In the assurance of information security in organizations, the human factor plays a major role, as research shows that most of the external attacks and intrusions occur due to the risky acts of employees. From this point of view, it is crucial for the organization to establish with its employees a certain level of information security culture that relates to knowledge, behaviour and other activities. An important aspect is the measurement, which enables organizations time comparison and to detect weak points in the information behaviour of employees, as eliminating these deficiencies reflects in a higher level of information security culture. Since this is a young and yet unexplored area, the challenge is primarily the appropriate definition and operationalization of the concept of the information security culture as a construct, as well as the formation of a valid and reliable measuring instrument that would enable the analysis to be carried out on the findings. The aim of this thesis is to evaluate the quality of the short version of the CLTRe Toolkit survey questionnaire for measuring the information security culture. The methodological analysis is based on the verification of different types of validity, reliability and the assessment of the models fit. The results show that the selected measurement instrument does not achieve satisfactory evaluation of validity and reliability. The proposed improvements will contribute to reconstruct the questionnaire in order to be methodologically tested once again. Creating a quality measuring instrument for the information security culture is of great importance for the development of this field, since it will be one of the first to enable the relevant content findings of the level of information security culture in the organization.
|
