The Impact of Corporate Culture in Security Policies - A Methodology

Despite security policies, standards, awareness strategies and tools currently in place, employees are still being involved in risky behaviors that jeopardizes businesses. Meanwhile, although security policies are the cornerstone of well-designed security strategies, recent studies have demonstrated poor adherence or even negligence in accordance with the rules security policies specify. This observed behavior is related to the fact that business permeates different countries, cultures, and understanding human nature and culture is still a key success factor to information security not well-supported by established security policy development and deployment methodologies. As its outcome, this paper addresses a ubiquitous methodology to develop security policies considering the evaluation of culture and its impacts over security policy adherence.