Information Security Cultures of Four Professions: A Comparative Study

Differences in cultures across professions have been reported in the professional culture literature. An understanding of such differences is important to understand the effects of culture. We extend this argument to the area of information security. We argue that it is necessary to examine the information security cultures of various professions to identify differences that may exist, so that they may be taken into account in formulating initiatives to enhance information security. In this article, we provide a comparative description of the security cultures of four professions - information systems, accounting, marketing and human resources - based on semi- structured interviews of respondents from each of the professions. Our results confirm the existence of differences in security cultures across professions. In particular, they indicate that there are differences in beliefs about what constitutes information security, who is responsible for it, and the likelihood of their compliance with security under performance pressure.