Nowadays information security policies are operative in many organizations. Currently few organizations take the pain of verifying the efficacy of these policies. Different standards and procedures exist about methods of measuring efficacy of information security policies. Choosing and implementing them depends mainly on the key performance indicators (KPIs) and key risk indicators (KRIs) of any particular organization. This thesis is a case study of an organization in United Arab Emirates (UAE). The basic aim of the research is to inquire and analyze how the efficacy of the implemented security policies is being measured in this particular organization and to propose a method which is more suitable to the needs of organization. The research is based on theoretical study, an interview and a questionnaire. The results of this thesis indicate that there are no formal mechanisms for measuring the efficacy of information security policies in the organization under consideration. Moreover the employees of the organization are also not much satisfied with information security awareness in the company, which can be another reason for ensuring that the efficacy is measured on regular basis. Therefore, a technique from ISO27004 has been used to demonstrate how this efficacy can be measured. It is a step by step procedure for which the information has been extracted from the interview and survey questionnaire responses.

Many articles within the literature point to the information security policy as one of the most important elements of an effective information security program. Even though this belief is continually referred to in many information security scholarly articles, very few research studies have been performed to corroborate this sentiment. Doherty and Fulford undertook two studies in 2003 and in 2005 respectively that sought to catalogue the impact of the information security policy on breaches at businesses in the United Kingdom. The pair went on to call for additional studies in differing industry segments. This dissertation built upon Doherty and Fulford (2005). It sought to add to the body of knowledge by determining the statistical significance of the information security policy on breaches within Higher education. This research was able to corroborate the findings from Doherty and Fulford's original research. There were no observed statistically significant relationships between information security policies and the frequency and severity of information security breaches. This study also made novel contributions to the body of knowledge that included the analysis of the statistical relationships between information security awareness programs and information security breaches. This effort also analyzed the statistical relationships between information security policy enforcement and breaches. The results of the analysis indicated no statistically significant relationships. Additionally, this research observed that while information security policies are heavily utilized by colleges and universities, security awareness training is not heavily employed by institutions of higher education. This research noted that many institutions reported not having consistent enforcement of information security policies. The data observed during this research implies there is room for additional coverage of formal information security awareness programs and potentially a call to attempt alternative training methods to achieve a reduction of the occurrences and impact of security breaches. There is room for greater adoption of consistent enforcement of policy at higher education organizations. The results of this dissertation suggest that the existence of policy, training, and enforcement activities in and of themselves are not enough to sufficiently curtail breaches. Additional studies should be performed to better understand how breaches can be reduced.

Password policy compliance is a vital component of organizational information security. Although many organizations make substantial investments in information security, employee-related security breaches are prevalent, with many breaches being caused by negative password behavior such as password sharing and the use of weak passwords. The purpose of this quantitative correlational study was to examine the relationship between employees’ attitudes towards password policies, information security awareness, password self-efficacy, and employee intentions to comply with password policies. This study was grounded in the theory of planned behavior and social cognitive theory. A cross-sectional survey was administered online to a random sample of 187 employees selected from a pool of qualified Qualtrics panel members. Participants worked for organizations in the United States and were aware of the password policies in their own organizations. The collected data were analyzed using 3 ordinal logistic regression models, each representing a specific measure of employees’ compliance intentions. Attitudes towards policies and password self-efficacy were significant predictors of employees’ intentions to comply with password policies (odds ratios ≥ 1.257, p < .05), while information security awareness did not have a significant impact on compliance intentions. With more knowledge of the controllable predictive factors affecting compliance, information security managers may be able to improve password policy compliance and reduce economic loss due to related security breaches. An implication of this study for positive social change is that a reduction in security breaches may promote more public confidence in organizational information systems.

There is a great concern when it comes to the investigation of the parameters that affect the formulation of an information security management strategy in an organization. Amongst others, information security awareness is of great interest, mainly because it links the implementation of the information security policies to the consciousness and the psychology of the employees of an organization. State it otherwise, the information security awareness positively beholds the role of a bridge so as to help the IS managers to evaluate the level that the critical information of the organization are secured, and it offers to IS managers opportunities to develop suitable training programs and information security policies for all the employees of an organization. In the current thesis, we focused on the investigation of the factors that influence the behavior of the employees in order to accept any information security policy of the organization and to adopt information security awareness.The psychology of security and technology (POST™) framework (Layton, 2005) together with a PEST (Political, Economic, Social, Technology) analysis guide the investigation and offer the theoretical background for the conduction of a study in an IT Company. A qualitative research has been conducted and semi-structured interviews helped for the collection of the desired data. Also a thematic analysis and the use of a generic approach (Lichtman, 2013) helped for the analysis of the data. The final results gave the ability to identify in practice the employees’ information security awareness adoption level, to link the measurement findings to the development of an information security management strategy and to refine the POST™ framework for its greater advance.

Informationssäkerhet är ett område som kommit att sättas alltmer i fokus hos organisationer. Tidigare har främst tekniska lösningar för att skydda viktig information fått uppmärksamhet, det är först på senare tid som informationssäkerhet har börjat uppfattas som ett komplext område som innefattar såväl tekniska, som organisatoriska och mänskliga faktorer. För att eftersträva en god informationssäkerhet inom organisationen bör ett grundligt arbete läggas på att utveckla informationssäkerhetspolicys och säkerhetsansvariga måste kontinuerligt utbilda och skapa medvetenhet hos anställda kring vilka hot som finns mot organisationen ifall informationssäkerhetsbestämmelser inte efterlevs. Huvudsyftet i föreliggande studie har varit att undersöka vilka faktorer som styr anställdas efterlevnad av informationssäkerhetspolicys. Ytterligare delsyfte har varit att undersöka hur den faktiska efterlevnaden av informationssäkerhetsbestämmelser avspeglar sig inom två vårdverksamheter i Landstinget i Östergötland. För att uppfylla studiens syfte har fallstudier genomförts där såväl observationer som intervjuer med personal legat till grund för datainsamlingen. Resultatet visar att säkerhetsmedvetandet och efterlevnaden av säkerhetsbestämmelser inom de undersökta organisationerna är tämligen god, men det finns skillnader i graden av efterlevnad. Resultaten visar att anställda i viss mån hoppar över säkerhetsbestämmelser för att effektivisera sitt arbete. Den vanligaste säkerhetsbestämmelsen som visade på bristande efterlevnad var att en del anställda slarvade med att logga ut eller låsa datorn då denna lämnades oövervakad. Faktorer som visat sig vara avgörande för ifall säkerhetsbestämmelser efterlevs eller inte är bland annat ifall den anställde anser att beteendet övervakas, hur väl medveten man är kring konsekvensen av att säkerhetsbestämmelser inte efterlevs, samt hur stor sannolikhet man anser det vara att hotet realiseras. Ytterligare faktorer som visat sig spela roll är ifall den anställde anser att säkerhetsbestämmelsen ligger i konflikt med andra intressen, såsom effektivitet eller bekvämlighet. För att kunna införa effektiva policyåtgärder krävs det därmed att policyutvecklare förstår vad som motiverar anställda till att följa säkerhetsbestämmelser och vilka värderingar som ligger bakom deras beteende. / Information security has grown into a field of study that has gained increasingly attention within organizations. In the early days focus of the field has primerly been on technical solutions in order to protect information. Only recently information security has come to be seen as a complex area including both technical, organizational and human factors. In order to strive for a high degree of information security within the organization, emphasis has to be placed on developing a functional information security policy. Just as important is that security managers continually educate and create awareness amongst employees with regards to existing threats if information security rules are not respected. The main purpose in regards to this study has been to investigate the determinants of employees' compliance with information security policies. A further aim of the study has been to examine how the actual compliance of information security regulations is reflected in two healthcare clinics in the county council of Östergötland. In order to fulfill the purpose of the study, case studies were carried out in the clinics, where both filed studies and interviews with staff members formed the basis for data collection. The results show that security awareness and compliance with safety regulations within the surveyed organizations are fairly good, but there are differences in the level of compliance. The results show that employees to some degree overlook safety rules in order to make their work more efficient. The most common security rule that showed non-compliance was where employees occasionally did not logg off or lock the computer as it was left unattended. Determinants that showed to have an influence on whether or not employees comply with information security policys are among other factors to what extent the employee belives that the behavior is being monitored, awareness about conseqences from not complying with the security rules, as well as to what extent one belives that the actual threat occurs. Additional determinants that were found to have an influence on the actual behavior with regards to compliance is to what extent the employee considers the regulations to be in conflict with other interests, such as efficiency or convenience. In order to introduce effective policy measures knowledge is needed where policy makers understand what motivates employees to comply with safety rules, as well as the values that underlie their behavior.

Information security research shows that employees are a source of some of the security incidents in the organisation. This often results from failure to comply with the Information Security Policies (ISPs). The question is, therefore, how to improve information security behaviour of employees so that it complies with the ISPs. This study aims to contribute to the understanding of information security behaviour, especially how it can be improved, from an intrinsic motivation perspective. A review of the literature suggested that research in information security behaviour is still predominantly based on the extrinsic perspective, while the intrinsic perspective has not received as much attention. This resulted in the study being carried out from the perspective of the self-determination theory (SDT) since this theory has also not received as much attention in the study of information security behaviour. The study then proposed an information security compliant behaviour conceptual model based on the self-determination theory, (ISCBMSDT). Based on this model, a questionnaire, the ISCBMSDT questionnaire, was developed using the Human Aspects of Information Security Questionnaire and SDT. Using this questionnaire, a survey (n = 263) was carried out at a South African university and responses were received from the academic, administrative and operational staff. The following statistical analysis of the data was carried out: exploratory factor analysis, reliability analysis, analysis of variance (ANOVA), independent samples test (t-tests) and Pearson correlation analysis. The responses to the survey questions suggest that autonomy questions received positive perception followed by competence questions and relatedness questions. The correlation analysis results show the existence of a statistically significant relationship between competence and autonomy factors. Also, a partial significant relationship between autonomy and relatedness factors as well as between competence and relatedness factors was observed. The exploratory factor analysis that was performed on the questionnaire produced 11 factors. Cronbach alpha was then computed for the eleven factors and all were found to be above 0.7, thus suggesting that the questionnaire is valid and reliable. The results of the research study also suggest that competence and autonomy could be more important than relatedness in directing information security behaviour among employees. / School of Computing / M. Tech. (Information Technology)