Awareness, behaviour and culture: The ABC in cultivating security compliance

A substantial proportion of security breaches stem from human factors, necessitating their consideration alongside technical elements. Scholars propose that a security culture fosters suitable employee behaviors leading to compliance. Consequently, organizations should be guided by a security culture aimed at safeguarding organizational assets and influencing individual behaviors for improved security practices. While security-aware individuals are key in asset protection, the manner in which they interact with implemented security controls is crucial. Non-compliant behavior can impact an organization’s productivity and data confidentiality. This paper reviews notable literature on security culture from 1999-2014, focusing on the role of security awareness, behavior, and their potential influence in transitioning an existing culture to a security-centric one. It introduces relevant security culture tools and provides a comprehensive framework for understanding how security awareness and behavior can instigate a cultural shift towards security.