Developing a cyber security culture: Current practices and future needs

Uchendu, Betsy; Nurse, Jason R.C.; Bada, Maria; Furnell, Steven

Abstract

While the creation of a strong security culture has been researched and discussed for decades, it continues to elude many businesses. Part of the challenge faced is distilling pertinent, recent academic findings and research into useful guidance. In this article, we aim to tackle this issue by conducting a state-of-the-art study into organisational cyber security culture research. This work investigates four questions, including how cyber security culture is defined, what factors are essential to building and maintaining such a culture, the frameworks proposed to cultivate a security culture and the metrics suggested to assess it. Through the application of the PRISMA systematic literature review technique, we identify and analyse 58 research articles from the last 10 years (2010-2020). Our findings demonstrate that while there have been notable changes in the use of terms (e.g., information security culture and cyber security culture), many of the most influential factors are similar. Top management support, policy and procedures, and awareness for instance, are critical in engendering cyber security culture. Many of the frameworks reviewed revealed common foundations, with organisational culture playing a substantial role in crafting appropriate cyber security culture models. Questionnaires and surveys are the most used tool to measure cyber security culture, but there are also concerns as to whether more dynamic measures are needed. For practitioners, this article highlights factors and models essential to the creation and management of a robust security culture. For research, we produce an up-to-date characterisation of the field and also define open issues deserving of further attention such as the role of change management processes and national culture in an enterprise's cyber security culture.

Citation

Uchendu, B., Nurse, J. R., Bada, M., & Furnell, S. (2021). Developing a cyber security culture: Current practices and future needs. Computers and Security, 109, Article 102387. https://doi.org/10.1016/j.cose.2021.102387

• Journal Article Type: Article
• Acceptance Date: Jun 23, 2021
• Online Publication Date: Jun 30, 2021
• Publication Date: Oct 1, 2021
• Deposit Date: Jul 29, 2021
• Publicly Available Date: Jul 1, 2022
• Journal: Computers and Security
• Print ISSN: 0167-4048
• Electronic ISSN: 0167-4048
• Publisher: Elsevier
• Peer Reviewed: Peer Reviewed
• Volume: 109
• Article Number: 102387
• DOI: https://doi.org/10.1016/j.cose.2021.102387
• Keywords: Law; General Computer Science
• Public URL: https://nottingham-repository.worktribe.com/output/5884705
• Publisher URL: https://www.sciencedirect.com/science/article/pii/S016740482100211X
• Additional Information: This article is maintained by: Elsevier; Article Title: Developing a cyber security culture: Current practices and future needs; Journal Title: Computers & Security; CrossRef DOI link to publisher maintained version: https://doi.org/10.1016/j.cose.2021.102387; Content Type: article; Copyright: © 2021 Elsevier Ltd. All rights reserved.