Factors Shaping Information Security Culture in an Internal IT Department

摘要

Companies are exposed to the risk of falling victim to cyber attacks every day and therefore invest in optimizing their information security (IS) level. In addition to technological investments, the focus is now increasingly on employees, as their attitude and behavior has a significant influence on the IS level of a company. There is already extensive research on the influencing factors and the establishment of an IS culture in companies. However, little attention has been paid to the group of IT employees, although it has been proven that their attitude, behavior and judgment regarding cyber attacks and IS in general differ from non-IT employees. Even within an IT department, one can expect to see different degrees of these factors, as a distinction must be made between IS employees and employees with traditional IT functions (software development, server operation, etc.). Based on 25 recent IS studies, a literature review has identified four factors that influence the IS attitude and behavior of employees in an internal IT department and thus have an impact on the IS culture. These four components are IT tools, IS skill, appreciation and sub-cultures. The results show that more qualitative research with a focus on employees of an IT department is necessary to advance the findings in the area of IS culture. In addition, CIOs and CISOs benefit from the results, as they specify fields of action that can be tested and optimized in their own organizations.