ASSESSMENT OF INFORMATION SECURITY CULTURE IN THE BANKING INDUSTRY: THE CASE OF COMMERCIAL BANK OF ETHIOPIA

Abstract

Information security culture is mainly considered as a set of information security characteristics that the organization values. In this paper, an attempt has been made to assess information security culture at commercial bank of Ethiopia. The study has employed descriptive research. The instrument (customized for the current study) incorporates statements that assess different issues in relation to information security by using 5-point Likert-scale questionnaire, distributed to employees and unstructured interview conducted with information security manager and selected through purposive sampling. To make the assessment Questioner were adopted from previous studies. A total of 257 questionnaires were filled and returned by employees. The analysis was made by making use of descriptive statistics. The empirical result shows that employee’s level of awareness and knowledge towards information security is conducive and, the top management of the bank do commit enough time, money and people to protect information resource of the bank and also information security issues are not communicated and explained to employees as expected and information security controls and policies are applicable in CBE.