Understanding and measuring information security culture in developing countries : case of Saudi Arabia

The purpose of the current study was to develop a measurement of information security culture in developing countries such as Saudi Arabia. In order to achieve this goal, the study commenced with a comprehensive review of the literature, the outcome being the development of a conceptual model as a reference base. The literature review revealed a lack of academic and professional research into information security culture in developing countries and more specifically in Saudi Arabia. Given the increasing importance and significant investment developing countries are making in information technology, there is a clear need to investigate information security culture from developing countries perspective such as Saudi Arabia. Furthermore, our analysis indicated a lack of clear conceptualization and distinction between factors that constitute information security culture and factors that influence information security culture. Our research aims to fill this gap by developing and validating a measurement model of information security culture, as well as developing initial understanding of factors that influence security culture. A sequential mixed method consisting of a qualitative phase to explore the conceptualisation of information security culture, and a quantitative phase to validate the model is adopted for this research. In the qualitative phase, eight interviews with information security experts in eight different Saudi organisations were conducted, revealing that security culture can be constituted as reflection of security awareness, security compliance and security ownership. Additionally, the qualitative interviews have revealed that factors that influence security culture are top management involvement, policy enforcement, policy maintenance, training and ethical conduct policies. These factors were confirmed by the literature review as being critical and important for the creation of security culture and formed the basis for our initial information security culture model, which was operationalised and tested in different Saudi Arabian organisations. Using data from two hundred and fifty-four valid responses, we demonstrated the validity and reliability of the information security culture model through Exploratory Factor Analysis (EFA), followed by Confirmatory Factor Analysis (CFA.) In addition, using Structural Equation Modelling (SEM) we were further able to demonstrate the validity of the model in a nomological net, as well as provide some preliminary findings on the factors that influence information security culture. The current study contributes to the existing body of knowledge in two major ways: firstly, it develops an information security culture measurement model; secondly, it presents empirical evidence for the nomological validity for the security culture measurement model and discovery of factors that influence information security culture. The current study also indicates possible future related research needs.

Information security management : a case study of an information security culture

This thesis argues that in order to establish a sound information security culture it is necessary to look at organisation's information security systems in a socio- technical context. The motivation for this research stems from the continuing concern of ineffective information security in organisations, leading to potentially significant monetary losses. It is important to address both technical and non- technical aspects when dealing with information security management. Culture has been identified as an underlying determinant of individuals' behaviour and this extends to information security culture, particularly in developing countries. This research investigates information security culture in the Saudi Arabia context. The theoretical foundation for the study is based on organisational and national culture theories. A conceptual framework for this study was constructed based on Peterson and Smith's (1997) model of national culture. This framework guides the study of national, organisational and technological values and their relationships to the development of information security culture. Further, the study seeks to better understand how these values might affect the development and deployment of an organisation's information security culture. Drawing on evidence from three exploratory case studies, an emergent conceptual framework was developed from the traditional human behaviour and the social environment perspectives used in social work, This framework contributes to in- formation security management by identifying behaviours related to four modes of information security practice. These modes provide a sound basis that can be used to evaluate individual organisational members' behaviour and the adequacy of ex- isting security measures. The results confirm the plausibility of the four modes of practice. Furthermore, a final framework was developed by integrating the four modes framework into the research framework. The outcomes of the three case stud- ies demonstrate that some of the national, organisational and technological values have clear impacts on the development and deployment of organisations' informa- tion security culture. This research, by providing an understanding the in uence of national, organi- sational and technological values on individuals' information security behaviour, contributes to building a theory of information security culture development within an organisational context. The research reports on the development of an inte- grated information security culture model that highlights recommendations for developing an information security culture. The research framework, introduced by this research, is put forward as a robust starting point for further related work in this area.

A Proposed Framework for Understanding Information Security Culture and Practices in the Saudi Context

An examination of Information Security (IS) and Information Security Management (ISM) research in Saudi Arabia has shown the need for more rigorous studies focusing on the implementation and adoption processes involved with IS culture and practices. Overall, there is a lack of academic and professional literature about ISM and more specifically IS culture in Saudi Arabia. Therefore, the overall aim of this paper is to identify issues and factors that assist the implementation and the adoption of IS culture and practices within the Saudi environment. The goal of this paper is to identify the important conditions for creating an information security culture in Saudi Arabian organizations. We plan to use this framework to investigate whether security culture has emerged into practices in Saudi Arabian organizations.

Information security culture : a behaviour compliance conceptual framework

Understanding the complex dynamic and uncertain characteristics of organisational employees who perform authorised or unauthorised information security activities is deemed to be a very important and challenging task. This paper presents a conceptual framework for classifying and organising the characteristics of organisational subjects involved in these information security practices. Our framework expands the traditional Human Behaviour and the Social Environment perspectives used in social work by identifying how knowledge, skills and individual preferences work to influence individual and group practices with respect to information security management. The classification of concepts and characteristics in the framework arises from a review of recent literature and is underpinned by theoretical models that explain these concepts and characteristics. Further, based upon an exploratory study of three case organisations in Saudi Arabia involving extensive interviews with senior managers, department managers, IT managers, information security officers, and IT staff; this article describes observed information security practices and identifies several factors which appear to be particularly important in influencing information security behaviour. These factors include values associated with national and organisational culture and how they manifest in practice, and activities related to information security management.

Cultural impact on e-service use in Saudi Arabia : the need for service oriented culture

This paper reports the results of a mixed method approach to answer: To what extent do cultural values impact on e-service use in Saudi Arabia, and if so how? This paper will firstly, introduce the importance of culture and define the aspects of Saudi culture with focus on our scope: the need for Service Oriented Culture. It will then, briefly, describe the method used and present the qualitative and quantitative findings related to the need for Service Oriented Culture. This research aims to cover a gap in the literature by investigating to what extent the presence of Service Oriented Culture, as one of Saudi Arabia’s cultural values, impacts on e-service use in Saudi Arabia. Surprisingly, the tested hypothesis was rejected: the presence of Service Oriented Culture is not a positive predictor of Intention to Use e-services in Saudi Arabia. It is evidenced that consideration of the impact of the cultural values will mainly contribute to the enhancement of ICTs implementation and use.

Understanding successful use of technology in organisations in developing countries : a structurational perspective

Information Technology and its relationship to organisational performance has been a subject of continued interest to researchers and other stakeholders in developing countries. While there is concurrence that IT does contribute to performance, and we are efficiently expanding our knowledge on what factors cause better leveraging of IT resources in organisations, we have done little to understand how these factors interact with technology that results in improved performance. This paper suggests looking that the interaction between organisational resources and technology within the structurational lens, which recognises the recursive interaction between technology and people in the presence of social practices, and the norms that inform their ongoing practices. An ethnographic approach to understanding this interaction between technology and resources, as suggested by the structuration perspective, is suggested, aiming to provide richer insights on the nature of the environment that promotes better use of IT resources in developing countries. Such insights could provide the IT users in developing countries with at least an initial conception of the “IT usage platform” that they could promote in their organisations to leverage the most from their IT resources.

Quality of work life and turnover intention in primary healthcare organisations : a cross-sectional study of registered nurses in Saudi Arabia

Purpose: The purpose of this study was to improve the retention of primary healthcare (PHC) nurses through exploring and assessing their quality of work life (QWL) and turnover intention. Design and methods: A cross-sectional survey design was used in this study. Data were collected using a questionnaire comprising four sections (Brooks’ survey of Quality of Nursing Work Life [QNWL], Anticipated Turnover Intention, open-ended questions and demographic characteristics). A convenience sample was recruited from 143 PHC centres in Jazan, Saudi Arabia. A response rate of 87% (n = 508/585) was achieved. The SPSS v17 for Windows and NVivo 8 were used for analysis purposes. Procedures and tests used in this study to analyse the quantitative data were descriptive statistics, t-test, ANOVA, General Linear Model (GLM) univariate analysis, standard multiple regression, and hierarchical multiple regression. Qualitative data obtained from responses to the open-ended questions were analysed using the NVivo 8. Findings: Quantitative findings suggested that PHC nurses were dissatisfied with their work life. Respondents’ scores ranged between 45 and 218 (mean = 139.45), which is lower than the average total score on Brooks’ Survey (147). Major influencing factors were classified under four dimensions. First, work life/home life factors: unsuitable working hours, lack of facilities for nurses, inability to balance work with family needs and inadequacy of vacations’ policy. Second, work design factors: high workload, insufficient workforce numbers, lack of autonomy and undertaking many non-nursing tasks. Third, work context factors: management practices, lack of development opportunities, and inappropriate working environment in terms of the level of security, patient care supplies and unavailability of recreation room. Finally, work world factors: negative public image of nursing, and inadequate payment. More positively, nurses were notably satisfied with their co-workers. Conversely, 40.4% (n = 205) of the respondents indicated that they intended to leave their current employment. The relationships between QWL and demographic variables of gender, age, marital status, dependent children, dependent adults, nationality, ethnicity, nursing tenure, organisational tenure, positional tenure, and payment per month were significant (p < .05). The eta squared test for these demographics indicates a small to medium effect size of the variation in QWL scores. Using the GLM univariate analysis, education level was also significantly related to the QWL (p < .05). The relationships between turnover intention and demographic variables including gender, age, marital status, dependent children, education level, nursing tenure, organisational tenure, positional tenure, and payment per month were significant (p < .05). The eta squared test for these demographics indicates a small to moderate effect size of the variation in the turnover intention scores. Using the GLM univariate analysis, the dependent adults’ variable was also significantly related to turnover intention (p < .05). Turnover intention was significantly related to QWL. Using standard multiple regression, 26% of the variance in turnover intention was explained by the QWL F (4,491), 43.71, p < .001, with R² = .263. Further analysis using hierarchical multiple regression found that the total variance explained by the model as a whole (demographics and QWL) was 32.1%, F (17.433) = 12.04, p < .001. QWL explained an additional 19% of the variance in turnover intention, after controlling for demographic variables, R squared change =.19, F change (4, 433) = 30.190, p < .001. The work context variable makes the strongest unique contribution (-.387) to explain the turnover intention, followed by the work design dimension (-.112). The qualitative findings reaffirmed the quantitative findings in terms of QWL and turnover intention. However, the home life/work life and work world dimensions were of great important to both QWL and turnover intention. The qualitative findings revealed a number of new factors that were not included in the survey questionnaire. These included being away from family, lack of family support, social and cultural aspects, accommodation facilities, transportation, building and infrastructure of PHC, nature of work, job instability, privacy at work, patients and community, and distance between home and workplace. Conclusion: Creating and maintaining a healthy work life for PHC nurses is very important to improve their work satisfaction, reduce turnover, enhance productivity and improve nursing care outcomes. Improving these factors could lead to a higher QWL and increase retention rates and therefore reinforcing the stabilisation of the nursing workforce. Significance of the research: Many countries are examining strategies to attract and retain the health care workforce, particularly nurses. This study identified factors that influence the QWL of PHC nurses as well as their turnover intention. It also determined the significant relationship between QWL and turnover intention. In addition, the present study tested Brooks’ survey of QNWL on PHC nurses for the first time. The qualitative findings of this study revealed a number of new variables regarding QWL and turnover intention of PHC nurses. These variables could be used to improve current survey instruments or to develop new research surveys. The study findings could be also used to develop and appropriately implement plans to improve QWL. This may help to enhance the home and work environments of PHC nurses, improve individual and organisational performance, and increase nurses’ commitment. This study contributes to the existing body of research knowledge by presenting new data and findings from a different country and healthcare system. It is the first of its kind in Saudi Arabia, especially in the field of PHC. It has examined the relationship between QWL and turnover intention of PHC nurses for the first time using nursing instruments. The study also offers a fresh explanation (new framework) of the relationship between QWL and turnover intention among PHC nurses, which could be used or tested by researchers in other settings. Implications for further research: Review of the extant literature reveals little in-depth research on the PHC workforce, especially in terms of QWL and organisational turnover in developing countries. Further research is required to develop a QWL tool for PHC nurses, taking into consideration the findings of the current study along with the local culture. Moreover, the revised theoretical framework of the current study could be tested in further research in other regions, countries or healthcare systems in order to identify its ability to predict the level of PHC nurses’ QWL and their intention to leave. There is a need to conduct longitudinal research on PHC organisations to gain an in-depth understanding of the determents of and changes in QWL and turnover intention of PHC nurses at various points of time. An intervention study is required to improve QWL and retention among PHC nurses using the findings of the current study. This would help to assess the impact of such strategies on reducing turnover of PHC nurses. Focusing on the location of the current study, it would be valuable to conduct another study in five years’ time to examine the percentage of actual turnover among PHC nurses compared with the reported turnover intention in the current study. Further in-depth research would also be useful to assess the impact of the local culture on the perception of expatriate nurses towards their QWL and their turnover intention. A comparative study is required between PHC centres and hospitals as well as the public and private health sector agencies in terms of QWL and turnover intention of nursing personnel. Findings may differ from sector to sector according to variations in health systems, working environments and the case mix of patients.

Cultural impact on e-service use in Saudi Arabia : results from focus groups

This paper reports the results of focus groups obtained as part of a full study that uses a mixed method approach to answer the following question: what are the cultural values that impact on e-service use in Saudi Arabia? In order to answer this question we reviewed culture theories, dimensions, and models that have been identified in the literature. Four focus groups interviewing experts and general users (customers) of online services in Saudi Arabia have been completed aiming at the end to identify the uncovered elements of Saudi culture in the literature, which hopefully will result in developing a framework of cultural values that affect e-service use in Saudi context. This paper will firstly, introduce the importance of culture and define the aspects of Saudi culture. It will then describe the method used, and finally discussing the findings of the focus groups. Findings revealed four factors that have not been covered in the literature and need to be investigated namely: nepotism, the lack of human interaction, services oriented culture, and the career path.

Quality of work life among primary health care nurses in the Jazan region, Saudi Arabia : a crosssectional study

Background: Quality of work life (QWL) is defined as the extent to which employee is satisfied with personal and working needs through participating in the workplace while achieving the organisation’s goals. QWL has been found to influence the commitment and productivity of employees in healthcare organisations, as well as in other industries. However, reliable information on the QWL of PHC nurses is limited. The purpose of this study was to assess the QWL among PHC nurses in the Jazan region, Saudi Arabia. Methods: A descriptive research design, namely, a cross-sectional survey was used in this study. Data were collected using Brooks’ survey of quality of nursing work life (QNWL) and demographic questions. A convenience sample was recruited from 143 PHC centres in Jazan, Saudi Arabia. The Jazan region is located in the southern part of Saudi Arabia. A response rate of 91% (N = 532/585) was achieved (effective RR = 87%, n = 508). Data analysis consisted of descriptive statistics, t-test and one way-analysis of variance. Total scores and sub-scores for QWL Items and item summary statistics were computed and reported, using SPSS version 17 for Windows. Results: Findings suggested that the respondents were dissatisfied with their work life. The major influencing factors were unsuitable working hours/shifts, lack of facilities for nurses, inability to balance work with family needs, inadequacy of family-leave time, poor staffing, management and supervision practices, lack of professional development opportunities, and inappropriate working environment in terms of the level of security, patient care supplies and equipment, and recreation facilities (Break-area). Other essential factors include the community’s view of nursing and inadequate salary. More positively, the majority of nurses were satisfied with their co-workers, satisfied to be nurses and had a sense of belonging in their workplaces. Significant differences were found according to gender, age, marital status, dependent children, dependent adults, nationality, ethnicity, nursing tenure, organisational tenure, positional tenure, and payment per month. No significant differences were found according to education level and location of PHC. Conclusions: These findings can be used by PHC managers and policy makers for developing and appropriately implementing successful plans to improve the QWL. This will help to enhance the home and work environments, improve individual and organisation performance and increase nurses’ commitment.

Progress and challenges in the implementation of Electronic Medical Records in Saudi Arabia : a systematic review

Electronic Medical Record (EMR) systems are being implemented increasingly worldwide. Saudi Arabia is one of the developing countries that commenced implementing such systems in 1988. Whilst EMR uptake has been low in Saudi Arabia until now, a number of hospitals have implemented EMR systems successfully. This paper analyses available studies (n = 28) in the literature regarding EMR implementation in Saudi Arabia to identify the progress of EMR implementation to date and to identify the facilitators and barriers to implementation.

Electronic medical record systems in Saudi Arabia: Knowledge and preferences of healthcare professionals

Background The use of Electronic Medical Record (EMR) systems is increasing internationally, though developing countries, such as Saudi Arabia, have tended to lag behind in the adoption and implementation of EMR systems due to several barriers. The literature shows that the main barriers to EMR in Saudi Arabia are lack of knowledge or experience using EMR systems and staff resistance to using the implemented EMR system. Methods A quantitative methodology was used to examine health personnel knowledge and acceptance of and preference for EMR systems in seven Saudi public hospitals in Jeddah, Makkah and Taif cities. Results Both English literacy and education levels were significantly correlated with computer literacy and EMR literacy. Participants whose first language was not Arabic were more likely to prefer using an EMR system compared to those whose first language was Arabic. Conclusion This study suggests that as computer literacy levels increase, so too do staff preferences for using EMR systems. Thus, it would be beneficial for hospitals to assess English language proficiency and computer literacy levels of staff prior to implementing an EMR system. It is recommended that hospitals need to offer training and targeted educational programs to the potential users of the EMR system. This would help to increase English language proficiency and computer literacy levels of staff as well as staff acceptance of the system.

Challenges facing sustainable housing in Saudi Arabia : a current study showing the level of public awareness

Sustainable housing implementation requires strong support from the public, government and the housing industry. Lack of public awareness and understanding of the language and the meaning of sustainable housing may cause lack of public support. Salama stated that "sustainability or sustainable design is simply a rephrasing of some of the forgotten values of traditional architecture and urbanism"(Salama 2007). This exploratory paper examines public awareness of sustainable housing in Saudi Arabia. In developing countries, like Saudi Arabia, which have been experiencing a rapid rate of urbanisation, sustainable concept intervention is essential due to the scarcity of resources (Reffat 2004a). Sustainable building methods include the full use of the site design, passive solar design, natural light and ventilation. This paper reports on an exploratory survey on understanding the potential of the implementation of sustainable housing in Saudi Arabia. The main problem is that more than half of respondents were not aware of sustainable housing. Thus, one of the recommendations from the survey is to educate the public by using local media to inform people of the benefits of sustainable implementation to both new and existing housing stock.

Analyzing the literature for the link between the conservative Islamic culture of Saudi Arabia and the design of sustainable housing

Saudi Arabia experiences housing shortage for mid and low-income families, which is caused by rapid population growth. This condition is worsened by the fact that the current housing supply has problems in meeting both sustainable requirements and cultural needs of those families. This paper aims to investigate the link between the unique conservative Saudi culture and the design of sustainable housing, while keeping the housing cost affordable for mid and low-income families. The paper is based on a review of literatures on the issues of the Islamic culture and how can they be integrated into the design process of a Saudi house. Findings from literature reveiw suggest several design requirements for accommodating the conservative Saudi Culture in low cost sustainable houses. Such requirements include the implementation of proper usage of windows, and house orientation with a courtyard inside rather than facing the main street will provide natural ventilation while maintaining privacy. The main contribution to the body of knowledge is that this is a new approach to sustainable housing in Saudi Arabia considering not only energy use and architectural design issues but also socio-cultural issues as an essential part of sustainability.