Security-aware organisational cultures as a starting point for mitigating socio-technical risks

Abstract

This extended abstract briefly introduces Hofstede's three leveled model of human mental programming which captures the unique mental constitution of a person. These levels devide the vague "human factor" in more approachable categories. In the following sections each category is addressed and presented seperately according to research found and regarding security-aware behaviour. By including universal human behaviour, characteristics of organisational and national cultures as well as (occupational) grouping of personality traits of employees, we might be able to identify emerging social threats. Furthermore, assessing social risks could help to develop guidelines for cultural change towards a more security-aware organisational culture.

As the influence of an organisation on external factors (other than their own organisational culture) tends to be minimal, developing, allowing, and applying cultural changes can be a promising approach in mitigating socio-technical risks.