Information security management : a case study of an information security culture

This thesis argues that in order to establish a sound information security culture it is necessary to look at organisation's information security systems in a socio- technical context. The motivation for this research stems from the continuing concern of ineffective information security in organisations, leading to potentially significant monetary losses. It is important to address both technical and non- technical aspects when dealing with information security management. Culture has been identified as an underlying determinant of individuals' behaviour and this extends to information security culture, particularly in developing countries. This research investigates information security culture in the Saudi Arabia context. The theoretical foundation for the study is based on organisational and national culture theories. A conceptual framework for this study was constructed based on Peterson and Smith's (1997) model of national culture. This framework guides the study of national, organisational and technological values and their relationships to the development of information security culture. Further, the study seeks to better understand how these values might affect the development and deployment of an organisation's information security culture. Drawing on evidence from three exploratory case studies, an emergent conceptual framework was developed from the traditional human behaviour and the social environment perspectives used in social work, This framework contributes to in- formation security management by identifying behaviours related to four modes of information security practice. These modes provide a sound basis that can be used to evaluate individual organisational members' behaviour and the adequacy of ex- isting security measures. The results confirm the plausibility of the four modes of practice. Furthermore, a final framework was developed by integrating the four modes framework into the research framework. The outcomes of the three case stud- ies demonstrate that some of the national, organisational and technological values have clear impacts on the development and deployment of organisations' informa- tion security culture. This research, by providing an understanding the in uence of national, organi- sational and technological values on individuals' information security behaviour, contributes to building a theory of information security culture development within an organisational context. The research reports on the development of an inte- grated information security culture model that highlights recommendations for developing an information security culture. The research framework, introduced by this research, is put forward as a robust starting point for further related work in this area.

Building organizational capability through a quality assurance program within a business school and encouraging organizational culture change

This study explores organizational capability and culture change through a project developing an assurance of learning program in a business school. In order to compete internationally for high quality faculty, students, strategic partnerships and research collaborations it is essential for Universities to develop and maintain an international focus and a quality produce that predicts excellence in the student experience and graduate outcomes that meet industry needs. Developing, marketing and delivering that quality product requires an organizational strategy to which all members of the organization contribute and adhere. Now, the ability to acquire, share and utilize knowledge has become a critical organizational capability in academia as well as other industries. Traditionally the functional approach to business school structures and disparate nature of the social networks and work contact limit the sharing of knowledge between academics working in different disciplines. In this project a community of practice program was established to include academics in the development of an embedded assurance of learning program affecting more than 5000 undergraduate students and 250 academics from nine different disciplines across four schools. The primary outcome from the fully developed and implemented assurance of learning program was the five year accreditation of the business schools programs by two international accrediting bodies, EQUIS and AACSB. However this study explores a different outcome, namely the change in organizational culture and individual capabilities as academics worked together in teaching and learning teams. This study uses a survey and interviews with academics involved, through a retrospective panel design which contained an experimental group and a control group. Results offer insights into communities of practice as a means of addressing organizational capability and changes in organizational culture. Knowledge management and shared learning can achieve strategic and operational benefits equally within academia as within other industrial enterprises but it comes at a cost. Traditional structures, academics that act like individual contractors and deep divides across research, teaching and service interest served a different master and required fewer resources. Collaborative structures; fewer master categories of discrete knowledge areas; specific strategic goals; greater links between academics and industry; and the means to share learned insights will require a different approach to resourcing both the individual and the team.

Artful inquiry : an arts-based facilitation approach for individual and organisational learning and development

The research undertaken in these two major doctoral studies investigates the field of artsbased learning, a pedagogical approach to individual and organisational learning and development, my professional creative facilitation practice and development as a researcher. While the studies are stand-alone projects they are intended to build on each other in order to tell the evolving story of my research and professional practice. The first study combines The Role of Arts-based Learning in a Creative Economy; The Need for Artistry in Professional Education the art of knowing what to do when you don’t know what to do and Lines of Inquiry: Making Sense of Research and Professional Practice. The Role of Arts-based Learning in a Creative Economy provides an overview of the field of arts-based learning in business. The study focuses on the relevant literature and interviews with people working in the field. The paper argues that arts-based learning is a valuable addition to organisations for building a culture of creativity and innovation. The Need for Artistry in Professional Education continues that investigation. It explores the way artists approach their work and considers what skills and capabilities from artistic practice can be applied to other professions’ practices. From this research the Sphere of Professional Artistry model is developed and depicts the process of moving toward professional artistry. Lines of Inquiry: making sense of research and professional practice through artful inquiry is a self-reflective study. It explores my method of inquiry as a researcher and as a creative facilitation practitioner using arts-based learning processes to facilitate groups of people for learning, development and change. It discusses how my research and professional practice influence and inspire the other and draws on cased studies. The second major research study Artful Inquiry: Arts-based Learning for Inquiry, Reflection and Action in Professional Practice is a one year practice-led inquiry. It continues the research into arts-based and aesthetic learning experiences and my arts-based facilitation practice. The research is conducted with members of a Women’s Network in a large government service agency. It develops the concept of ‘Artful Inquiry’’ a creative, holistic, and embodied approach for facilitation, inquiry, learning, reflection, and action. Storytelling as Inquiry is used as a methodology for understanding participants’ experiences of being involved in arts-based learning experiences. The study reveals the complex and emergent nature of practice and research. It demonstrates what it can mean to do practice-led research with others, within an organisational context, and to what effect.

Communities of practice : building organisational capability through an undergraduate assurance of learning program

This study explores academic perceptions of organizational capability and culture following a project to develop a quality assurance of learning program in a business school. In the project a community of practice structure was established to include academics in the development of an embedded, direct assurance of learning program affecting more than 5000 undergraduate students and 250 academics from nine different disciplines across four discipline based departments. The primary outcome from the newly developed and implemented assurance of learning program was the five year accreditation of the business school’s programs by two international accrediting bodies, EQUIS and AACSB. This study explores a different outcome, namely perceptions of organizational culture and individual capabilities as academics worked together in teaching teams and communities. This study uses a survey and interviews with academics involved, through a retrospective panel design consisting of an experimental group and a control group. Results offer insights into communities of practice as a means of encouraging new individual and organizational capability and strategic culture adaptation.

Safety culture research in the construction sector : interlocked projects in safety competency and safety effectiveness indicators

Safety culture is a concept that has long been accepted in high risk industries such as aviation, nuclear industries and mining, however, considerable research is now being undertaken within the construction sector, with varying levels of success. The current paper discusses three recent interlocked projects that have had some success in the Australian construction industry. The first project examined the development and implementation of a safety competency framework targeted at safety critical positions across first tier construction organisations. Combining qualitative and quantitative methods, the project: developed a matrix of safety critical positions (n=11) and safety managements tasks (SMTs; n=39); mapped the process steps for their acquisition and ongoing development; detailed the knowledge, skills and behaviours required for all SMTs; and outlined organisational cultural outcomes that could be anticipated in a successful implementation of the framework. The second project extended research on safety competency and leadership to develop behavioural guidelines for leaders to drive safety culture change down to second tier companies. This was designed to assist smaller construction companies to customise their own competency framework and develop implementation guidelines that match their aspirations and resources. The third interlocked project explored the use of safety effectiveness indicators (SEIs) as an industry-relevant assessment tool for reducing risk on construction sites. With direct linkages to safety competencies and safety management tasks, the SEIs are the next step towards an integrated safety cultural approach to safety and extend the concept of positive performance indicators (PPIs) by providing a valid, reliable, and user friendly measurement platform. Taken together, the results of the interlocked projects suggest that safety culture research has many potential benefits for the construction industry, particularly when research is conducted in partnership with industry stakeholders. Suggestions are made for future research, including further application and testing of the safety competency framework and aligning SEIs across construction projects of varying size, location and design.

Organizational culture and willingness to share knowledge : a competing values perspective in Australian context

A considerable amount of research has confirmed the relationship between organizational culture and knowledge sharing behaviours. However, less research has been conducted on the impact of project sub-cultures in relation to the sharing of knowledge between projects, particularly in project based organizations (PBOs). The unique structures and contexts characterized by PBOs indicate the need to investigate further the impact of cultures present within PBOs and their effect on knowledge sharing. We report on a rich case study of four large Australian-based PBOs whereby the cultural values of these large organizations were seen to impact significantly on whether project teams were more or less likely to improve inter-project knowledge sharing. Furthermore, this research demonstrates the utility of using Cameron and Quinn's (2005) Competing Values Framework to evaluate culture in the context of PBOs

Safety culture in supply chains : 'Customer is king'

Despite the presence of many regulations governing the operation of heavy vehicles and supply chains in Australia, the truck driving sector continues to have the highest incidence of fatal injuries compared to all other industries. The working environment has been the focus of attention by safety researchers during the past few decades, with particular consideration been given to the concept ‘safety culture’ and how to maintain, modify and advance responses to occupational risk. One important aspect of the heavy industry which sets it apart is the existence of cultural or sub-cultural influences at an industry wide and occupation-specific level rather than organisational level. This paper reports on the findings of stakeholder’s perceptions of the influences of power and control, and culture on industry safety. In-depth structured interviews were conducted during 2011 with Australian industry stakeholders (n=31). The questioning surrounded decision-making processes with regards to identifying risks, self-monitoring and reducing risky activities; as well as how power-affected relationships may influence the operational performance of supply chains and impacts on driver safety. One of the most significant findings from these interviews relates to the notion of power. The perception that the ‘Customer is King’ was widely viewed, with the majority of stakeholders believing that there exists a ‘master slave mentality’ in the industry. There appears to be great frustration in the industry as to the apparent immunity of customers (particularly retail supply chains) to their responsibilities. There was also a strong perception that the customer holds the balance of power by covertly employing remuneration-related incentives and pressures. Smaller trucking companies are perceived as being more vulnerable to the pressure of customer expectations.

The challenges of adopting design-led innovative strategies in not for profits : the role of consumers, culture and employees

Major changes to regulations, funding and consumer demand in the Australian aged care industry are driving not for profits in this sector to reshape and rethink the services they offer and the ways in which they deliver their services to consumers. Many not for profit organisations facing these new challenges are also facing organisational cultural barriers in the development and implementation of innovative strategies. This paper presents a case study where one organisation, using design led innovation, explored consumer insights and employee values to find new ways to facilitate change.

A framework for conceptualising traffic safety culture

Traffic safety culture is a relatively new concept which has recently gained attention in the field of traffic safety. There is currently little known regarding the nature of the concept, nor how it should be defined. Preliminary definitions have tended to focus on specific road safety problems and the anticipated effect of a strong traffic safety culture. The literature to date has tended to emphasise how traffic safety culture might be created or shaped. However, without a better understanding of the nature and structure of traffic safety culture, discussions regarding changes to traffic safety culture are restricted. An examination of different conceptualisations and definitions of organisational safety culture provides a preliminary theoretical framework for traffic safety culture. Two high risk driving behaviours within the Australian context are compared to illustrate how key factors within this framework can be used to understand and improve road safety outcomes.

Conditions for Successful Reforms : Characteristics of the Organisation and Culture in Chinese Schools in a Global Context

Reforms to the basic education system in China have reflected an increasing awareness of and openness to new ideas from the global education sphere. Many of the concepts involved in the development and implementation of these reforms, including adopting holistic perspectives of student development; decentralising school governance to facilitate local decision-making to address local needs; and, an increased focus on practical, lifelong learning for all involved in schools, have been promoted in research and policies throughout the world. While working within this global context, the system of schooling in China has retained a unique character that is quite different from education in the West. Drawing on an international project on school transformation, this chapter aims to examine how five secondary schools in Chongqing, a municipality in Southwestern China, have harnessed and aligned their resources to provide effective school governance following the curriculum reforms. Furthermore, the chapter will examine the similarities and differences between the organisational structures and cultures of these schools in China and successful schools in Australia, England, Finland, Wales and the United States.

Interactions between organizational culture, trustworthiness, and mechanisms for inter-project knowledge sharing

This research used a multiple-case study approach to empirically investigate the complex relationship between factors influencing inter-project knowledge sharing—trustworthiness, organizational culture, and knowledge-sharing mechanisms. Adopting a competing values framework, we found evidence of patterns existing between the type of culture, on the project management unit level, and project managers’ perceptions of valuing trustworthy behaviors and the way they share knowledge, on the individual level. We also found evidence for mutually reinforcing the effect of trust and clan culture, which shape tacit knowledge-sharing behaviors.

Organisational factors that drive fundraising effectiveness in Australian health charities

This research sought to explore organisational factors that drive successful fundraising. Drawing on Strategic Management theory, this qualitative study examined the key intraorganisational factors that organisations develop to be effective at fundraising within the context of extraorganisational factors that can affect fundraising effectiveness. In this way, it helps build a fundraising effectiveness theory. The findings from this study afford leaders of nonprofits an opportunity to reflect on their reasons for pursuing fundraising as an income stream, their level of understanding of fundraising, the degree of investment they are willing to make and the critical leadership required by the CEO.

The influence of organizational culture and climate on entrepreneurial intentions among research scientists

Over the past decades, universities have increasingly become involved in entrepreneurial activities. Despite efforts to embrace their ‘third mission’, universities still demonstrate great heterogeneity in terms of their involvement in academic entrepreneurship. This papers adopts an institutional perspective to understand how organizational characteristics affect research scientists’ entrepreneurial intentions. Specifically, we study the impact of university culture and climate on entrepreneurial intentions, including intentions to spin off a company, to engage in patenting or licensing and to interact with industry through contract research or consulting. Using a sample of 437 research scientists from Swedish and German universities, our results reveal that the extent to which universities articulate entrepreneurship as a fundamental element of their mission fosters research scientists’ intentions to engage in spin-off creation and intellectual property rights, but not industry-science interaction. Furthermore, the presence of university role models positively affects research scientists’ propensity to engage in entrepreneurial activities, both directly and indirectly through entrepreneurial self-efficacy. Finally, research scientists working at universities which explicitly reward people for ‘third mission’ related output show higher levels of spin-off and patenting or licensing intentions. This study has implications for both academics and practitioners, including university managers and policy makers.

Cultural factors: Understanding culture to design organisation structures and systems to optimise safety

Safety culture is a term with numerous definitions in the literature. Many authors advocate a prescriptive approach to safety culture in which if an organisation has certain levels of externally prescribed systems and structures in place it has a “good safety culture”. Conversely, other researchers suggest an anthropological approach of exploring deep meanings and understandings present within an organisation’s workforce. In a recent published review, the authors presented an alternative view to safety culture, in which the anthropological aspects of safety culture interact with the structures and systems in place within an organisation to result in behavioural patterns. This can be viewed as a human factors approach to safety culture in which, through understanding the specific interactions between the culture of a workforce and external organisational elements, organisational structures and systems can be optimised in order to shape worker behaviour and improve safety. This paper presents findings from a recent investigation of safety culture in the Australian heavy vehicle (transport) industry. Selected results are discussed to explore how understanding culture can provide direction to the optimisation of organisational structures and systems to match worker culture and thus improve safety. Specifically the value placed on personal experience and stories, as well as on both time and money are discussed, and interventions that are suited to these aspects of the culture are discussed. These findings demonstrate the importance of shifting beyond mere prescriptive and interpretive approaches to safety culture and instead to focus on the interaction between cultural and contextual elements to optimise organisational structures and systems.

Safety culture and speeding in the Australian heavy vehicle industry

Inappropriate speed and speeding are among the highest causes of crashes in the heavy vehicle industry. Truck drivers are subjected to a broad range of influences on their behaviour including industrial pressures, company monitoring and police enforcement. Further, drivers have a high level of autonomy over their own behaviour. As such it is important to understand how these external influences interact with commonly shared beliefs, attitudes and values of heavy vehicle drivers to influence their behaviour. The present study uses a re-conceptualisation of safety culture to explore the behaviours of driving at an inappropriate speed and speeding in the heavy vehicle industry. A series of case studies, consisting of interviews and ride-along observations, were conducted with three transport organisations to explore the effect of culture on safety in the heavy vehicle industry. Results relevant to inappropriate speed are reported and discussed. It was found that organisational management through monitoring, enforcement and payment, police enforcement, customer standards and vehicle design factors could all reduce the likelihood of driving at inappropriate speeds under some circumstances. However, due to weaknesses in the ability to accurately monitor appropriate speed, this behaviour was primarily influenced by cultural beliefs, attitudes and values. Truck drivers had a tendency to view speeding as relatively safe, had a desire to speed to save time and increase personal income, and thus often attempted to speed without detection. When drivers saw speeding as dangerous, however, they were more likely to drive safely. Implications for intervention are discussed.