The relationship between security culture and security practices in protecting critical national infrastructure in Malaysia

Abstract

This thesis looks into the relationship between security culture and security practices in Malaysia when it comes to protecting Critical National Infrastructure. There has been a great deal of interest in this relationship as a result of the recent and widespread recognition that poor security practises, rather than insufficient technical controls, are the root cause of security issues. Furthermore, it is argued that security culture is required to cultivate and support security practices. This implies that they have a relationship, and that by understanding this relationship, improvements to Critical National Infrastructure protective security can be made. Hence, this research creates a rigorous conceptual framework for identifying the specific security culture characteristics that support and guide security practices aimed at improving Critical National Infrastructure protective security. The framework is then used as the foundation for quantitative studies that empirically investigate the exact relationship between security culture and security practices. Based on the findings, this study concludes that a comprehensive approach is needed to cultivate the security culture characteristics that are important in order to support and guide security practises and positively influence employees' security behaviour in CNI. This discovery is a significant step forward in the future systematic cultivation of security culture and security practices to support and guide security practices to influence employee behaviours in order to improve CNI protective security.