
Participants were interviewed in a variety of settings. Eleven participants
were interviewed within their organization. The five participants who were unable
to be interviewed within their organization agreed to meet in a mutually convenient
location. All participants allowed their interview to be audio recorded. The audio
files were transcribed by the principal investigator into electronic text files and
were used for data validation purposes only. Participants were assigned a numeric
identifier to maintain referential integrity between participants and data excerpts,
and to ensure the identity of participants would remained confidential. The
numeric identifiers and associated excerpts from participant responses were used as
data within the study.
Interviews continued over the allotted four-month period to ensure
properties of the emerging categories were fully evolved (Charmaz, 2014).
However, theoretical saturation within this study occurred after coding and
integrating data from the seventh interview. Theoretical saturation was confirmed
by analyzing and integrating the data from subsequent interviews. Subsequent
interviews did not contribute new concepts or insight into the relationships between
organizational culture and the implementation of information security awareness
and training programs.
Initial Coding and Analysis
The first phase of coding within this study was initial coding. The main
purpose for performing initial coding was to remain open to all the possibilities and
to construct codes which best fit the data collected (Charmaz, 2014). Because
initial coding remains open to many possibilities, it can employ different coding
methods as needed (Saldana, 2016). During the initial coding phase within this
study two coding methods were used to construct codes and concepts. This study
utilized two elemental coding methods and three iterations of coding within the
initial coding phase. Specifically, the first iteration of initial coding employed the
in vivo coding method and the second and third iterations employed the process
coding method.
The first iteration of coding during the initial coding phase utilized in vivo
coding. The in vivo codes were constructed by identifying and extrapolating the
essence of the data using the words of the participant (Saldana, 2016). The data
was analyzed line-by-line for meaning and an in vivo code was assigned to all
meaningful passages. The purpose for using in vivo coding was to stay grounded in
the data by constructing codes comprised of the data. Memo writing also began
during the first iteration and continued throughout the initial coding phase. The
first iteration of initial coding produced 1108 in vivo codes which were used to
facilitate the second iteration of coding. Table 5, Sample in vivo codes shows how
a line of data from transcribed interviews was in vivo coded.
Table 4. Sample in vivo codes.
In Vivo Code
Source and Excerpt
(1) "regulatory, got to do"
201 “The nature of the company is entrepreneurial
but the security training program is more of a (1)
regulatory, got to do type thing”
(2) “all kinds of
requirements”
801 “Goes back to the 8570 and any other
requirement out there, there’s (2) all kinds of
requirements for training”
(3) “going to be done
regardless”
601 “It’s (3) going to be done regardless they’re still
going to have a deadline to turn in its still going to
be done”
The second iteration of coding utilized the process coding method. Process
coding focused upon the action occurring within the data and used gerund phrases
to construct codes (Charmaz, 2014; Saldana, 2016). Utilizing a coding method
which focused on action within the data was appropriate for this study because the
action within the data exposed the interactions occurring between organizational
culture and the implementation of an information security awareness and training
program. During the second iteration of coding, the in vivo codes where used in
conjunction with the data to support analysis methods such as questioning and
comparing. The questioning method facilitated an understanding of the activity
occurring in the data. By searching for answers to questions such as what was
occurring in the data and how was the data interacting, an understanding of the
phenomenon from the perspective of the participants emerged (Corbin & Strauss,
2015). Comparing in vivo codes with the data and having a better understanding of
the interactions found in the data facilitated the construction of process codes.
Table 5, Sample process codes, shows how a line of data was assigned a process
code.
Table 5. Sample process codes.
Code
Source and Excerpt
(1) Following established
training processes
201 “The nature of the company is entrepreneurial
but the security training program is more of a
regulatory, got to do type thing”
(2) Determining
requirements for
training
801 “Goes back to the 8570 and any other
requirement out there, there’s all kinds of
requirements for training”
(3) Ensuring training is
completed
601 “It’s going to be done regardless they’re still
going to have a deadline to turn in its still going to
be done”
Descriptive analysis was also introduced to count the number of unique
sources associated with each code and the number of times a particular code was
referenced. As data was analyzed, new process codes were constructed. However,
when an existing code represented the meaning of a line of data being analyzed, the
code was reused. The second iteration of initial coding produced 41 process codes
which were associated to at least 2 unique participants and referenced at least 4
times. The full list of process codes and associated sample data excerpts can be
viewed in Appendix E, Table of Codes, Sources, References, and Sample Excerpts.
The third iteration of coding also utilized process coding and expanded the
analysis to include comparing process codes to one another in an attempt to find
higher level concepts which could subsume multiple codes and still portray the
meaning found within the data. During the third iteration, theoretical comparisons
were introduced which looked at the data, codes, and emerging concepts and
evaluated them for alternative meanings (Corbin & Strauss, 2015). Theoretical
comparisons where facilitated by asking questions which started with the “what if”
phrase (Corbin & Strauss, 2015, p. 87). Through constant comparative analysis the
41 process codes where subsumed by 27 concepts which can be seen in Appendix
F, Table of Concepts, Codes, and Sample Excerpts. Descriptive analysis was used
to determine the number of unique sources and the reference count for each of the
27 concepts (Appendix G, Table of Concepts, Sources, References, and Codes).
Evaluation of the results from descriptive analysis revealed 15 participants
referenced the concept ensure training is completed and 16 participants referenced
the concept achieving compliance. The concepts, associated codes, corresponding
data excerpts, and memos developed during the initial coding phase were brought
forward into focused coding.
Focused Coding and Analysis
The second phase of coding included focused coding which looked for
themes across the concepts and codes to facilitate the construction of categories
(Charmaz, 2014; Saldana 2016). The theme which emerged from comparisons
made between each of the concepts was that the concepts provided varying
meanings for elements of a training program. Exploration of the theme “elements
of a training program” led to the discovery of six categories which subsumed all
previous concepts and codes. The six categories focused on the benefits,
characteristics, costs, expectations, management, and purpose of an information
security awareness and training program. However, additional analysis determined
two concepts—centralizing training management and distributing training
management—could be subsumed by a new concept focused on positioning of
training management within an organization. The discovery led to the construction
of a new concept—positioning training management—which subsumed
centralizing training management and distributing training management. The
concept positioning training management was a better fit for the category
management of training program which had emerged. The category, which focused
on characteristics, was discovered to contain four concepts which were clearly
operational in nature. Further analysis led to changing the category from focusing
on characteristics to focusing on operations and two concepts within the category
where recategorized. The concept rewarding employees was moved to the category
which had emerged as management of training program and the concept keeping
employees interested was recategorized as expectation of training program. The
category which focused on characteristics of a training program was then renamed
to operations within training program to clarify its meaning. The six categories
which emerged from focused coding and the concepts which they subsumed can be
seen in Table 6, Categories and concepts. A review of the literature found all but
three of the concepts to have been previously discussed in relation to information
security culture and information security awareness and training programs. The
three concepts which were not found in the literature review were facilitating sales,
helping peers, and delegating tasks to subordinates.
Table 6. Categories and concepts.
Category
Concept
Benefit of training program
Facilitating sales
Helping peers
Practicing material learned
Preventing violations
Protecting the organization
Cost of training program
Establishing performance objectives
Leveraging technology
Providing necessary resources
Expectation of training
program
Accessing training information
Desiring rich training content
Keeping employees interested
Minimizing disruption to workflow
Receiving accurate information
Management of training
program
Delegating tasks to subordinates
Ensuring training is completed
Listening to feedback
Positioning of training management
Rewarding employees
Operation within training
program
Delivering training to business areas
Developing relevant training
Establishing frequency of training
Establishing refresh rate for content
Purpose of training program
Achieving compliance
Communicating policy
Establishing importance of training
Holding employees accountable
Raising awareness
For a full list of the concepts, codes, and sample excerpts which were
subsumed by the six categories refer to Appendix H, Table of Categories, Concepts,
Sources, and Sample Excerpts.
Benefit of training program. The concepts which emerged from data
focused on the advantages of implementing an information security awareness and
training program were categorized as benefit of training program. The concepts
which were categorized as benefits of a training program were seen as facilitating
sales, helping peers, practicing material learned, preventing violations, and
protecting the organization.
The concept facilitating sales was not found in the literature review but
existed in the data. Participants recognized they could gain a competitive
advantage by selling “peace of mind” to their customers. Participant 101 said “I am
going to want to have that [information security training] in the company so that I
can sell it to the customer at the end.” When asked about how the organization
would respond if their competitor did not have an information security awareness
and training program, Participant 902 stated “we would tout our infosec
[information security] training systems and activity as a discriminator in
competition with that company; we wouldn’t put them down for not having it, we
would just say we offer this additional value to the government customer because
we’re doing this to train our people to handle their data properly.” Participant 302
stated “the proposal group would use that info [the fact that a competitor did not
have an information security training program] to make us look better than the
competition.”
Helping peers was a concept which represented overcoming challenges and
instilling teamwork as a result of the implementation of an information security
awareness and training program. This concept was not found in the literature
review. However, defense contractors are faced with having to implement the
Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.2047012
which calls for the safeguarding of covered defense information and cyber incident
reporting. The clause is significant because there are requirements referenced by
the clause to establish an information security awareness and training program.
Participant 601 said “everything is DFARS you know and we have one of our
people that works direct charge coming off and helping one of our indirect persons
work with that.” Other participants helped their peers by reminding them to finish
their training on time so they would not have to experience the consequences
associated with expired information security training. Participant 801 said “if we
see that their annual training is about to expire then we’ll email them or call them
and even go to their desk and say hey you need to get on that.”
The concept practicing material learned captured situations where
participants reported activities which represented application of the information
within an information security awareness and training program. For instance,
Participant 105 said “We do preach security is everyone’s job, if you see something
suspicious, hear something, or read something, report it.” Participants who
mentioned putting into practice materials covered within the information security
awareness and training led to the construction of the concept as a benefit of the
training program.
The prevention of security violations—whether through human intervention
or automation—was categorized as a benefit of the training program. Some
participants employed automated measures to ensure the security training was
implement by embedding security policy into the configuration of devices to
prevent users from violating security policy. Participant 301 said “most of the
items within the training have been regulated by some form of GPO [group policy
object] or some form of application that keeps people from doing stupid things.”
Participants who mentioned activities designed specifically to prevent violations led
to the construction of the concept preventing violations.
Participants who discussed activities involving the necessary safeguarding
of the organization and its information led to the construction of the concept
protecting the organization. Participant 901 said “the first one was that you know
if you’re interested in your job security here one of the things that could put us out
of business tomorrow is to lose our security clearance” and Participant 102 said “It
is important for employees to understand what proprietary data is and the many
ways to safeguard it.” Activities which represented protecting the organization
were recognized as benefits of the training program.
Cost of training program. The category cost of training program contains
the concepts which represented an additional cost to the organization when utilized
to support the implementation of an information security awareness and training
program. The cost of training program category included the concepts establishing
performance objectives, leveraging technology, and providing necessary resources.
Information security awareness and training activities identified as having
an established objective or goal were associated with the concept establishing
performance objectives. The tasks mention most often pertained to accomplishing
a passing score on an end of course exam. Participant 701 said “you must make a
specific grade on it if you don’t you have to repeat the training.” The objective
identified referred to the minimum acceptable score for passing the training.
Participant 902 said “the goal is to reduce the number of people who fall for or who
are fooled by phishing tests.” The objective referred to by Participant 902 meant
users would more accurately recognize phishing attempts. The rationale behind
placing the concept establishing performance objectives within the category cost of
training program was due to the time associated with accomplishing and managing
the performance objectives.
A few participants mentioned leveraging technology as a means to enhance
the capabilities of a training program and to stay connected with the workforce.
Participant 102 said “The organization will use IT to share training events held at
the corporate offices over internet conferencing and video recordings when remote
employees are unable to attend in person.” Similarly, Participant 401 said “we’re
using technology knowledge management systems and Microsoft 365 groups and
forums and chat and everything to feel like there’s a connectedness.”
When participants talked about providing necessary resources to maintain
the information security awareness and training program, the conversations varied.
Some individuals, like Participant 902, said “the labor hours required to make the
training relevant, up to date, to get it out and get it recorded; just resources tend to
be one of our biggest challenges.” However, labor hours were not the only
challenge identified. Participant 401 said “I mean one there’s not enough people
out there so there’s major competition around staff and people, there’s not enough
talent around or accessible.” While some participants were discussing the
difficulties in obtaining the resources others seemed confident in gaining access to
the necessary resources. Participant 701 said “basically they address making sure
that we have the tools we need to remain secure along with the training.”
Expectation of training program. The category expectation of training
program included concepts which placed expectations upon the information
security awareness and training program. The concepts categorized as having
placed an expectation upon the training program were accessing training
information, desiring rich training content, keeping employees interested,
minimizing disruption to workflow, and receiving accurate information.
The concept accessing training information emerged as participants were
discussing the ability to access security information presented within the training.
Participants reported that the training sometimes contains information on key
personnel and departments to contact when there are security related questions.
Having access to this information outside of the training was recognized as placing
an expectation on the training program. Participant 103 said “The organization
does not have blind openness of information across the board which is part of our
information security implementation and training program.” However, Participant
201 said “A lot of information is made available which describes what is going on
out there.” Both participants were recognized as having some expectation that the
security related information would be made available outside of the training.
The training experiences described by the participants seemed to have left
them desiring rich training content. The participants complained of having to
accomplish the same training every year. Participant 105 said “I just think most
people literally just click through so they are not on the bad list because it is
required.” However, the desire for rich training was summed up well when
Participant 901 said “why should I sit and be engaged in listening; and too many
times our training is rote rather than being interactive.”
Participants seemed to express an expectation of having the training keep
their focus. Some participants discussed the challenges associated with keeping the
workforce engaged in the training. Participant 901 said “we have a lot of engineers
and lot of technical people who feel they know as much about computers and
information systems as anybody else and they are sometimes reluctant to listen to
things that we try to teach them in our training program.” However, there were
participants who expressed excitement about having training which they found
interesting. Participant 801 said “Actually it’s a simulation; believe it or not
they’ve made it a simulation which is nice.” When activities made reference to
keeping a participant interested in the training, the activity was included with the
concept keeping employees interested.
Several participants focused on implementing training programs which
would align with the organization and be focused on minimizing disruption to
workflow. Participant 902 said “better understanding of the hierarchy and the
boundaries of our organization and how it fits in with others would help us with
how that information—the security information training information—is presented
to the employees.” Participant 201 echoed what participant 902 said by saying
“Time is money really and if you’ve got guys working on site that are putting in
eight hours supporting the government and then you want them to spend another
two to three hours in a day on the security training—in large doses that can be a
problem, in small doses it seems to work okay.” When activities referred to
streamlining the training program to support the business it was associated with the
concept minimizing disruption to workflow.
Receiving accurate information was a concept which focused on the
dissemination of trustworthy information and the competence of individuals
conducting the training. Participant 501 said “I think the people are more likely to
listen to it and kind of get something out of it if they have that ok I trust what he’s
saying he sounds like he knows what he’s talking about.” When asked if
information sharing hindered the effectiveness of the information security
awareness and training program, Participant 601 said “I think it only supplements
it, if you get something that’s good and is from a reputable source.”
Management of training program. The concepts which focused on
performing activities surrounding management of the training program and the
people administering the training were included in the category management of
training program. The concepts which were included in management of training
program were delegating tasks to subordinates, ensuring training is completed,
listening to feedback, positioning of training management, and rewarding
employees.
The concept delegating tasks to subordinates was not found during a review
of the literature. However, this concept emerged as a result of delegating activities
expressed by the participants during the interviews. The development of the
training in some organizations is delegated to individuals performing in other roles.
Some participants reported assembling training materials which had been
developed by individuals working within the areas covered in the information
security training. A good explanation of this concept was provided by Participant
901 who said “the trainer ultimately has got to be the author and someone’s got to
take the – have the presence of taking a lot of different inputs and consolidating it
and making it work.”
The concept ensuring training is completed was a dominant theme
throughout the interviews. Information security awareness and training was a
requirement for all participants and completion of the training was strictly
monitored and enforced. Participant 601 said “It’s going to be done regardless
they’re still going to have a deadline to turn in its still going to be done.” In some
instances, the information security training was tied directly to performance
appraisals which were subsequently tied to pay raises. Participant 701 said “they
mandate that you have to take it or you don’t complete your annual evaluation.”
There were instances where participants who were responsible for the
information security awareness and training program reported listening to feedback.
Participant 901 said “we’ll frequently try to solicit from those people what’s your
view on this how do we best bring this material forward to people and make them
understand.” Another participant listened to feedback to make adjustments to the
delivery method for the training. Participant 601 said “if it didn’t reach people or
didn’t get a good response from it I probably wouldn’t do it again. I want to make
learning exciting.”
Participants reported the positioning of training management within
organizations varied. Some participants discussed having a dedicated or centralized
training management function whereas others mentioned having a program which
was distributed across the organization. Participant 105 said “we do have security
training which is done by the security person on her own” which was understood as
being an example of having a centralized training program. Participant 902 said
“right now it comes from several different groups and we have different people at
the executive level that view some of that training differently” which was
understood as being an example of having a distributed training program. Whether
participants referred to having a centralized or a distributed training program both
were included in the concept positioning training management.
The concept rewarding employees referred to recognition given to the
individuals developing and delivering the training within the organizations. Several
participants made reference to rewards and recognitions when discussing goal
achievement in relation to the information security awareness and training program.
Participant 601 said “I think it’s good when people tell you you’re doing a good job
or hey we’re going above and beyond our goals.” When participants made
reference to a reward or recognition within the context of the information security
awareness and training program it was associated with the concept rewarding
employees.
Operation within training program. The concepts included in this
category focused on activities supporting training content development and
delivery. The concepts which were categorized as operation within training
program were delivering training to business areas, developing relevant training,
establishing frequency of training, and establishing refresh rate for content.
Several participants mentioned having employees who worked within their
customer’s facilities which created challenges in delivering the training content to
those employees. Participant 701 had this to say “certain people work off site so
sometimes it’s hard, it’s a challenge to get into the web based site that the
organization has.” Participants who mentioned having to train individuals in
remote business offices or at customer sites were included in the concept delivering
training to business areas.
When a participant referenced having training which was relevant to their
work environment it was included in the concept developing relevant training.
Relevant training could take many forms. For some participants, it was in response
to a security violation. Participant 102 said “Violations of these practices are
shared with supervisor, and the ISA [information security awareness] manager then
develops a plan to mitigate and disseminate the information to recognize and
prevent the attempts throughout the organization.” For others, relevant training
meant having training which focused on current technology. Participant 903 said “I
would say that the challenge is just trying to keep up with the technology so the
information that you’re putting forth in the security awareness program is current.”
Participants who discussed activities pertaining to the recurring nature of
training were included in the concept establishing frequency of training. For
instance, Participant 104 said “All employees are trained on the portal page and
most of the policies and procedures during orientation.” However, Participant 101
said “The implementation of the information security awareness training program
must consider that the requirements for employees who are already indoctrinated
into the culture are different than those needed for employees being on boarded.”
Participant 501 addressed the situation directly by saying “you can train somebody
on something once a year but if you don’t have continuous awareness throughout
that year it can get lost and I think a lot of places put awareness and training in the
same category.”
Some participants discussed changing training content to keep up with
current events or to stay current with information security knowledge so they can
better protect themselves and their organization. Participant 401 said “if things are
changing so fast from an adversarial environment perspective the skills you need
and understanding you need have to change as fast.” Activities which referred to
refreshing the training content were include in the concept establishing refresh rate
for content.
Purpose of training program. The category purpose of training program
was constructed to include concepts which provided a reason for the existence of
the information security awareness and training program. The concepts which were
categorized as purpose of training program were achieving compliance,
communicating policy, establishing importance of training, and holding employees
accountable.
The concept achieving compliance was the second dominant theme
throughout all of the interviews. Some participants expressed the importance of
remaining in compliance with rules and regulations. Participant 701 said “there’s
laws, rules, regulations we have to follow and if we don’t follow them we get a bad
reputation.” When asked, “How do rules and regulations within your organization
affect the implementation of an information security awareness and training
program?”, Participant 801 responded with “Goes back to the 8570 and any other
requirement out there, there’s all kinds of requirements for training.” The reference
to 8570 was made because it is part of a Department of Defense Directive which
established the information assurance workforce improvement program and
included requirements for information assurance training and certification.
However, participant 902 offered the most definitive response by saying “We are
responding to governmental regulations and business risks and we’re doing those
things to help mitigate those risks and to meet the compliance requirements; that’s
it.” Comments which focused on meeting compliance requirements were included
in the concept achieving compliance.
Several participants discussed the importance of communicating policy and
having policy in place to provide the structure and support for the information
security awareness and training program. Participant 601 said “You have to have
something you can fall back on if I say hey you can’t do that and they say well
show me where, where do you have that written.” Some participants mentioned
communicating policy clarified security rules and concepts. Participant 104 brings
this situation to light by saying “People may want the same level of access as others
on the team without understanding why there are restrictions in place.” Situations
which pertained to the use of security policy to facilitate implementation of the
information security awareness and training program were include within the
concept communicating policy.
Participants referenced establishing importance of training through their
comments which focused on what would happen if training didn’t occur. In some
cases, this even included implementing the training program to administer and track
the completion of the training. Participant 901 recalled that “there’s drastic
consequences if we don’t sustain this thing and losing our security clearance is one,
losing the ability for the government to award us a contract because we haven’t
done this we just can't have.” However, there were also comments which pertained
to delaying information security training if production goals where not being met.
Participant 105 said “we might postpone the training but I don’t know of any
training which we have that has to be done right then, they can all be moved
around.”
The concept holding employees accountable was one of the reasons given
for having employees complete the training individually. Participant 104 said
“Well everybody needs to cooperate with the training program and follow the IT
rules and regulations or they can get written up for not following them.”
Participant comments which referenced holding employees accountable for their
actions were included in this concept.
When participants referenced activities associated with increasing an
employee’s knowledge about situations which could affect them, the actions were
associated with the concept raising awareness. Participant 501 had this to say “for
one you’re getting all the good out of the information security program that you
need to get out of it to understand different types of things that can affect you.”
Situations described by participants which led to an increase in information security
awareness were included within the raising awareness concept.
Determining Significance of Concepts in Relation to Culture Type
Each of the questions asked during the interview mapped directly to one of
the research questions which were constructed from and mapped directly to one of
the four organizational culture types represented by the competing values
framework. The concepts, codes, data, and interview questions were sorted based
on their corresponding research question. Descriptive analysis was used to
determine the number of unique participant sources and the number of references
for each concept as it applied to each research question (i.e. organizational culture
type). Table 7, Concepts, sources, and references grouped by research question
shows the source (Src) and reference (Ref) counts for each concept grouped by
research question.
Table 7. Concepts, sources, and references grouped by research question.
Concept
RQ1
RQ2
RQ3
RQ4
Src
Ref
Src
Ref
Src
Ref
Src
Ref
Accessing training information
9
15
-
-
-
-
-
-
Achieving compliance
9
16
12
35
16
69
12
35
Communicating policy
6
8
7
9
13
26
-
-
Delegating tasks to subordinates
6
12
-
-
2
2
-
-
Delivering training to business areas
3
3
12
24
2
2
2
2
Desiring rich training content
5
11
12
40
6
7
3
5
Developing relevant training
9
14
12
16
2
6
7
8
Ensuring training is completed
12
29
5
17
10
21
7
11
Establishing frequency of training
3
5
6
6
5
13
1
1
Establishing importance of training
1
1
1
1
9
13
5
7
Establishing performance objectives
7
10
1
1
2
3
9
15
Establishing refresh rate for content
3
3
3
3
1
1
1
1
Facilitating sales
-
-
2
2
-
-
12
14
Helping peers
6
17
5
6
1
1
-
-
Holding employees accountable
10
18
2
3
3
3
3
4
Keeping employees interested
5
6
8
17
3
5
2
4
Leveraging technology
4
4
5
6
3
5
3
3
Listening to feedback
9
14
7
10
1
1
1
1
Minimizing disruption to workflow
3
3
3
5
9
20
6
10
Positioning of training management
12
25
3
5
5
7
3
4
Practicing material learned
10
17
1
1
1
1
1
1
Preventing violations
2
3
1
1
3
4
1
1
Protecting the organization
3
4
3
3
7
14
10
23
Providing necessary resources
2
2
6
6
3
4
11
14
Raising awareness
5
7
1
1
6
8
1
1
Receiving accurate information
3
4
-
-
-
-
-
-
Rewarding employees
6
11
3
5
1
1
5
8
After determining the source and reference counts for each concept within a
particular organizational culture type, the next step was to determine which
concepts had sufficient density within each of the organizational culture types to
indicate significance. Within this study, significance of a concept in relation to a
particular organizational culture type was recognized when at least one-fourth of
the total number of sources had at least one reference to the concept pertaining to a
specific organizational culture type. A code referenced by at least one-fourth of the
participant sources warranted consideration because the code may be significant to
the research (Harding, 2013; Saldana, 2016). The significance of each concept in
relation to each of the research questions grouped by category can be viewed in
Table 8, Categories, concepts, and concept significance grouped by research
question.
Table 8. Categories, concepts, and concept significance grouped by research question.
Category
Concept
RQ 1
RQ2
RQ3
RQ4
Coo.
Inn.
Con.
Eff.
Benefit of
training
program
Facilitating sales
Helping peers
Practicing material learned
Preventing violations
Protecting the organization
S
S
S
S
S
S
Cost of training
program
Establishing performance objectives
Leveraging technology
Providing necessary resources
S
S
S
S
S
S
Expectation of
training
program
Accessing training information
Desiring rich training content
Keeping employees interested
Minimizing disruption to workflow
Receiving accurate information
S
S
S
S
S
S
S
S
Management of
training
program
Delegating tasks to subordinates
Ensuring training is completed
Listening to feedback
Position of training management
Rewarding employees
S
S
S
S
S
S
S
S
S
S
S
Table 8. Categories, concepts, and concept significance grouped by research question. (continued)
Category
Concept
RQ1
Coo.
RQ2
Inn.
RQ3
Con.
RQ4
Eff.
Operation
within training
program
Delivering training to business areas
Developing relevant training
Establishing frequency of training
Establishing refresh rate for content
S
S
S
S
S
S
Purpose of
training
program
Achieving compliance
Communicating policy
Establishing importance of training
Holding employees accountable
Raising awareness
S
S
S
S
S
S
S
S
S
S
S
S
There were three concepts which did not meet the criteria for establishing
significance within any of the four culture types identified on the competing values
framework. The three concepts which did not meet the criteria for determining
significance based on the data within this study were preventing violations,
receiving accurate information, and establishing refresh rate for content. The
explanation for the concepts preventing violations and receiving accurate
information not meeting the criteria for significance was because they only
contained three participant sources each and the criteria to be met was four
participant sources within a specific organizational culture type. While the concept
establishing refresh rate of content contained six participant sources, it did not
contain the required four sources within any of the four organizational culture
types.
There were also two concepts which were significant across all four
organization culture types. The two concepts were within the management of
training program and purpose of training program categories. The concept within
the management of training program category was ensuring training is completed.
The concept ensuring training is completed was also affected by 18 of the 20
individual organizational culture traits explored. The two traits not affecting the
concept were security and stability and creativity.
The second concept which existed across all four culture types was within
the purpose of training program category. The concept within the purpose of
training program category was achieving compliance. The concept achieving
compliance was affected by all 20 individual organizational culture traits explored.
Determining Effect of Organizational Culture
Exploring how organizational culture affected the implementation of the
information security awareness and training program required grouping the
categories, concepts, sources, and sample excerpts according to their associated
organizational culture type identified on the competing values framework.
To determine how organizational culture affects the implementation of
information security awareness and training programs, the concepts needed to be
viewed in relation to each of the research questions which focused on a particular
organizational culture type identified on the competing values framework.
RQ1 Cooperativeness. How does the level of cooperativeness
(cooperation, information sharing, trust, empowerment, and teamwork) within the
business affect the implementation of an information security awareness and
training program?
Participants were asked 10 questions pertaining to cooperativeness. The
questions focused on organizational culture traits related to the cooperativeness
quadrant on the competing values framework (Figure 1). The resulting categories,
concepts, and sample excerpts specifically related to the cooperativeness
organizational culture type can be viewed in Appendix I, Table of Categories,
Concepts, Sources, and Sample Excerpts for Cooperativeness Culture Type. The
categories and concepts significant to the cooperativeness organizational culture
type are summarized in Table 9, Categories and concepts for the cooperativeness
organizational culture type.
Table 9. Categories and concepts for the cooperativeness organizational culture type.
Category
Concept
Benefit of training program
Helping peers
Practicing material learned
Cost of training program
Establishing performance objectives
Leveraging technology
Expectation of training program
Accessing training information
Desiring rich training content
Keeping employees interested
Management of training program
Delegating tasks to subordinates
Ensuring training is completed
Listening to feedback
Positioning of training management
Rewarding employees
Operation within training program
Developing relevant training
Purpose of training program
Achieving compliance
Communicating policy
Holding employees accountable
Raising awareness
Organizational cultures oriented toward cooperativeness exhibit tendencies
toward human enrichment activities, consensual processes, and committed
relationships (Cameron, Quinn, DeGraff, & Thakor, 2014). The specific traits
explored by this study were cooperation, information sharing, trust, empowerment
and teamwork.
Cooperation within this study was defined as involving two or more
employees who purposefully act to accomplish a common agenda. Within the data
sample, cooperation affected all concepts listed in Table 9 except leveraging
technology and raising awareness.
Information sharing was defined as involving an exchange of information
between people within the organization. Furthermore, information sharing could
occur within a single department or occur across the entire organization.
Information sharing affected all concepts listed in Table 9 except practicing
material learned, leveraging technology, and holding employees accountable.
Trust was defined as having a level of confidence that someone or
something will accomplish assigned objectives. Trust affected all concepts listed in
Table 9 except developing relevant training and raising awareness.
Empowerment was defined within this study as having been given the
authority, power, and means for making decisions in the interest of the organization.
Empowerment affected all concepts listed in Table 9 except keeping employees
interested.
Teamwork was defined as having two or more employees working together
as part of a cooperative and coordinated effort to accomplish a common objective.
Teamwork affected all concepts listed in Table 9 except accessing training
information.
The category management of training was affected by all five
cooperativeness traits. All concepts within the management of training category
were affected by each of the cooperativeness traits. Additionally, the data did not
reveal a single dominant organizational culture trait affecting every concept.
However, empowerment and trust were the two most dominant traits within the
cooperativeness culture type.
RQ2 Innovativeness. How does the level of innovativeness (creativity,
entrepreneurship, adaptability, and dynamism) within the business affect the
implementation of an information security awareness and training program?
Each participant was asked 10 questions pertaining to innovativeness. The
questions focused on organizational culture traits related to the innovativeness
quadrant on the competing values framework (Figure 1). The resulting categories,
concepts, and sample excerpts specifically related to the innovativeness
organizational culture type can be viewed in Appendix J, Table of Categories,
Concepts, Sources, and Sample Excerpts for Innovativeness Culture Type. The
categories and concepts significant to the innovativeness organizational culture type
are summarized in Table 10, Categories and concepts for the innovativeness
organizational culture type.
Table 10. Categories and concepts for the innovativeness organizational culture type.
Category
Concept
Benefit of training program
Helping peers
Cost of training program
Leveraging technology
Providing necessary resources
Expectation of training program
Desiring rich training content
Keeping employees interested
Management of training program
Ensuring training is completed
Listening to feedback
Operation within training program
Delivering training to business areas
Developing relevant training
Establishing frequency of training
Purpose of training program
Achieving compliance
Communicating policy
Organizational cultures oriented toward innovativeness recognize
opportunity in change, push boundaries, and embrace creativity (Cameron, Quinn,
DeGraff, & Thakor, 2014). The specific traits explored by this study were
creativity, entrepreneurship, adaptability, and dynamism. However, within this
study dynamism was deconstructed into two traits consisting of challenges and
growth.
Creativity was defined as attempting different approaches to tasks or
thinking of new ideas. Creativity affected half of the concepts listed in Table 10,
Categories and concepts for the innovativeness organizational culture type. The six
concepts which were affected by the creativity trait were providing necessary
resources, desiring rich training content, keeping employees interested, developing
relevant training, achieving compliance, and communicating policy.
Entrepreneurship was defined as seeking innovative solutions without fear
of reprisal for assuming additional business risk. Entrepreneurship affected every
concept listed in Table 10, Categories and concepts for the innovativeness
organizational culture type. Entrepreneurship was the only trait to affect all
concepts within the innovativeness organizational culture type making it the
dominant trait.
Within this study adaptability was defined as adapting to new business
opportunities which do not align with the current expectations, experiences, or
values engrained within the organization. The adaptability trait affected all of the
culture traits within Table 10 except helping peers, leveraging technology, and
establishing frequency of training.
Within this study the culture trait dynamism was deconstructed to mean
challenges and growth. Challenges were defined as occasionally being faced with
difficult problems which extend beyond current expertise. Challenges affected all
but one concept listed in Table 10, Categories and concepts for the innovativeness
organizational culture type. The one concept unaffected by challenges was
establishing frequency of training. Growth was defined as occurring when an
organization expands due to acquiring additional sales or minimizing costs.
Growth affected all information security awareness and training program concepts
listed in Table 10 except helping peers, providing necessary resources, and
communicating policy.
Within the innovativeness organizational type every concept within the
category purpose of training program was affected by each of the organizational
culture traits. The concept desiring rich training content was also affected by each
of the traits. The dominant trait within the innovativeness organizational culture
type was entrepreneurship because it affected every concept.
RQ3 Consistency. How does the level of consistency (order, rules and
regulations, uniformity, security and stability, and efficiency) within the business
affect the implementation of an information security awareness and training
program?
Participants were asked 10 questions pertaining to consistency. The
questions focused on organizational culture traits related to the consistency
quadrant on the competing values framework (Figure 1). The resulting categories,
concepts, and sample excerpts specifically related to the consistency organizational
culture type can be viewed in Appendix K, Table of Categories, Concepts, Sources,
and Sample Excerpts for Consistency Culture Type. The categories and concepts
significant to the consistency organizational culture type are summarized in Table
11, Categories and concepts for the consistency organizational culture type.
Table 11. Categories and concepts for the consistency organizational culture type.
Category
Concept
Benefit of training program
Protecting the organization
Expectation of training program
Desiring rich training content
Minimizing disruption to workflow
Management of training program
Ensuring training is completed
Positioning of training management
Operation within training program
Establishing frequency of training
Purpose of training program
Achieving compliance
Communicating policy
Establishing importance of training
Raising awareness
Organizational cultures oriented toward consistency embrace control,
process, and predictability (Cameron, Quinn, DeGraff, & Thakor, 2014). The
specific traits explored by this study were order, rules and regulations, uniformity,
security and stability, and efficiency.
Within this study order was defined as a situation where individuals follow
an established or customary process which results in a unifying or harmonious
condition within the organization. The order trait affected every information
security awareness and training concept within Table 11, Categories and concepts
for the consistency organizational culture type. The order trait was the only trait
within the consistency organizational culture type to affect every information
security awareness and training program concept making it the dominant trait.
Rules and regulations were defined as authoritative directions of what to do
or not to do given specific situations within the workplace. The rules and
regulations trait affected all concepts listed in Table 11 except desiring rich training
content, minimizing disruption to workflow, and raising awareness.
Uniformity was defined as the consistent lack of variation between items
being compared over an extended period of time. The uniformity trait affected all
concepts listed in Table 11 except positioning of training management, establishing
frequency of training, and establishing importance of training.
Within this study security and stability were two traits which were defined
independently. Security was defined as measures taken to protect employees,
resources, and other organizational interests from harm. Stability was defined as
measures taken to ensure a low rate of change occurs within an organization given
reasonably expected conditions. The security and stability trait affected all
concepts listed in Table 11 except minimizing disruption to workflow, ensuring
training is completed, and establishing frequency of training.
Efficiency was defined as a condition which occurs when actual production
or performance equals the maximum levels of production or performance possible
given the same level of consumption. The efficiency trait affected all concepts
listed in Table 11 except protecting the organization and desiring rich training
content.
Within the consistency organizational culture type, the order trait was the
dominant trait. The order trait affected every concept shown to have significance
within the consistency organizational culture type. In addition, there was no single
category where all of the concepts were affected. However, achieving compliance
and communicating policy were affected by all culture traits.
RQ4 Effectiveness. How does the level of effectiveness (competitiveness,
goal achievement, production, and benefit-oriented measures) within the business
affect the implementation of an information security awareness and training
program?
Participants were asked 10 questions pertaining to effectiveness. The
questions focused on organizational culture traits related to the effectiveness
quadrant on the competing values framework (Figure 1). The resulting categories,
concepts, and sample excerpts specifically related to the effectiveness
organizational culture type can be viewed in Appendix L, Table of Categories,
Concepts, Sources, and Sample Excerpts for Effectiveness Culture Type. The
categories and concepts significant to the effectiveness organizational culture type
are summarized in Table 12, Categories and concepts for the effectiveness
organizational culture type.
Table 12. Categories and concepts for the effectiveness organizational culture type.
Category
Concept
Benefit of training program
Facilitating sales
Protecting the organization
Cost of training program
Establishing performance objectives
Providing necessary resources
Expectation of training program
Minimizing disruption to workflow
Management of training program
Ensuring training is completed
Rewarding employees
Operation within training program
Developing relevant training
Purpose of training program
Achieving compliance
Establishing importance of training
Organizational cultures oriented toward effectiveness have a competitive
nature and drive hard in order to ensure winning in the market place (Cameron,
Quinn, DeGraff, & Thakor, 2014). The specific traits explored by this study were
competitiveness, goal achievement, production, and benefit-oriented measures.
However, the trait called benefits-oriented measures was decomposed to focus on
unrewarded business initiatives and maximizing benefits.
Within this study, competitiveness was defined as offering products or
services with comparable capability, quality, price, and support within the same
market. The competitiveness trait affected all of the concepts listed in Table 12
except rewarding employees.
Goal achievement was defined as accomplishing one or more objectives
within an established timeframe. The goal achievement trait affected all of the
concepts listed in Table 12 except providing necessary resources.
Production was defined as transforming inputs into finished goods or
services and reduced production was explained as a situation which occurs when
organizations do not meet production goals. The production trait affected all of the
concepts listed in Table 12 except facilitating goals, establishing performance
objectives, and rewarding employees.
Benefits-oriented measures focused on the benefits associated with business
initiatives. Benefits-oriented measures were decomposed into two attributes
unrewarded business initiatives and maximizing benefits. Unrewarded business
initiatives were projects undertaken to achieve specific objectives in the near-term
which were unsuccessful. The specific objectives may have been to reduce costs,
increase efficiency, increase production or improve sales but the outcome resulted
in additional expense. Unrewarded business initiatives affected all of the concepts
within Table 12 except facilitating sales and developing relevant training.
Maximizing benefits was defined as an action or decision contributing to meeting a
business objective which could be financial or non-financial in nature. Maximizing
benefits affected all the concepts listed in Table 12 except establishing performance
objectives and minimizing disruption to workflow.
The category purpose of training was affected by all five effectiveness
traits. All concepts within the purpose of training program category were affected
by each of the effectiveness traits. The concepts protecting the organization and
ensuring training is completed were also affected by each of the effectiveness traits.
Additionally, the data did not reveal a single dominant organizational culture trait
affecting every concept. However, competitiveness and goal achievement were the
two most dominant traits within the effectiveness culture type.
Theoretical Coding Analysis
Theoretical coding utilized the concepts, categories, and themes identified
within focused coding. By performing analysis across categories and concepts
meaningful relationships could be discovered which could facilitate explaining why
awareness and training programs are lagging in priority when data breaches caused
by employee negligence are rising.
As previously mentioned, two concepts were referenced across all four
organizational culture types. The first concept was within the management of
training program category and was ensuring training is completed. The second
concept which existed across all four culture types was within the purpose of
training program category and was achieving compliance.
The two dominant concepts within the study were from the management of
training program and purpose of training program categories. Exploration of these
two categories in relation to the other categories was necessary to discover
meaningful relationships existing between concepts. Each significant concept
within the category management of training program was analyzed against each
significant concept within every category to determine if a significant relationship
existed. For the purposes of this analysis a significant relationship existed when 50
percent or more of the participant sources for a management of training program
concept also referenced the same concept being analyzed within the context of a
particular organizational culture type. Similarly, each significant concept within the
category purpose of training program was analyzed against each significant
concept within every other category to determine if a significant relationship
existed. For the purposes of this analysis a significant relationship existed when 50
percent or more of the participant sources for a purpose of management program
concept also referenced the same concept being analyzed within the context of a
particular organizational culture type.
The most significant relations were discovered between the concepts
management of training program and purpose of training program. The only
relationship to exist across all four organizational culture types existed between the
concept ensuring training is completed and the concept achieving compliance. The
significant relationships discovered between the concepts within the management of
training program category and the concepts within the purpose of training program
category can be seen in Table 13, Analysis of management and purpose categories
grouped by research question.
Table 13. Analysis of management and purpose categories grouped by research question.
If management of
training program
is:
If purpose of training program is:
RQ1
Coo.
RQ2
Inn.
RQ3
Con.
RQ4
Eff.
Src.
Src.
Src.
Src.
Delegating tasks to
subordinates
6
-
-
-
Achieving compliance
3
-
-
-
Communicating policy
-
-
-
-
Establishing importance of training
-
-
-
-
Holding employees accountable
3
-
-
-
Raising awareness
3
-
-
-
Ensuring training is
completed
12
5
10
7
Achieving compliance
7
4
10
5
Communicating policy
6
-
7
-
Establishing importance of training
-
-
5
-
Holding employees accountable
8
-
-
-
Raising awareness
-
-
5
-
Listening to
feedback
9
7
-
-
Achieving compliance
6
5
-
-
Communicating policy
-
-
-
-
Establishing importance of training
-
-
-
-
Holding employees accountable
6
-
-
-
Raising awareness
-
-
-
-
Positioning of
training
management
12
-
5
-
Achieving compliance
6
-
5
-
Communicating policy
-
-
5
-
Establishing importance of training
-
-
4
-
Holding employees accountable
9
-
-
-
Raising awareness
-
-
-
-
Rewarding
employees
6
-
-
5
Achieving compliance
3
-
-
5
Communicating policy
3
-
-
-
Establishing importance of training
-
-
-
-
Holding employees accountable
3
-
-
-
Raising awareness
-
-
-
-
Discovery of the relationship between the concept ensuring training is
completed and the concept achieving compliance was significant to exploring why
information security awareness and training programs are lagging in priority. The
relationship was significant because it was the only relationship which extended
across all four of the organizational culture types.
The concept ensuring training is completed required further exploration in
the context of each organizational culture type. Discovering which concepts were
related to ensuring training is completed could facilitate understanding the analytic
story. To facilitate understanding of the analytic story the concept ensuring training
is completed along with concepts which indicated having a significant relationship
were isolated and organized within the context of each organizational culture type.
Analysis of the relationships indicated when management of training program was
ensuring training is completed then purpose of training program was always
achieving compliance. To understand the significance of the relationship between
ensuring training is completed and achieving compliance, the two concepts taken
together were analyzed against all other significant concepts. This analysis looked
at the number of unique participants who referenced both concepts within a
particular research question, which as previously mentioned was mapped to an
organizational culture type, and determined the significant concepts within each of
the other categories. For the purposes of this analysis a significant relationship
existed when 50 percent or more of the participant sources for both ensuring
training is completed and achieving compliance also referenced the same
significant concept being analyzed within the context of a particular organizational
culture type. The number of unique participant sources who referenced both
concepts ensuring training is completed and achieving compliance grouped by
research question (i.e. organizational culture type) is shown in Table 14. Analysis of
significant concepts grouped by research question.
Table 14. Analysis of significant concepts grouped by research question.
If management
and purpose of
training
program are:
Then the:
RQ1
Coo.
RQ2
Inn.
RQ3
Con.
RQ4
Eff.
Src.
Src.
Src.
Src.
Ensuring
training is
completed
AND
7
4
10
5
Benefit of training program is:
Facilitating sales
Protecting the organization
-
-
-
4
-
-
5
3
Cost of training program is:
Providing necessary resources
-
2
-
3
Achieving
compliance
Expectation of training program is:
Accessing training information
Desiring rich training content
Keeping employees interested
Minimizing disruption to workflow
4
-
-
-
-
2
-
-
-
4
-
-
-
-
6
3
Operation within training program is:
Delivering training to business areas
Developing relevant training
Establishing frequency of training
-
2
-
-
5
3
-
-
-
-
5
-
The main theme which developed throughout the process of interviewing
participants and analyzing interview data was management of information security
awareness and training program was focused on ensuring training is completed for
the primary purpose of achieving compliance. However, the benefits, costs,
expectations, and operations associated with the information security training
program were affected by organizational culture type. The discovery of the main
theme led to the construction of the theoretical code compliance driven.
Conceptual Data Analysis and Key Findings
Throughout the interview process it was evident the participants regarded
information security awareness and training as something they had to do not for
personal benefit but because the training was assigned by their organization. The
participants repeatedly emphasized training was required and they had to do it or
face the consequences. Participant 701 mentioned having the information security
awareness and training program associated with their performance appraisals
affected their potential for increased salary. Participant 801 mentioned revoking an
employee’s user credentials if the training was not completed, essentially making it
impossible for the employee to work. Participant 105 referenced being placed on
the “bad list” if training was not completed on time. However, through descriptive
analysis a story emerged from the data which helped explain how organizational
culture affected the implementation of information security awareness and training
programs and why the implementation of information security awareness and
training programs were lagging in priority.
Effects of organizational culture types. The implementation of an
information security awareness and training program within the defense industry is
a requirement levied upon businesses through contract terms and government
agencies charged with ensuring businesses are appropriately handling government
related information. Descriptive analysis facilitated the discovery of two concepts
which existed across all organizational culture types. The two concepts were
ensuring training is completed and achieving compliance. An explanation for the
concepts existing across all organizational culture type was the requirement for
organizations to have an information security awareness and training program in
place and to ensure employees are trained in order to be compliant with contractual
and regulatory requirements. However, having a compliance driven program in
place was not representative of having a priority to implement an information
security awareness and training program.
Explanations for lagging in priority. Priority for implementing
information security awareness and training programs within the defense industry
located in the Tennessee valley region was lagging because the effects of
organizational culture have not been recognized or addressed. While organizations
within the defense industry are implementing compliance driven information
security awareness and training programs, those programs must integrate with the
organization’s culture if the programs are going to provide any real usefulness
(Siponen, 2001). Rather than address the organizational culture aspect, many
organizations have chosen to embed security training and policy into machine
configurations to reduce the probability of security violations at the expense of
restricting their employees’ capabilities. Participant 102 suggested you cannot
leave the protection of the organization up to trust—barriers must be in place to
prevent attacks. Implementations of information security awareness and training
programs which are compliance driven may lag in priority within the defense
industry when significant training program concepts affected by organizational
culture are not recognized and addressed. The reluctance to recognize and address
the effects of organizational culture upon implementation of information security
awareness and training programs has allowed the “lag in priority” to persist.
Theoretical Model and Theory
Exploration of relationships between organizational culture types and the
implementation of information security and awareness training programs led to the
discovery that training programs within the defense industry located in the
Tennessee valley region are compliance driven. Two main concepts which existed
across all culture types and were present throughout the data enabled the
construction of the umbrella code compliance driven and led to the development of
the associated explanatory framework (see Figure 3) and subsequent theory.
The umbrella code and main theme which had emerged during theoretical
coding were used to scope the model to compliance driven information security
awareness and training programs within the target population. Selection of
appropriate organizational culture orientations was handled through use of a flow
control which supported selection of one or many organizational culture
orientations. The last section of the explanatory framework included significant
concepts shown to have a significant relationship with both main concepts ensuring
training is completed and achieving compliance when joined together. The
model applies to organizations operating within the defense industry located within
the Tennessee valley region. Organizations which have implemented a compliance
driven information security awareness and training program will find the model
useful in determining why their implementations may be lagging in priority.
Compliance driven information security awareness and training programs exist
when management is primarily focused on ensuring the training is completed for
the purpose of achieving compliance. However, organizational culture effects how
the training program is prioritized across the organization.
The model suggests a lag in priority will exist within cooperativeness
oriented organizations when access to training information is not available and
relevant training is not delivered. When organizations are oriented toward the
innovativeness culture type, the model suggests a lag in priority will exist when
necessary resources are unavailable, dull and uninteresting training is delivered,
business units are not considered, and the training being delivered is not relevant.
Consistency oriented organizations will experience a lag in priority when the
program fails to protect the organization, does not minimize disruption to
workflow, and establishes an ineffective frequency for training. Organizations
oriented towards the effectiveness culture type will experience a lag in priority
when the training program fails to facilitate sales, is ineffective at protecting the
organization, cannot acquire the necessary resources, does not minimize disruption
to workflow, and establishes an ineffective frequency for training.
Figure 3. Theoretical model explaining organizational culture effects upon compliance-driven
information security awareness and training programs. This figure illustrates the significant
concepts which must be addressed during implementation to avoid a lag in priority.
The theory states implementation of information security awareness and
training programs which are compliance driven lag in priority within the defense
industry when significant concepts affected by organizational culture are not
recognized and addressed.
Validation of Findings
The validation of the findings occurred throughout various stages of the
study. The primary methods used to ensure validity of the findings focused around
credibility, originality, resonance, and usefulness (Charmaz, 2014). Establishing
credibility began with having the interview questions reviewed for face and content
validity by four experts within their fields. Interviewing 16 participants who had
varying viewpoints and responsibilities within the defense industry located in the
Tennessee valley region also aided in establishing credibility. Participant
interviews were thorough and lasted between 60 and 90 minutes. Interviews
continued even after theoretical saturation had been achieved to ensure the concepts
would be fully-evolved (Charmaz, 2014). Descriptive analysis was used to
facilitate systematic comparisons between categories and concepts. Two coding
methods were utilized during initial coding to ensure concepts retained a strong link
to the data.
Regarding originality, no studies were discovered in the literature which
focused on organizational culture and the effects upon the implementation of
information security awareness and training programs within the defense industry.
According to Chen, Ramamurthy, and Wen (2015), knowledge about relationships
existing between organizational culture and information security programs is
lacking. Additionally, there were no known models for explaining why the
implementation of the information security awareness and training programs was
lagging in priority. This study offered new insights into addressing implementation
issues caused by organizational culture within the defense industry located in the
Tennessee valley region.
Resonance was accomplished through the use of theoretical sampling which
ensured concepts and categories embodied the essence of the experience being
studied (Charmaz, 2014). Resonance was validated when two individuals familiar
with the experience being studied were able to relate to a presentation of the
working theory.
Studies which contain new knowledge and spark additional research have
attained a degree of usefulness (Charmaz, 2014). This study explains how
organizational culture affects the implementation of information security awareness
and training program and why those programs are lagging in priority within the
defense industry located within the Tennessee valley region. Organizations
attempting to implement information security awareness and training programs will
find this study useful.
Summary
This study explained how organizational culture affected the
implementation of information security awareness and training programs within the
defense industry located within the Tennessee valley region. The study showed
how each of the organizational culture types affected the implementation of an
information security awareness and training program by varying the significance of
concepts related to implementing the program. The study explored the effects of
five organizational culture traits specific to each of the four organizational culture
types and identified which traits affected the concepts related to implementing an
information security awareness and training program. In addition, the study
discovered reasons for why the implementation of an information security
awareness and training program can lag in priority even when organizations are
required to implement training programs. The main theme which emerged and the
discovery of two dominant concepts facilitated the construction of an explanatory
model and the development of a substantive theory with relevance to the defense
industry.
Chapter 5
Discussion, Implications, and Recommendations
Overview
Information has become an enabler of business and must therefore be
protected. Organizations are faced with an increasing number of security breaches
(Casey, 2012). Many of the data breaches are a result of social engineering and
employee negligence. The purpose for the study was to understand why
implementation of information security awareness and training programs were
lagging in priority when data breaches due to social engineering attacks and
employee negligence were rising (Experian, 2016). In order to accomplish this the
study explored the effects organizational culture had upon the implementation of
information security awareness and training programs within the defense industry
located in the Tennessee valley region. Organizational culture had been previously
shown to affect the implementation of information security management principles
(Chang & Lin, 2007; Whipple, 2015). Focusing on information security awareness
and training programs represented a logical progression in knowledge because
awareness and training programs are built upon security management principles.
This study extended previous research efforts and helped fill a gap in the
information security culture literature.
The constructivist worldview was adopted for the study so meaning could
be constructed from the experiences of the participants (Charmaz, 2014). The study
utilized a qualitative approach to support exploration of a situation where prior
knowledge was nonexistent. The study employed a constructivist grounded theory
design so meaningful relationship between data, concepts, and categories could be
explored and discovered. Data was collected by interviewing 16 participants who
offered a wide range of viewpoints.
The study utilized the competing values framework to facilitate grouping
the data collected through participant interviews by the organizational culture types
cooperativeness, innovativeness, consistency, and effectiveness. The study utilized
initial coding to extrapolate the essence from the interview data. The initial coding
process utilized two coding methods and three iterations of coding. The first
iteration used the in vivo coding method which used the participants’ own words to
construct the codes. The second iteration of coding utilized process coding and
focused on discovering the actions within the data and used gerund phrases to
construct the codes. The two coding methods were used to ensure the initial 41
codes remained grounded in the data. The third iteration of coding utilized the
process coding method but focused on comparing codes against codes and codes
against data to construct 27 concepts which contained a higher level of abstraction.
The codes, concepts and memos generated during initial coding were used within
focused coding.
Focused coding compared concepts to concepts, and concepts to codes to
construct six categories which subsumed lower level concepts. During focused
coding the data was resorted and grouped by research question. Each research
question corresponded to a specific organizational culture type. The regrouping of
data facilitated exploration of the effects organizational culture had upon the
implementation of the information security awareness and training programs.
Significant concepts were discovered within each organizational culture type which
facilitated discovery of the specific cultural traits affecting concepts. The four
research questions sought to understand how each of the four organizational culture
types affected the implementation of the information security awareness and
training program. Application of the competing values framework exposed the
significant concepts being affected by organizational culture type but did not
answer the underlying question of why information security awareness and training
programs were lagging in priority.
The competing values framework provided the structure required to conduct
theoretical coding within the context of each of the organization culture types.
Through the use of constant comparisons and descriptive analysis, two significant
concepts emerged which existed across all four culture types. Two central concepts
facilitated the construction of a theoretical code which supported the central theme
and explained what was happening in the data. Participant responses confirmed the
theoretical code as meaningful and accurate. The theoretical code which emerged
from the data was compliance driven. Utilizing the theoretical code, central theme,
and significant concepts, a theoretical model was constructed which explained how
organizational culture affected compliance driven information security awareness
and training programs within the defense industry located within the Tennessee
valley region and answered the underlying question why those programs were
lagging in priority.
Contribution of the Study
This study is the only known study to have applied the competing values
framework to the implementation of information security awareness and training
programs within the defense industry located in the Tennessee valley region.
However, the value of the study extends to all organizations operating within the
defense industry which have a compliance driven information security awareness
and training program. The study provided an explanation for why information
security awareness and training programs were lagging in priority by discovering
how organizational culture was affecting the implementation of those programs.
The study will benefit practitioners and researchers attempting to understand how
organizational culture affects the implementation of information security awareness
and training programs. Knowledge gained from having conducted this study
helped explain the effects which organizational culture can have upon the
implementation of information security awareness and training programs.
Researchers will be able to draw from and extend the results of this study to
areas where implementation of different program types may be affected by
organizational culture. The findings within this study will also benefit the body of
literature pertaining to security culture within the organization. Researchers have
suggested establishing a security subculture within an organization to facilitate
propagation of security principles (Da Veiga & Martins, 2015a). The research
conducted in this study will help shape future research into security subcultures by
having identified specific culture traits affecting the implementation of information
security awareness and training programs.
Practitioners will be able to align the implementation of information
security awareness and training programs with the culture present within their
organizations. According to Siponen (2010), security awareness and training
programs need to be integrated into the organization’s culture if they are to be
useful. The model developed as a result of this research will help facilitate
integration efforts and provide a framework for managers who wish to move
beyond having a compliance driven training program. Kotulic and Clark (2004)
reported management teams lacked access to reliable security planning processes.
This research will facilitate planning processes by identifying the concepts which
are significant to implementing information security awareness and training
programs for each organizational culture type.
Organizations within the defense industry which must meet training
requirements established through terms within contracts and regulations levied by
defense agencies will find this research valuable. Information security awareness
and training is a requirement for defense contractors handling classified, controlled
unclassified, and covered defense information. Failure to implement the
information security awareness and training programs could result in organizations
experiencing breach of contracts or loss of security clearances. The results of this
study will facilitate implementation of information security awareness and training
requirements and may extend to additional security programs where organizational
culture affects the implementation process.
Discussion and Implications
This study integrated the competing values framework and explored the
effects of organizational culture upon information security awareness and training
programs within the confines of the framework. Hartnell, Ou, and Kinicki (2011)
recommended exploring organizational culture and effectiveness through use of
alternative frameworks. Utilizing a different framework to structure the study may
have produced different findings. However, comparing findings from different
frameworks was beyond the scope of this study.
The executives interviewed for this study possessed a clear understanding of
the culture within their organizations. Several expressed concerns about having
regulatory requirements levied upon them which were not aligned with their
existing organizational culture. One executive in this study voiced concern about
meeting future challenges of maintaining the organizational culture as the company
grows. Another mentioned the challenges being faced as the organization shifted
its cultural orientation and adopted more of a consistency culture type. However,
the understanding of culture was not uniform across all participants. While all
participants were familiar with their organization’s culture and were able to
accurately respond to the interview questions, their depth of knowledge across the
organization was sometimes limited due to their placement within the
organizational structure.
The definitions of the organizational culture traits could have been open for
interpretation. This study defined each of the organizational culture traits for the
participants prior to asking questions about the traits which minimized the effects of
interpretation. However, some participants experienced difficulty recognizing the
differences between cooperation and teamwork. The main quandary expressed by
participants was teamwork required cooperation.
Recommendations
The competing values framework has been proven effective for assessing
organizational culture and operational effectiveness within a variety of different
circumstances. Extending the use of the framework beyond security management
principles and using the framework to analyze the effects of organizational culture
upon implementation of information security awareness and training programs
added to the body of knowledge. Conducting this study within an industry which is
not required to implement an information security awareness and training program
would produce interesting findings.
This study could be extended to evaluate the effects of organizational
culture upon other program types within the defense industry. Understanding how
organizational culture affects programs such as quality, safety, workforce
development, risk management, and other types of required training would be
valuable to program managers charged with implementing and maintaining those
programs. In addition, the body of knowledge would benefit from the comparisons
which could be conducted between organizations operating in commercial
industries against organizations operating within the defense industry. For
organizations operating within both industry types the discoveries may help to
alleviate internal tension within those organizations due to competing cultural
values.
