Factors of people-centric security climate: conceptual model and exploratory study in Vietnam
This work addresses the problem of improving people-centric security climates for organizations, but it is incremental as it refines existing models with a specific case study.
The study tackled the challenge of employees not recognizing security features by developing a conceptual model linking organizational social networks to information security climate formation, validated through a case study in Vietnam that identified relevant social networks.
There is an increasing focus on the persuasive approach to develop a people-centric security climate where employees are aware of the priority of security and perform conscious security behaviour proactively. Employees can evaluate the priority of security as they observe and interact with the security features that constitute the security climate of the workplace. We examined the fundamental challenge that not every employee could recognise those features. In this multi-stage research, we adopted the theoretical lens of symbolic interactionism to advance a conceptual model which explains the relationship between organisation's social networks and the formation of information security climate. A descriptive case study in Vietnam was then conducted to refine the proposed model. The findings validated and extended the dimensions of information security climate, as well as identified the relevant organisation's social networks (i.e. information, affect, and power) that lead to its formation.