Raising the information security awareness level in Saudi Arabian organizations through an ...

376 Pages·2017·11.85 MB·English

Loughborough University
Institutional Repository
Raising the information
security awareness level in
Saudi Arabian organizations
through an effective,
culturally aware information
security framework
ThisitemwassubmittedtoLoughboroughUniversity’sInstitutionalRepository
by the/an author.
Additional Information:
• A Doctoral Thesis. Submitted in partial fulfilment of the requirements
for the award of Doctor of Philosophy of Loughborough University.
Metadata Record: https://dspace.lboro.ac.uk/2134/28120
Publisher: (cid:13)c Hend Alkahtani
Rights: This work is made available according to the conditions of the Cre-
ative Commons Attribution-NonCommercial-NoDerivatives 4.0 International
(CC BY-NC-ND 4.0) licence. Full details of this licence are available at:
https://creativecommons.org/licenses/by-nc-nd/4.0/
Please cite the published version.
Raising the Information Security Awareness Level in Saudi Arabian
Organizations Through an Effective Culturally Aware Information
Security Framework

A doctoral thesis in partial fulfillment of the requirements for the award of
Doctor of Philosophy of Loughborough University

By
Hend Khalid Alkahtani
Department of Computer Science
Loughborough University

Supervisors
Professor Ray Dawson
And
Doctor Russell Lock

January 2018

© by Hend Alkahtani
ACKNOWLEDGEMENT

First I would like to thank Allah for all the blessings and for answering my prayers during my
stressful years of my study. I would like to thank my advisors Prof Ray Dawson and Dr
Russell Lock for their invaluable advice, support, patience and guidance throughout my
period of study. Their support and encouragement had pushed me forward and strengthen
my thesis.
I would like to thank my family starting with my husband for his patience, encouragement,
loving and financial support. My mom my father my kids my sisters and brothers for their
support and encouragement and believing on me. I also would like to thank my best friend
and her parents for praying for me and for their moral support.
I would like also to thank the formed information security team members especially kholoud
Baselm and Sammer Aldbass for their contribution, support, patience and continuous help
during the development of the produced culturally aware information security framework.
A special thanks and appreciation to my country Saudi Arabia for its encouragement for a
better education and makes the abroad education easy for everyone. My gratitude and
thanks to The Saudi Arabia cultural of bureau for sponsorship my study.

i
Abstract

The focus of the research is to improve the security of information systems in Saudi Arabian
knowledge-intensive organisations by raising the awareness level among all types of
information system users. This is achieved by developing a culturally aware information
security framework that requires the involvement of all types of information system user.
Saudi Arabia has a unique culture that affects the security of information systems and,
hence, the development of this information security framework. The research uses Princess
Nora bint Abdul Rahman University (PNU), the largest all female university in Saudi Arabia,
as a case study.

The level of information security awareness among employees at Saudi Arabia Universities
was tested. Surveys and interviews were conducted to gather data related to the
information security system and its uses. It was found that most employees in Saudi Arabian
organisations and universities are not involved in the development of any information
security policy and, therefore, they are not fully aware of the importance of the security of
information. The purpose of this study is to develop a cultural aware information security
framework that does involve all types of employees contributing to the development of
information security policy. The framework, consists of nine steps that were adapted,
modified and arranged differently from the international best practice standard ISO 27K
framework to fit the unique culture in Saudi Arabia. An additional step has been added to
the framework to define and gather knowledge about the organisations population to justify
its fit into the segregated working environment of many Saudi Arabian institutions. Part of
the research objective is to educate employees to use this information security framework
in order to help them recognise and report threats and risks they may encounter during
their work, and therefore improve the overall level of information security awareness. The
developed information security framework is a collection of ISO 27k best practice steps, re-
ordered, and with the addition of one new step to enable the framework to fit the situation
in Saudi Arabian segregation working environments.
ii
A before-assessment methodology was applied before the application of the culturally
aware information security policy framework between two universities, Imam University
which has ISO27K accreditation and PNU, the case study, to measure and compare their
users’ information security awareness level. Then, an after-assessment methodology is used
to demonstrate the framework effectiveness by comparing the level of awareness before
the application of the culturally aware information security policy framework with the level
of the awareness knowledge gained after the application.

Keywords - Information systems, Information security, Security awareness, Saudi Arabian
Culture, Security policy.

iii
List of Publications

H. Alkahtani, R.J.Dawson, RLock, 2013, “The Impact of Culture on Saudi Arabian Information
Systems Security”. The 21st International Conference on Software Quality Management
(SQM 2013), London.

H. Alkahtani, R.J.Dawson, RLock, 2015, “Communication and Effective Email Usage in
Saudi Arabia”. International Conference on Software Quality Management (SQM
2015). Loughborough University Loughborough, UK.

iv
TABLE OF CONTENTS
Chapter 1 Introduction …………………………………………………………………………….….…...……..... 1
1.1 Statement of the Problem …………………………….……………………………………………..……..…. 2
1.2 Research Aim and Objectives …………………………………………………………..……………….……..4
1.3 Research Structure ……………………………………………………………………………….………………….8
1.4 Conclusion …………………………………………………………………………………………………………..…12

Chapter 2 Literature Review ……………………………………………………………………..……………....13
2.1 Introduction ………………………………………………………………………..………………………….……..13
2.2 Information Security ………………………………………………………………………………..………….…13
2.3 Threats and Risks to Information Technology …….………………………………………….……...16
2.3.1 Risk Management ………………………………………………….……………………………….….17
2.3.2 Risk Assessment ………………………………………………………….………………………….….18
2.3.3 Threats and risks associated with people……………….………..……………..…….……19
2.3.4 Technology Risk …………………………………..………………………..…………….…………….20
2.4 Laws and Regulation for IT ………………………………………………………………………………….….22
2.5 Implementing Information Security …………………………………………………………….…………23
2.5.1 Auditing …………………………………………………………………………………………..……......26
2.5.2 Technical Controls ……………………………………………………………………………..……...27
2.5.2.1 Preventive Controls ………………………………………………………………..…....27
2.5.2.2 Detective and Recovery Control ………………………………………………..……30
2.5.3 Security Policy controls …………………………………………………………………………...…31
2.5.4 People Controls ………………………………………………………………………………………….35
2.6 Human Compliance ………………………………………………………………………..………….……….…37
2.6.1 Approaches to insure compliance ………………………………………..………………..…. 38
2.6.1.1 Training and education ……………………………………………………….……..…..38
2.6.1.2 Sanction …………………………………………………………………………….………..…39
2.6.1.3 Annual personal performance plan ………………………………………….....…40
2.7 Management and information security ………………………………………………..…………..…..42
2.8 Information security in Saudi Arabia ……………………………………………………..………..…....43
2.8.1 Information system outsourced in Saudi Arabia ……………………………………..…44
2.8.2 Information system attacks in Saudi Arabia ………………………………………..…..…46
2.8.3 Saudi Arabia cultural effect in information security ………………………………....47
2.9 Conclusion ……………………………………………………………………………………………………..…..…49

Chapter 3 The Impact of Culture on Saudi Arabian Information Systems Security ……….51
3.1 Introduction ………………………………………………………………………………………………..…….…..51
3.2 Language Barriers ……………………………………………………….…………………………………….…..52
3.3 Text direction ……………………………………………………………………………………………..……….…53
3.4 Hierarchy …………………………………………………………………………………………………….………...54
v
3.5 Gender communication ………………………………………………………………………………………….56
3.6 Fear of losing face ……………………………………………………………………………………………..…..56
3.7 Nepotism ……………………………………………………………………………………………………………….57
4.8 Wealth ……………………………………………………………………………………………………………….….58
4.9 Conclusion …………………………..…………………………………………………………………………........59

Chapter 4 Methodology …………………………………………………………………………………….…....60
4.1 Research Methodology ……………………………………………………………..…………………..…..….60
4.2 Research Philosophy ………………………………………………………..…………………………..…….…61
4.2.1 Positivistic …………………………………………………………………………………………..……..61
4.2.2 Interpretivist/Phenomenological ………………………………………………………………..61
4.2.3 Choice of Philosophy ………………………………………………………………………….……...63
4.3 Research approach …………………………………………………………………………………………..…...64
4.3.1 Type of Research ……………………………………………………………………………………..…64
4.3.2 Quantitative vs qualitative ……………………………………………………………………….…65
4.3.3 Subjective vs Objective ………………………………………………………………………………66
4.3.4 Deductive vs inductive ……………………………………………………………………………....68
4.3.5 Choice of Approach ………………………………………………………………………………..….68
4.4 Research Strategy ……………………………………………………………………………………………...….69
4.4.1 Choice of strategy ……………………………………………………………………………………......70
4.5 Data Collection Methods for the Research …………………………………………………………….…...72
4.5.1 Literature Review …………………………………………………………………………………….…74
4.5.2 Survey ………………………………………………………………………………………………….…....74
4.5.2.1 Initial Questionnaires ……………………………………………………………..….…..75
4.5.2.2 Second Questionnaires …………………………………………………………………..76
4.5.2.3 The interviews …………………………………………………………………………..…...77
4.6 Summary …………………………………………………………………………………………………………..…..78

Chapter 5 Data collection-Survey………………………………………………………….…………….……..79
5.1 Questionnaires aim …………………………………………………………………………………….……….…79
5.2 Data collection-Survey process………………………………………………………………………….......79
5.2.1 Distribution of Questionnaires …………………………………………………………………..….79
5.2.2 Questionnaire distribution results ……………………………………………………………...…80
5.2.3 Questionnaire distribution results …………………………………………………………….…..80
5.3 Data collection analysis process .………………………………………………………………….………..80
5.3.1 Q1: Gender (male/female)………………………………………………………………………….81
5.3.2 Q2: Age Group………………………………………………………………………………………….…82
5.3.3 Q3: What is your highest qualification?..........................................................83
5.3.4 Q4: Do you have any IT related qualification at undergraduate / postgraduate
level?...........................................................................................................................84
5.3.5 Q5: Have you attended any IT related training courses?................................84
vi
5.3.6 Q6: Position held at PNU……………………………………………………………………..………85
5.3.7 Q7: Which of the University’s computer systems do you use?......................86
5.3.8 Q8: Do you often face problems when using the University’s computer
systems?......................................................................................................................87
5.3.9 Q9: When dealing with IT related tasks, do you consider yourself someone
more likely to have to help others, or to ask for help yourself?.................................87
5.3.10 Q10: Please list and rate (1-5) any problems that you have faced in the past
month……………………………………………………………………………………………………………………..88
5.3.11 Q 11: On a scale of 1 – 5 how computer literate do you see yourself?...........89
5.3.12 Q12: Do you feel the IT systems at PNU are difficult to use?..........................91
5.3.13 Q13: How many passwords do you use to access the various IT systems at
PNU?............................................................................................................................92
5.3.14 Q14: Which parts of the current IT systems do you find the most difficulty
with?............................................................................................................................93
5.3.15 Q15: If you would like to add any additional information in relation to using
the IT facilities at PNU please write it below…………………………………………………………93
5.3.16 Non-IT staff survey analysis conclusion……………………………………….…..94
5.4 IT-employee survey analysis …………………………………………………………………………….…...94
5.4.1 Q1: Gender…………………………………………………………………………………………..….….94
5.4.2 Q2: Age group……………………………………………………………………………………………..95
5.4.3 Q3: What is your highest qualification?..........................................................95
5.4.4 Q4: Is your education IT related?....................................................................96
5.4.5 Q5: Have you attended any IT related training courses?................................97
5.4.6 Q6: Position held at PNU…………………………………………………………………………....97
5.4.7 Q7: Which of the tasks below do you perform whilst at the University?........98
5.4.8 Q8: Which of the University’s computer systems do you use?.......................99
5.4.9 Q9: Do you often face problems when using the University’s computer
systems?....................................................................................................................100
5.4.10 Q10: Do you find yourself asking others for help, or helping others?...........100
5.4.11 Q11: Please list and rate (1-5) any problems that you have faced in the past
month………………………………………………………………………………………………………………..…101
5.4.12 Q12: On a scale of 1 – 5 how computer literate do you see yourself?..........101
5.4.13 Q13: Do you feel the IT systems at PNU are difficult to use?........................103
5.4.14 Q14: How many passwords do you use to access the various IT systems at
PNU?..........................................................................................................................104
5.4.15 Q15: How much training on the Banner systems have you received?..........105
5.4.16 Q16: What do you see the solution being to improve the computer systems
at PNU?...................................................................................................................106
5.4.17 Q17: How much external support does PNU currently utilise for the current
information systems?..............................................................................................107
5.4.18 Q18: Do you feel the current IT department is managed correctly?.............107
vii
5.4.19 Q19: Have you found this training to be beneficial?.....................................108
5.4.20 Q20: How secure do you feel the current computer systems are at PNU?...108
5.4.21 IT Staff Survey Conclusion……………………………………………………………..109
5.5 Summary of the finding results………………………………………………………………………..……110

Chapter 6 Data collection: Interview ………………………………………..…………….……………….112
6.1 The goal of the Interviews ………..…………………………………………………………………...…….112
6.2 Interview Techniques …………………………..……………………………………………..……….………116
6.2.1 The first interview collection technique …………………………………………………..….117
6.2.2 The second interview collection technique …………………………………………….…...118
6.2.3 The third interview technique ………………………………………………………………..……119
6.3 The data collection interview design .…………………………………………………………………..120
6.4 Initial interview ………………………………………………………………………………………………….…121
6.4.1 Part 1: Vulnerability of PNU’s information systems …………………………………..122
6.4.2 Part 2: Employee and users awareness ……………………………………………….……129
6.4.3 Part 3: Training programmes …………………………………………………………………….134
6.5 Second interview: Interviewing females at the University .……………………….………... 137
6.5.1 General problems ……………………………………………………..….………………………….138
6.5.2 Staff problems …………………………………………………….……………………………………139
6.6.2 Students problem with the system ……………………………………………….………….139
6.6 The results and finding for the first and second interviews ………………………………….140
6.7 Third interview: ISO interviews ……………………………………………………….…………………...142
6.8 Recommendations ……………………………………………………………………………………………….145
6.8.1 Communication solution …………………………………………………………………….…….145
6.8.2 Feedback awareness ………………………………………………………………………….…….147
6.9 Conclusion…………………………………………………………………………………………………………….147

Chapter 7 Formation of Information Security Policy framework.………………….……….…149
7.1 The development of information security framework ………….………………………………149
7.2 First phase: Prior implementation ………………………………………………………………………..155
7.2.1 Step 0: Formation of an information security team ………………………………….155
7.2.2 Step 1: Identification and collection of information security requirements.156
7.2.2.1 ISO / Best practice ………………………………………………………………………..157
7.2.2.2 Law and regulations ………………………………………………………………………162
7.2.2.3 Auditing ………………………………………………………………………………………..163
7.2.2.4 Risk assessment and treatment ………………………………………………….…166

7.2.2.5 Identifying culture problems …………………………………………………………169

7.2.2.5.1 Trusting culture ………………………………………………………………170

7.2.2.5.2 Gender communication ………………………………………………….172

7.2.3 Step 2: Identification of the population of an organisation ………………….…..174

viii