Challenges in fostering an information security culture in Australian small and medium sized enterprises
Sneza Dojkovski, Sharman Lichtenstein, Matthew Warren · European Conference on Information Warfare and Security · 2006
Sneza Dojkovski, Sharman Lichtenstein and Matthew J. Warren School of Information Systems, Deakin University, Australia. [email protected] sharman [email protected] matthew. [email protected] In light of significant employee-based information security risks, the Australian critical infrastructure will be better protected by the increased presence of an information security culture in organisations of all sizes. This paper identifies key challenges to be addressed by Australian governments and business owners when attempting to foster information security culture in Australian small and medium sized enterprises (SME). The paper reports findings from a focus group of Australian information technology consultants. Key findings indicate that SME owners lack sufficient awareness of the importance of information security and must be persuaded to invest in it, with an initial risk analysis potentially useful for this purpose. Other findings suggest that management commitment and leadership are important influences when reinforced by formal policies and procedures and a range of formal and informal security awareness activities. The paper highlights the special challenges of the Australian environment, where the traditional laissez-faire national character presents unique difficulties that strongly suggest the need for a national SME information security awareness campaign.